Is Your Software Truly HIPAA Compliant? A Checklist for Solo Therapists
A practical software-vetting checklist for solo therapists who need to evaluate EHRs, email, telehealth, and other tools through a HIPAA risk lens.
Software is not automatically HIPAA compliant because it is expensive, heavily advertised, or labeled for healthcare. A product can support a safer, more defensible workflow, but only when the vendor relationship, the technical safeguards, and your day-to-day practice habits all hold up. This checklist shows a solo therapist what to verify before trusting any tool with electronic protected health information, or ePHI.
Most therapists understand the ethical weight of confidentiality. What catches people off guard is the software side. Graduate school rarely gave anyone a practical manual for evaluating EHRs, email providers, calendars, telehealth tools, intake systems, or AI add-ons through a HIPAA lens.
Solo practitioners then assume the vendor has already handled the compliance work. HIPAA does not work that way. Vendors carry part of the load, and the rest lives in your contracts, your settings, and your habits around the tools.
If you are not sure whether your EHR, email, calendar, telehealth platform, or client intake stack belongs anywhere near PHI, use this checklist before you trust it.
If you need the broader foundation first, start with the plain-English HIPAA guide for solo therapists.
The non-negotiable starting point
Before you inspect a single feature, check the legal relationship.
Business Associate Agreement
- The vendor has confirmed whether it will sign a Business Associate Agreement.
- You have the signed agreement on file where applicable.
If a vendor is creating, receiving, maintaining, or transmitting ePHI on your behalf, the BAA is a core part of the relationship [1]. Asking for it is one of the fastest ways to separate healthcare-ready vendors from consumer-grade tools dressed up with better marketing.
A signed BAA is still only a contractual foundation rather than proof of full compliance. The product settings, security controls, and your own internal practices have to be sound on top of it.
To see the public language EasyMindCare uses around this, review the Business Associate Agreement page.
Technical safeguards to pressure-test
Most solo therapists assume these safeguards come automatically. Ask direct questions instead.
Authentication and unique access
- The system requires a unique account and secure authentication for each user.
- Password expectations, account recovery, and login security are described clearly.
Even if you are solo today, the software should not behave like a casual consumer app. Account access should be treated seriously from day one.
Access control
- Access to records or workflows can be limited based on who is authorized to see what.
This may feel less urgent when you are the only clinician, but it matters as soon as a biller, assistant, contractor, or future team member enters the picture. The existence of access controls tells you whether the product was built with healthcare realities in mind.
Session timeout and logoff controls
- The system supports session timeout, automatic logoff, or equivalent session-management controls.
What matters is whether the product reduces the chance that someone can walk up to an unattended device and access sensitive information.
Encryption in transit and at rest
- The vendor clearly states how data is protected while stored and while transmitted.
- The answers are specific instead of dissolving into vague marketing language.
Encryption is one of the easiest things for vendors to gesture at without explaining well. Vague answers are a warning sign. You are looking for a vendor that can speak clearly about how data is protected instead of hiding behind buzzwords.
Integrity controls
- The system has controls that help protect ePHI from unauthorized alteration or destruction.
The vendor does not have to read you a cryptography textbook. You need confidence that the system treats clinical records as data that must remain trustworthy and resistant to untracked changes.
Audit controls
- The system records meaningful access and activity logs.
- You can reconstruct who accessed what and when if something goes wrong.
Audit logs matter because they make the system more defensible under scrutiny, and together with the other controls they help separate serious healthcare infrastructure from generic software.
If you are evaluating a core record system specifically, the guide on HIPAA and EHR selection for solo therapists goes deeper on what these controls should look like in practice.
Administrative safeguards you still own
No software can do this part for you.
Written internal rules
- You have written policies for which tools are approved for PHI, how devices are secured, and how records are handled.
HIPAA risk lives in the product and in the workflow around it. The same app can be used thoughtfully or sloppily depending on the practice using it.
Periodic risk review
- You have a repeatable way to review software risk, device risk, and vendor changes over time.
Your stack does not stay frozen. Vendors change terms, add AI features, alter storage models, or raise prices. A tool that felt acceptable two years ago may deserve a second look now.
The fast red flags list
If a vendor cannot answer these questions clearly, slow down.
- They avoid the BAA question or push you toward consumer tiers.
- They use phrases like "HIPAA certified" or "fully compliant" without meaningful detail.
- They cannot explain logging, data handling, or access controls in plain language.
- They speak confidently about convenience and barely at all about record security.
- They make it hard to understand what happens to your data if you stop paying.
The last flag matters more than many therapists realize. For the ownership angle, read what actually happens when you stop paying your EHR.
A better way to think about compliance and architecture
Many solo therapists buy software as if the main question is whether the vendor is safe enough, and that is only part of it. The better question is how much control, clarity, and dependency the setup creates over time.
Different architectures create different risk boundaries. A shared cloud SaaS platform can be managed responsibly. A more ownership-oriented or dedicated setup can reduce some kinds of vendor dependence and make long-term retention questions easier to reason about. Neither approach removes the need for sound policies, secure devices, backups, access discipline, and ongoing review.
EasyMindCare pushes the same frame: solo therapists need simpler infrastructure, clearer responsibility, and less permanent dependence on bloated software rent.
To pressure-test the cost side of stacking tool after tool, the software rent calculator is the fastest place to start.
Use the checklist before you trust the tool
The point of this checklist is to replace vague fear with better questions. Clear answers from a vendor earn a longer look. Vague ones earn a pass.
Aim for a stack you can understand, defend, and live with over time rather than a perfect one.
To talk through BAAs, software sprawl, or EasyMindCare's approach to solo-practice infrastructure, request an EasyMindCare demo.
Quick note: any demos or previews use fake client data in a compliant environment.