Clinic and documentation software: what federal rules say
Therapy practices document care, schedule, and bill in electronic systems: electronic health records (EHRs), practice management software, and cloud documentation tools. This page does not rate products. It covers what HHS and the federal health IT office say applies when a practice puts patient records in software.
Quoted from official pages checked November 12, 2026. Confirm current requirements and dates on those sites. This page is not legal, tax, or compliance advice.
The vendor is usually a HIPAA business associate
HHS’s business associates guidance explains that a business associate is, generally, a “person” (which includes organizations) that performs certain functions or activities regulated by the HIPAA rules for a covered entity (paraphrased). HHS’s cloud computing guidance states that when a covered entity uses a cloud service provider (CSP) “to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf,” then “the CSP is a business associate”. It adds that “the covered entity (or business associate) and the CSP must enter into a HIPAA-compliant” business associate agreement (BAA).
The Security Rule
HHS’s Security Rule page states: “The Security Rule establishes a national set of security standards to protect certain health information that is maintained or transmitted in electronic form.” It sets out “administrative, physical, and technical safeguards”, and the page explains that the HITECH Act extended those safeguards to business associates (paraphrased). See also this site’s HIPAA basics and breach notification pages.
Certified health IT
The ONC Health IT Certification Program page states that the program “ensures that Certified Health Information Technology meets the technological capability, functionality, and security requirements adopted by the U.S. Department of Health and Human Services (HHS).” The page links the Certified Health IT Product List (CHPL), where certified products are listed. The pages read do not say that a therapy practice must use certified software.
Information blocking
HealthIT.gov’s information blocking page states: “Information blocking is a practice by an ‘actor’ that is likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or specified in an information blocking exception.” It says the Cures Act applied the law to health care providers, developers of certified health IT, and health information exchanges and networks (paraphrased).
Questions to ask a software vendor
These follow from the pages above; they are not an HHS checklist.
- Will the vendor sign a business associate agreement?
- Where is patient data stored and backed up, and how is access controlled and logged?
- How does the vendor report security incidents to the practice?
- Can patients and other providers get records out of the system in a usable electronic form?
- Does the system support the documentation your payers require, such as Medicare plans of care and progress reports?
What this page does not do
It does not name, compare, or endorse software, and it is not a HIPAA compliance review. Read the HHS pages in full and get qualified advice for your practice.