What HIPAA-compliant practice management tools should a US private practice use for patient communication?
HIPAA-compliant patient communication tools for a US private practice must have a signed Business Associate Agreement (BAA) in place between the tool vendor and the covered entity (the practice). Tools that provide BAAs for healthcare practices include Kareo (patient messaging and appointment reminders with BAA), Athenahealth (integrated communication with BAA), Jane App (US market version with HIPAA BAA for SMS and email communication), SimplePractice (for mental health and allied health practices, with BAA), Klara (patient messaging platform for specialty practices, HIPAA-compliant with BAA), and Spruce Health (HIPAA-compliant SMS, phone, and secure messaging for small practices). For scheduling, Acuity Scheduling (a Squarespace company) offers a HIPAA-compliant plan with BAA; Calendly offers a HIPAA-compliant version at enterprise tier with BAA. Standard commercial Gmail, Google Workspace for healthcare (with BAA signed through the Google Workspace Admin console), or Microsoft 365 (with BAA signed through the Microsoft health industry agreement) can be HIPAA-compliant for email but require the BAA to be formally executed -- using a personal Gmail account or an organisational Google Workspace account without a signed BAA in place is non-compliant for PHI transmission.
How do I build a HIPAA-compliant automated recall system for annual preventive care in a US primary care practice?
A HIPAA-compliant automated recall system for annual preventive care in a US primary care practice is built by extracting last visit dates and eligible preventive care intervals from the practice management system (Kareo, Athenahealth, or similar), identifying patients who are 30-60 days from their annual visit due date, and triggering a recall message through a HIPAA-compliant communication platform with BAA coverage. The recall message itself must be carefully written to avoid including PHI in the message body -- the message should not name a specific diagnosis, test, or condition. A compliant recall message says something like "It may be time to schedule your annual visit with [Practice Name]. Call us at [number] or book online at [booking link]." The message does not reference the specific preventive care type, the patient's diagnosis, or any clinical detail. If the patient does not respond within 14 days, a second message is sent. The system tracks response and booking rates by patient cohort, allowing the practice to measure the revenue impact of the recall programme on Annual Wellness Visit capture rates and applicable preventive care billing codes.
How do I set up a HIPAA-compliant post-appointment patient satisfaction survey for a US private practice?
A HIPAA-compliant post-appointment patient satisfaction survey for a US private practice is sent through a communication platform with BAA coverage -- options include Klara, Spruce Health, or a HIPAA-compliant email platform such as Google Workspace with signed BAA. The survey is triggered 48 hours after the appointment is marked complete in the practice management system. The survey uses a standardised question set drawn from CAHPS (Consumer Assessment of Healthcare Providers and Systems) dimensions: communication quality, staff courtesy, facility experience, ease of scheduling, and overall experience rating. Survey responses are stored in a HIPAA-compliant data environment -- not in a standard Google Form without BAA. The results are aggregated in a dashboard that shows average scores by practitioner, by appointment type, and by month. For practices subject to CMS Merit-based Incentive Payment System (MIPS) measurement, structured patient satisfaction data is relevant to the Improvement Activities performance category. For practices not subject to MIPS, the data is used internally for practitioner performance review and operational improvement.
How do I build an insurance pre-authorisation tracking workflow for a US specialist practice?
An insurance pre-authorisation tracking workflow for a US specialist practice is built as a structured task management system in a HIPAA-compliant platform -- options include a HIPAA-configured Asana workspace (with BAA at Business tier), a HIPAA-compliant Salesforce Health Cloud instance, or a custom Airtable base with HIPAA BAA in place. Each pre-auth request is a record in the system with fields for: patient name and date of birth, procedure code (CPT), diagnosis code (ICD-10), payer name and plan, date of submission, submitted by, pre-auth reference number, status (submitted, pending, approved, denied, appeal in progress), approval or denial date, appeal deadline, and responsible staff member. When a new pre-auth request is required -- triggered either by a new appointment being booked that requires pre-auth, or by a clinical team request -- the system creates a task with a submission deadline. When the pre-auth is submitted, the record is updated and a follow-up task is created for 5 business days later. When an approval or denial is received, the record is updated and the patient and clinical team are notified through the practice management system. Denied pre-auths trigger an appeal task with a deadline calculated from the denial date. The dashboard shows all open pre-auths, their current status, their deadline, and the responsible staff member.
What is a Business Associate Agreement (BAA) and which practice management tools provide one for US healthcare providers?
A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a covered entity (a healthcare provider, health plan, or healthcare clearinghouse) and any vendor or subcontractor -- a Business Associate -- who creates, receives, maintains, or transmits protected health information (PHI) on the covered entity's behalf. HIPAA requires that a BAA be in place before PHI is shared with any third-party tool or vendor. Without a BAA, using a third-party tool to process, store, or transmit PHI is a HIPAA violation regardless of how secure the tool is. Practice management tools that provide BAAs for covered healthcare providers include Kareo, Athenahealth, Practice Fusion, AdvancedMD, DrChrono, SimplePractice, TherapyNotes, and Jane App (US version). Communication tools that provide BAAs include Klara, Spruce Health, Luma Health, and Solutionreach. Cloud storage and productivity tools that provide BAAs include Google Workspace (via the Google Workspace for Healthcare BAA in the Admin console, available on Business Starter tier and above) and Microsoft 365 (via the Microsoft Products and Services Data Protection Addendum, which serves as the BAA for Microsoft cloud services). A BAA is not a one-time document -- it must be maintained, updated when vendor services change, and terminated if the vendor relationship ends. Practices should maintain a BAA log listing every vendor handling PHI and the status of the BAA with each.
