HIPAA Questions Before Choosing a Care Coordination Tool

Any software vendor selling to healthcare providers will tell you they take HIPAA seriously. Many of them have a badge on their website. Some have a SOC 2 report. A few have a sentence in their terms of service that mentions the Health Insurance Portability and Accountability Act. Almost none of them will tell you specifically what controls they have in place, what they are responsible for under a Business Associate Agreement, and what obligations remain with your practice.

This is not a compliance guide. If your practice needs a full HIPAA risk analysis before adopting new software, engage a qualified healthcare compliance attorney or consultant rather than rely on a blog post. This is a practical framework for vendor conversations before you share patient information with their systems.

The Business Associate Agreement sets a baseline

Under HIPAA's Privacy and Security Rules, a vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) for a covered entity must have a signed Business Associate Agreement (BAA). This is a legal requirement. If a vendor handles patient data but has not offered a BAA, treat that as a significant red flag.

A signed BAA has limited meaning unless you understand the vendor's specific commitments. It establishes the vendor's responsibility for certain PHI protections in its systems. It does not ensure that those systems are secure, that access controls are adequate, or that your practice has met its obligations under the Security Rule. The BAA begins the compliance relationship, but it is not the substance of that relationship.

We execute a BAA with every clinical practice that joins CTPathways. We also explain the protections it represents instead of treating a signed BAA as a compliance checkbox. Asking what a vendor's BAA actually commits it to is reasonable and important.

Controls that matter for outreach tools

A care coordination tool that sends SMS or email to patients operates in a HIPAA-sensitive area. Outreach messages may contain PHI, including indirectly. "This is a reminder about your appointment with Dr. Smith on Tuesday" identifies a name, provider, and appointment, which qualifies as PHI in context. Its transmission, storage, and protection all matter.

Ask about data in transit and data at rest. Data in transit is message content moving between your EHR, the vendor's system, and the patient's device. Data at rest is the stored message record in the vendor's database. Both should be encrypted. Standard SMS is not inherently encrypted in transit, so vendors sending HIPAA-compliant SMS generally use SMS gateways with specific logging controls and patient consent frameworks.

Ask vendors plainly: how do you manage SMS transmission and logging for HIPAA compliance? What data do you retain, for how long, and who can access it? What happens to patient data when a practice ends its relationship with you? These are necessary questions before you share patient identifiers with any system.

Access control matters

Alongside encryption, the HIPAA Security Rule's Administrative Safeguards require covered entities and their business associates to implement role-based access controls. For a care coordination tool, ask who at the vendor can view patient data in your account, under what circumstances, and with what audit trail.

Review access controls within the tool as well. Can you determine which staff members may view particular patient records? Can you limit access to coordinators assigned to specific care teams? Can you review an audit log showing who accessed what and when? These are not luxuries for small practices. They support the access management requirements your practice carries under HIPAA, and the vendor's system needs to support them.

At minimum, verify that the vendor logs record-level access to PHI, makes those logs available to you, and lets you revoke access when staff members leave your practice.

Consent and patient communication

Outreach tools function within a complex consent environment. HIPAA permits covered entities to communicate with patients for treatment purposes without separate written authorization, so appointment reminders and post-visit follow-up messages are generally permissible. Still, the rules governing what you may send, how, and under what circumstances are not simple. They also interact with state privacy laws and federal HIPAA requirements.

A few things to verify with any outreach vendor: does the system document patient communication preferences, including opt-outs? Is there a clear mechanism for patients who decline automated outreach to have that preference honored across all subsequent communications? Does the system respect CAN-SPAM requirements for email and TCPA requirements for SMS, in addition to HIPAA considerations?

We are not saying every vendor must resolve every edge case in patient communication consent. The legal landscape is genuinely complex and varies by state. But a vendor unable to explain its handling of patient opt-outs and communication preferences is not one whose compliance posture you should trust with PHI.

What compliance should look like early on

For an early-stage healthcare software company, HIPAA compliance is an ongoing process, not a settled state. The aim is to protect patient data, maintain appropriate audit trails, execute BAAs with customers, and document policies for breach response and security incident management. No growing company has a perfect compliance posture at every moment. What matters is a correctly oriented posture, a team that understands what it is building and why the controls exist, and honesty about limitations.

Be skeptical of vendors that present HIPAA compliance as complete and fully solved. Be even more skeptical of vendors that deflect specific questions or send you entirely to their legal team without describing their own controls. Also question vendors that portray HIPAA compliance as a constraint to work around instead of a legitimate protection for patients in your care.

The practices we work with take their HIPAA obligations seriously. So do we. That shared seriousness is the basis for a trustworthy vendor relationship in healthcare, not a compliance badge on a landing page.