Software is not compliant on its own
Compliance is a property of how a practice operates, not a badge a product carries. Software can support compliant workflows through access controls, audit logging and secure messaging, but configuration and staff behaviour determine the outcome.
This guide is general information for practice owners and is not legal advice. Confirm obligations for your practice with qualified counsel.
The business associate agreement
A vendor handling protected health information on your behalf generally needs to sign a business associate agreement. Ask for the BAA document during evaluation rather than after signing, and read which sub-processors it covers.
What to ask every vendor in writing
Written answers are the point; verbal assurances in a demo are not usable.
- Will you sign a business associate agreement, and can we see it now?
- How are user roles and permissions defined and audited?
- Is there an immutable audit log of record access and changes?
- How is data encrypted in transit and at rest?
- What happens to our data if we terminate, and in what format is it returned?
- Which sub-processors handle messaging, storage and payments?
Why we do not publish compliance claims
Our software profiles do not state that a platform is HIPAA compliant. We report only what a vendor has confirmed in writing, with the date of confirmation, because compliance posture changes and a stale claim on a review site is worse than no claim.
Frequently asked questions
Related reading
Buying Guides
How to Choose Med Spa Software
A structured way to evaluate med spa software without being led by feature lists, demos or discount deadlines.
Marcus Reyes · March 3, 2026 · 11 min read
Buying Guides
Med Spa Software Buyer's Guide
The full evaluation checklist: clinical, operational, financial and contractual questions to resolve before you sign.
Marcus Reyes · March 5, 2026 · 14 min read
Pricing
How Much Does Med Spa Software Cost?
The pricing models used across med spa platforms, and the line items that usually determine the real total.
Marcus Reyes · March 6, 2026 · 9 min read
Newsletter
The Med Spa Tech Brief
Software updates, new platform reviews, and practical technology insights for aesthetic practice owners.
No vendor-sponsored emails. Unsubscribe at any time.