HIPAA Compliance for GLP-1 and Weight-Loss Telehealth Clinics

The HIPAA compliance and security operating system for GLP-1 and weight-loss telehealth clinics. The consumer brand, clinical entity, prescriber network, pharmacy, and marketing stack rarely sit in the same company — and each one owes something different. Patient Protect maps who is covered, who is a Business Associate, then runs the risk analysis, agreements, training, and evidence across the chain.

Get your Patient Protect Score — free

“Wellness platform” is a marketing label, not a legal classification. Map the consumer brand, clinical entity, prescribers, management company, pharmacies, laboratories, and technology vendors; then determine which entity conducts an adopted transaction, acts as a Business Associate, or falls outside HIPAA. Every covered entity and Business Associate in the chain must perform its applicable duties below.

HIPAA compliance is not optional for a covered GLP-1 clinic.

If your practice is a HIPAA covered entity, it is required to maintain an active, documented compliance program — and if it performs covered functions as a Business Associate, it must implement the Security Rule and every other duty attaching to that role. The responsibility does not transfer to your EHR, IT company, consultant, insurance carrier, or software provider. Those partners can support the work; your practice remains responsible for completing it.

Watching one training video is not a compliance program. Downloading a policy template is not a compliance program. Signing one BAA is not a compliance program. HIPAA requires your practice to implement, maintain, and document the complete operating system behind each of those activities.

Your practice is required to do all of the following

The duty

What it requires

Where it is written

01Conduct and document a Security Risk Analysis
Identify every place electronic protected health information enters, moves through, or leaves the practice. Assess the systems, devices, people, vendors, locations, workflows, threats, and vulnerabilities that could compromise that information.
45 CFR §164.308(a)(1)(ii)(A)
02Manage the risks the analysis uncovers
Turn identified risks into a documented remediation plan. Assign responsibility, prioritize the work, implement safeguards, and preserve evidence showing how the practice responded.
45 CFR §164.308(a)(1)(ii)(B)
03Designate Privacy and Security Officials
Assign and document who is responsible for developing, maintaining, and enforcing the practice's privacy and security program. In a small practice, one person may perform both roles — but the responsibilities must still be assigned and documented.
45 CFR §164.530(a) · §164.308(a)(2)
04Maintain written policies and procedures
Document how the practice protects patient information, controls access, handles permitted disclosures, responds to incidents, enforces workforce accountability, and maintains required privacy and security safeguards.
45 CFR §164.316(a) · §164.530(i)
05Train the entire workforce
Train workforce members on the privacy policies relevant to their roles and maintain an ongoing security-awareness program. Preserve records showing who was trained, what the training covered, and when it was completed.
45 CFR §164.530(b) · §164.308(a)(5)
06Identify and govern every Business Associate
Determine which vendors and service providers create, receive, maintain, or transmit protected health information on the practice's behalf. Execute the required Business Associate Agreement before protected information flows and maintain the agreement as part of the practice's compliance record.
45 CFR §164.502(e) · §164.308(b) · §164.504(e)
07Implement administrative, physical, and technical safeguards
Control who can access patient information, secure the systems and locations where it is maintained, review activity, authenticate users, protect data integrity, and safeguard electronic transmission.
45 CFR §164.308 · §164.310 · §164.312
08Protect patient privacy rights
Maintain the required notices, authorization processes, complaint procedures, and workflows for responding to patient requests involving access, amendments, confidential communications, restrictions, and applicable disclosure accounting.
45 CFR §164.520 · §164.524 · §164.526 · §164.522 · §164.528
09Prepare for incidents, outages, and breaches
Maintain security-incident procedures, data backup, disaster recovery, emergency operations, mitigation, and breach-notification processes before an event occurs.
45 CFR §164.308(a)(6) · §164.308(a)(7) · Subpart D
10Preserve proof that the work was completed
Retain the assessments, risk decisions, policies, training records, official designations, BAAs, acknowledgments, incident records, and other documentation needed to demonstrate what the practice actually did.
45 CFR §164.316(b) · §164.530(j)

The Security Risk Analysis is where the work begins.

The Security Rule requires an accurate, thorough assessment of the risks and vulnerabilities affecting every form of electronic protected health information your practice creates, receives, maintains, or transmits. This is commonly called a Security Risk Analysis, or SRA.

The federal government publishes its own Security Risk Assessment Tool for small and medium-sized practices. You are not required to use that particular tool. You are required to perform and document the underlying analysis.

Patient Protect provides its own guided SRA. It walks the practice through the assessment in plain language, identifies what is missing, and carries those findings into risk management, remediation, policies, tasks, and documentation — so the assessment ends with the problem assigned and resolved, not merely named.

A five-minute readiness quiz is not an SRA. Reviewing only your EHR is not an SRA. Reusing an old checklist that no longer reflects your systems, vendors, workforce, or workflows is not an SRA.

That includes our own free tool. The Patient Protect Score is a free exposure scan and a starting point. It is not your completed Security Risk Analysis, and we will not tell you it is.

What a GLP-1 clinic’s Security Risk Analysis must cover

Calling the operation a wellness platform does not change the healthcare activity occurring underneath it. GLP-1 businesses must map the legal and data relationship among the consumer brand, clinical entity, prescriber network, telehealth platform, laboratories, pharmacies, marketers, and technology vendors.

The complete patient journey from advertisement and eligibility screening through intake, clinical evaluation, prescribing, fulfillment, monitoring, and discontinuation
Online intake, health questionnaires, identity verification, consent, EHR, telehealth, and scheduling systems
E-prescribing, laboratory ordering and results, pharmacy communication, fulfillment, and adverse-event workflows
Weight, photographs, biometrics, medication history, payment information, messages, and progress data
Email, text, patient support, coaching, refill, and asynchronous clinical communication
Affiliate, influencer, advertising, analytics, lead-generation, and tracking technologies that receive health-related information
The allocation and removal of access across brand personnel, clinicians, contractors, pharmacies, support teams, and vendors

What the GLP-1 compliance program must also address

A documented map showing which organization is the covered entity, which parties are Business Associates, and who is responsible for each required function
BAAs with every organization functioning as a Business Associate in the operating chain
State consumer-health privacy, consent, deletion, data-sale, and breach-notification requirements
Strict separation between permitted patient communication and marketing use of health information
Multi-state clinical licensure, telehealth-consent, prescribing, pharmacy, and breach-response requirements
Workforce training for clinical, support, marketing, affiliate, and operational personnel who can affect protected information

The consumer experience may look like ecommerce. The underlying information remains health information moving through a clinical operation.

The honest answer to the question glp-1 clinics most often misclassify.

Most vendor content gives a marketing-flavored hedge. The page below answers the question directly, with primary-source references where they exist. This is the section that matters most if you’re trying to figure out whether your operation is actually a covered entity.

Covered entity status

A GLP-1 telehealth clinic is a covered entity under 45 CFR §160.103 when it conducts one of the standard transactions adopted under 45 CFR Part 162 — or has one conducted on its behalf. Those transactions are a defined list: health care claims (837), eligibility inquiry and response (270/271), prior authorization and referral certification (278), claim status (276/277), payment and remittance advice (835), enrollment, premium payment, coordination of benefits, and retail pharmacy drug claims under the NCPDP Telecommunication Standard. Ordinary prescriber-to-pharmacy e-prescribing under NCPDP SCRIPT is not on that list. Prescribing semaglutide, tirzepatide, or a compounded GLP-1 agonist electronically therefore does not by itself establish covered-entity status. Marketing the operation as a 'wellness clinic' or 'consumer health platform' does not change the analysis either. The real work is mapping which entity in the stack — consumer brand, professional entity, prescriber network, management company, pharmacy — conducts a covered transaction, performs covered work as a Business Associate, or sits outside HIPAA while remaining squarely inside state consumer-health law.

Business associate status

GLP-1 clinics are providers, not vendors processing PHI for someone else, so they are not typically business associates. The BA question is critical in the reverse direction: every platform the clinic uses is a BA to the clinic and requires a written BAA under §164.308(b)(1). For GLP-1 telehealth that means the telehealth platform (Doxy.me, Zoom Healthcare, SimplePractice, custom builds), the e-prescribing service (Surescripts, DrFirst), every compounding pharmacy partner (503A and 503B both — the BAA requirement is identical), every clinical lab (Quest, LabCorp, Tasso, Imaware, regional partners), the patient onboarding/intake platform, the secure messaging tool, and the payment processor where PHI flows.

Where the gray zone lives

There is essentially no gray zone for the prescribing operation itself — if the clinic e-prescribes, it is a CE. The genuine gray-zone questions are: (1) Is a wellness or consultation-only consumer health platform that doesn't prescribe a CE? Probably not, but state consumer-health laws may still apply. (2) Is a clinic that uses a third-party prescriber network (the prescriber is technically a separate entity) a CE for the clinic itself? The clinic is at minimum a BA to the prescriber, and most operations functionally meet the CE definition through the records they maintain. (3) Are influencer or affiliate-marketing arrangements that collect health information part of the CE? If health data is collected and shared with the clinical operation, the marketer often becomes a BA, and consent disclosures must be handled as covered communications.

State consumer-health law

GLP-1 telehealth is the most state-law-exposed segment in healthcare. Washington's My Health My Data Act (RCW 19.373) prohibits collecting or sharing 'consumer health data' — explicitly including weight, dietary habits, biometric data, and medical conditions — without specific consent, with a private right of action, statutory damages, and injunctive remedies. Nevada's SB 370 (2023) imposes parallel obligations with explicit applicability to telehealth, wellness, and direct-care models. Connecticut's Personal Data Privacy Act, California's CMIA plus the CPRA health-data overlay, and the FTC's 2023 Health Breach Notification Rule clarification all add layers. Add to this: state telehealth licensing matrices, state pharmacy board e-prescribing rules, and FDA/DEA jurisdiction over compounded GLP-1s. The compliance program that satisfies HIPAA is necessary but not sufficient — the state-law layer requires its own consent management, data-minimization analysis, and breach notification matrix.

Operational events that move a GLP-1 clinic from theoretical non-coverage into clearly-covered-entity territory.

Submitting an electronic health care claim, or having any partner submit one on the clinic's behalf (837).
Running electronic eligibility or benefit verification against a health plan (270/271).
Requesting prior authorization electronically (278), or checking claim status (276/277).
Receiving electronic remittance advice (835) for any service line, including a cash-pay brand that bills insurance for labs or office visits.
Submitting a retail pharmacy drug claim under the NCPDP Telecommunication Standard, where the operation includes a dispensing pharmacy.
Performing a covered function as a Business Associate for another covered entity — which brings the Security Rule and the applicable Privacy Rule duties with it, independent of the clinic's own transaction status.

What does not, by itself, make you a covered entity: sending an electronic prescription, submitting an electronic lab order, receiving an HL7 or FHIR result, running a patient portal, making an ordinary electronic referral, storing treatment photographs, hiring a medical director, or performing a medical service. None of these appear on CMS’s list of adopted standard transactions. They may still carry real security and state-law obligations — they just are not what decides HIPAA covered-entity status.

OCR has not yet published a HIPAA enforcement action targeting a GLP-1 telehealth clinic specifically — the segment is too new for the precedent to have built. The FTC, however, has been active in adjacent territory: the BetterHelp settlement (2023) and the GoodRx settlement (2023) under the Health Breach Notification Rule signal regulatory attention on telehealth and consumer-health data sharing. The University of Baltimore Law Review 2025 piece on the segment flagged it explicitly as a privacy time bomb. The conservative reading: HIPAA enforcement will arrive, and operators with no compliance program will be among the first cases.

OCR enforcement record observation

Not legal advice. This page summarizes how HIPAA and related state consumer-health privacy laws apply to glp-1 and weight-loss telehealth clinics based on Patient Protect’s reading of the relevant CFR provisions and state statutes. Operators with applicability questions specific to their setup should consult a qualified HIPAA attorney. Patient Protect is a HIPAA compliance platform; we are not a law firm and do not provide legal advice.

Where glp-1 and weight-loss telehealth clinics are most exposed.

The 'we're a wellness platform, not a healthcare provider' misclassification

GLP-1 telehealth clinics frequently launch under consumer-DTC marketing framing and operate as if HIPAA does not apply. Individually, an electronic prescription, a lab order, or a stored treatment record does not itself establish HIPAA covered-entity status — the analysis turns on whether the clinic (or a service acting on its behalf) conducts a HIPAA standard transaction adopted under 45 CFR Part 162 (an 837 claim, a 270/271 eligibility check, an 835 remittance, etc.). In this segment, that most often happens through a billing or membership vendor, or through the clinic's own insurance-billed service line. Even where HIPAA does not apply, state consumer-health privacy laws (WA MHMDA, NV CHPA, CT DPA, CA CMIA/CPRA), FTC Health Breach Notification Rule enforcement, and prescriber/vendor recordkeeping obligations still impose substantial exposure.

Compounding pharmacy BAAs missing across the partner network

Most operators rely on three to seven compounding pharmacies. Each is a separate business associate. The BAA cascade is the most commonly-cited deficiency in this segment — and pharmacy partners frequently push back on revisions, leaving operators with stale or unsigned templates that will not survive an OCR review.

State consumer-health privacy laws apply regardless of HIPAA status

Washington MHMDA, Nevada CHPA, Connecticut DPA, California CMIA and the CPRA health-data overlay. Each applies to weight-loss and metabolic-health data with consent and notification requirements that go beyond HIPAA. Most GLP-1 clinics have no state-law consent management layer in place. State AG enforcement is the more likely first regulatory action than OCR for this segment.

Influencer and affiliate marketing collecting health data without consent infrastructure

GLP-1 customer acquisition leans heavily on affiliate and influencer arrangements that collect health information (weight, conditions, eligibility quizzes) before the patient ever reaches a clinical encounter. Health-data collection by marketing partners typically makes them business associates and requires consent, BAAs, and disclosure that most operators do not have in place.

Built for glp-1 and weight-loss telehealth clinics, not hospital systems.

Risk analysis calibrated for the GLP-1 telehealth-pharmacy stack

The SRA wizard pre-loads the threat model for telehealth-prescribing-pharmacy operations: e-prescribing, compounding pharmacy data flows, lab integrations, intake platforms, marketing affiliates. The output is a risk register modeled on the actual operation, not the dental or hospital threat model that competitors design around.

Pharmacy partner BAA tracking — 503A and 503B

The Vendor Risk Scanner tracks BAA status across the full pharmacy network with clause-level analysis specific to compounded medications. Surfaces missing or weak agreements, expiration alerts, and pharmacy-side BAA pushback patterns. This is the differentiator over generic compliance vendors that ship one BAA template and expect every pharmacy to fit it.

State consumer-health law overlay tracking

Patient Protect's policy generation produces consent disclosures, data-minimization documentation, and notification templates calibrated to Washington MHMDA, Nevada CHPA, Connecticut DPA, California CMIA/CPRA, and the FTC Health Breach Notification Rule. The state-by-state matrix updates as new laws come into force.

Multi-state breach notification matrix

When an incident hits in a 30-state operation, 30 different notification timelines start running. The breach response module pre-loads each state's requirements, AG-notification thresholds, and patient notification timelines. The alternative is reading 50 statutes while the clock is running on the shortest one.

Patient consent and intake management for telehealth + photo storage

Consent capture for telehealth-specific scenarios — multi-state licensure disclosure, controlled-substance prescribing, before/after photo storage as treatment records. Generated documents reflect both HIPAA and the state consumer-health law overlay rather than just one.

Continuous compliance scoring instead of an annual snapshot

GLP-1 operations change weekly — new pharmacy partner, new state, new marketing affiliate. The Autonomous Compliance Engine recalculates compliance state in real time so the practice never operates on a snapshot that is stale by the second day of the year.

HIPAA already requires the work. Patient Protect starts at $39 a month.

For a covered practice, HIPAA does not ask whether the organization has the budget, internal expertise, or spare time to build a compliance program. The obligation already exists. The only real question is whether you run it through spreadsheets, generic templates, disconnected training and scattered agreements — or keep the whole program in one place.

Guided Security Risk Analysis
Risk-management and remediation workflows
48 customizable policies and procedures
HIPAA Foundations workforce training
Completion tracking and verifiable training certificates
Workforce and vendor management
Business Associate Agreement tracking and documentation
Compliance scoring and centralized audit evidence

Start your 14-day free trial

$39 per office per month · Up to 25personnel · No long-term contract

State-specific HIPAA rules for glp-1 and weight-loss telehealth clinics.

HIPAA is federal. What a state adds on top of it varies more than most compliance guidance admits — some states impose their own notification deadline and regulator notice, and others exclude HIPAA covered entities from their breach statute entirely. Select your state to see which of those is true where you practice.

Select your state

Browse all 50 states and DC

Each jurisdiction sets its own notification window, regulator threshold, and adjacent privacy rules — and its own answer to whether those reach a HIPAA covered entity at all. Open a state page for the GLP-1 clinics reference summary.

What happens after the paperwork is done.

Every major compliance platform covers risk assessments and policy templates. This is the part that differs.

What to ask

Patient Protect

Risk analysis structured to §164.308(a)(1)(ii)(A)

A readiness quiz is not a risk analysis.

Full SRA wizard mapped to NIST CSF with live scoring

Auto-generated policies with workforce acknowledgment

HIPAA requires documented proof your staff reviewed them.

48 policies from your risk profile, versioned acknowledgment

Staff training with delivery tracking

§164.308(a)(5) — sending a PDF is not sufficient.

HIPAA Foundations — 19 modules, 95 assessment questions, verifiable certificates

Full BAA lifecycle management

Expired BAAs are a top enforcement target.

E-signature, renewal alerts, Vendor Risk Scanner

Yes on all 9. Now run the checklist on the rest.

From $39/mo · No long-term contracts.

Start free trial See pricing

Enterprise-grade compliance. Independent-practice pricing.

No contracts · No setup fees · Cancel anytime

Basic

$39/mo

Risk assessments, policies, BAA management, training, compliance scoring, secure messaging, and standard PIPAA usage.

Start 14-day free trial

Recommended

Pro

$99/mo

Everything in Basic, plus the patient-facing workflows. Patient Management and Digital Forms, expanded PIPAA usage, and up to 50 personnel.

Start 14-day free trial

See full feature comparison →

Common questions about HIPAA compliance for glp-1 and weight-loss telehealth clinics.

Does HIPAA apply to a GLP-1 telehealth clinic that markets as a wellness platform?

The marketing framing is not the analysis, but neither is prescribing. Under 45 CFR §160.103 an operation becomes a covered entity by conducting a standard transaction adopted under Part 162 — claims, eligibility, prior authorization, claim status, remittance, or a retail pharmacy drug claim — or by having one conducted on its behalf. Ordinary e-prescribing under NCPDP SCRIPT is not among them, so prescribing a GLP-1 agonist electronically does not by itself make the clinic a covered entity. Calling the operation a wellness platform does not make it one either. Map the entities, find which one transacts or performs Business Associate work, and document the result — and note that state consumer-health privacy laws reach the data regardless of where HIPAA lands.

We use a telehealth platform — isn't compliance their responsibility?

The telehealth platform is a business associate to the clinic and is responsible for the platform's compliance condition, but the clinic remains responsible for its own compliance program — risk analysis, training, BAAs with all other vendors, breach notification. The platform's BAA covers the platform, not the clinic's broader operation.

Do I need a BAA with every compounding pharmacy partner?

Not automatically — classify each one. A pharmacy that dispenses to the patient is acting as a treating provider, and provider-to-provider treatment disclosures do not require a BAA. A pharmacy or fulfillment partner performing a function on the clinic's behalf — running the clinic's fulfillment workflow, handling its patient data as a service to the clinic — is a business associate under §160.103 and requires a written BAA under §164.308(b)(1) before PHI flows. A 503A or 503B designation does not decide this; the actual function does. Skipping the classification, or relying on one master BAA to cover unrelated partners, are both common gaps in this segment.

What state laws apply beyond HIPAA?

Washington's My Health My Data Act (RCW 19.373), Nevada's Consumer Health Privacy Act (SB 370), Connecticut's Personal Data Privacy Act, California's CMIA plus CPRA health-data provisions, and a growing list of states. These laws cover weight, dietary, and metabolic-health data explicitly, and each imposes consent, data-minimization, and breach-notification requirements distinct from HIPAA. Enforcement differs law by law and is worth checking per state rather than generalizing: Washington's MHMDA is enforceable by consumers through the state Consumer Protection Act and California's CMIA carries its own private right of action, while Nevada's and Connecticut's statutes are attorney-general enforced. HIPAA itself has no private right of action.

Are before/after photos for weight-loss tracking PHI?

When stored in connection with treatment, yes. Photos that document patient response to medication are part of the medical record under HIPAA and require the same protections as any other ePHI. Operators that store photos in consumer-grade cloud platforms without a BAA, or that allow staff to use personal-device camera rolls, are routinely exposed.

How do DEA telehealth controlled-substance rules affect GLP-1 compliance?

GLP-1 medications are not currently controlled substances, so the DEA telehealth-controlled-substance framework does not directly apply. However, clinics that also prescribe controlled medications (some weight-loss combinations include phentermine, Schedule IV) are subject to DEA telehealth rules in addition to HIPAA. The compliance approach for clinics with mixed prescribing should account for both.

We started as a consultation-only platform and grew into prescribing — do we have to retroactively comply?

HIPAA obligations attach prospectively from the date of becoming a CE — no retroactive penalty for the pre-prescribing period. But the records the clinic holds from that period, if they include PHI from current patients, fall under the Privacy Rule once the clinic is a CE. The practical implication: compliance must cover both prospective operations and the patient records inherited from the pre-prescribing period.

Does a GLP-1 clinic have to complete a HIPAA Security Risk Analysis?

Every covered entity and every Business Associate in the operating chain does, which is why the entity map has to come first. Where an organization is covered, it must conduct and document an accurate, thorough assessment of the risks affecting all its ePHI. For a GLP-1 operation that means the full patient journey — advertisement and eligibility screening, online intake and questionnaires, identity verification, clinical evaluation, prescribing, pharmacy fulfillment, monitoring, and discontinuation — plus the weight, photograph, biometric, and messaging data generated along the way, and the affiliate, analytics, and tracking technologies that receive health-related information. A single analysis covering only the clinical entity's EHR misses most of the operation.

Which of our GLP-1 vendors need Business Associate Agreements?

Any organization performing a function involving PHI on the covered entity's behalf: the telehealth platform, EHR, intake and questionnaire tools, identity-verification service, patient messaging and support platforms, billing and payment processors handling PHI, cloud storage, analytics and tracking vendors receiving health-related data, and the management company where one operates the clinical workflow. Pharmacies dispensing to the patient and laboratories performing tests are generally treating providers, not business associates — a 503A or 503B designation does not change that analysis, the actual function does. Affiliates and influencers collecting health information are only business associates if they act on behalf of a covered entity; otherwise they are a state consumer-health privacy problem, not a BAA problem.

Our brand, clinical entity, and prescriber network are separate companies — which one is the covered entity?

Possibly none of them, possibly several, and the answer changes what each one owes. Coverage attaches to the specific legal entity that conducts an adopted standard transaction, or has one conducted on its behalf — not to the brand the patient sees. A consumer-facing marketing company that never transacts is typically outside HIPAA while still being reached by state consumer-health privacy law. The professional entity employing the prescribers is usually where coverage lands if anyone bills. A management company operating the clinical workflow is frequently a Business Associate of that entity. The failure mode in this segment is not getting the answer wrong; it is never running the analysis, so no entity has documented what it owes and each assumes another one is handling it.

Is the government's Security Risk Assessment Tool mandatory?

No. The government's SRA Tool is one method designed to help small and medium-sized organizations perform the required analysis. HIPAA requires the underlying risk analysis — not the use of one particular tool. Patient Protect provides its own guided SRA and connects the findings directly to remediation, policies, tasks, and documentation.

Does our EHR make the practice HIPAA compliant?

No. An EHR may provide important safeguards for the records it maintains, but it does not conduct the practice's complete SRA, remediate every identified risk, train the workforce, manage all policies, identify every Business Associate, prepare the practice for incidents, or preserve the full body of compliance evidence.

How much does Patient Protect cost for a GLP-1 clinic?

Patient Protect Basic costs $39 per office per month and includes up to 25 personnel. It includes the guided Security Risk Analysis, risk management, policies, workforce training, workforce and vendor management, BAA tracking, compliance scoring, and centralized documentation needed to operate the practice's core HIPAA compliance program.

See all FAQs →

Corrections & Updates

Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.

Submit a correction →

“

Patient Protect is intuitive, proactive, and affordable — exactly what small clinics like ours need to keep patient data safe and stay on the right side of HIPAA.

Dr. Thomas E Murray, D.D.S.Patient Protect Member Since 2017

Also built for

Dentists Therapists Chiropractors Optometrists Physical Therapists Medical Practices Telehealth Dermatology Pediatrics Psychiatry Urgent Care DPC Practices HRT / TRT Clinics Concierge Practices Med Spas

Compliance built for GLP-1 telehealth, not retrofitted from a hospital playbook.

$39/month for Basic, $99/month for Pro. Pre-loaded threat model, pharmacy BAA tracking, state consumer-health law overlay, multi-state breach notification. Free 14-day trial.

Get your Patient Protect Score — free See pricing

Or explore the full HIPAA compliance software comparison — or all HIPAA compliance solutions