How HIPAA work integrates with the rest of running a practice — staff workflow, vendor onboarding, patient communication, and the operational decisions that shape compliance outcomes.
13 articles
Practice Operations is the human and procedural layer beneath the technology. Compliance breaks down most often not through technical failure but through operational drift: a new staff member never completes training, a vendor's BAA expires without notice, a workflow change introduces an exposure, a one-off accommodation becomes the norm. The articles below cover the operational discipline that keeps compliance current as the practice itself evolves.
Referral records leave most practices by fax or email because the alternative has always required the other end to adopt your software. That barrier is the problem.
Seven patient communication platforms that will sign a BAA, ranked by fit for independent practices. Where each is strong, where each is thin, and the workflow gap behind most communication breaches.
No Zapier BAA offering was identified. That alone disqualifies it for any workflow involving PHI. Practices that use Zapier to glue together healthcare tools are creating compliance exposure they may not see until an audit.
No published Stripe BAA offering was found. Most card transactions are not PHI under HIPAA — but billing context, descriptors, and integrations can introduce PHI. The line is narrower than most practices realize.
Adobe Sign, Adobe Acrobat Sign, Adobe Acrobat Pro, and Adobe Document Cloud are four different products with three different HIPAA stories. The naming overlap creates more OCR exposure than any e-signature platform should. This breaks the four apart and shows which one actually qualifies.
Loom's own documentation says it is currently not able to sign a BAA and asks customers not to send personal health information. That settles it for any video capturing or discussing PHI. Here is the gap and what to use instead.
You can have ten HIPAA-compliant tools and zero HIPAA compliance. The Franken-stack is what you get when operational pressure meets the absence of a compliance architecture.
Zoom offers a HIPAA-compliant option, but the free plan does not qualify. Here is what you need to set up before using Zoom with patients.
Microsoft Teams can meet HIPAA requirements — but only with the right Microsoft 365 plan, a BAA, and admin configuration. Here is the full guide.
Ten mistakes that recur across independent practices — not exotic security failures, but predictable operational gaps. Each one shows up repeatedly in OCR enforcement actions and breach reports.
Google Forms is named inside Google Drive on Google's HIPAA Included Functionality list, so it is covered by the Workspace organization's accepted BAA. Consumer @gmail.com accounts are never covered. Here is exactly what you need to configure and where Forms falls short for patient intake.
Calendly's Customer Terms and Conditions require you to warrant that your Customer Data contains no protected health information, and no published BAA offering was found on any plan. No configuration makes it fit for healthcare scheduling.
The compliance industry has spent a decade selling binders, templates, and consultant hours. The next generation of HIPAA platforms has to carry controls, not only records.
Related references
Training, BAA management, policy generation
10-minute scan of practice readiness
Implementation and rollout support
Direct primary care operations + 2026 HSA tailwind
Prominent-patient threat model, compartmentalized access controls
