HIPAA compliant CRM
A HIPAA compliant CRM, and we sign your BAA
BaseCloud is HIPAA compliant, and we sign a Business Associate Agreement (BAA) with your practice. BaseCloud is HIPAA and HITRUST compliant: every BaseCloud cloud resource is tracked live against the HITRUST/HIPAA control set of 586 checks, and HIPAA is included on every plan.
See pricing · Every feature is on every plan.
At a glance
- We sign a BAA with your practice
- HIPAA and HITRUST compliant, with 586 live checks
- Audit logs kept six years in a tamper-proof archive
- Private lock-screen notifications in BAA accounts
- HIPAA included on every plan
The problem
Patient information needs a system built to protect it
A practice runs on calls, texts, reminders and notes about patients. Spread across a phone system, a texting app, a spreadsheet and someone's inbox, that information is hard to audit and easy to expose.
Patient names on lock screens
A notification that shows a patient's name or message on a locked phone puts health information in front of anyone nearby.
Every role opens every record
Front desk and billing staff see the same clinical notes as the practitioner, whatever their job needs.
Who opened that file?
When a patient or an auditor asks who looked at a record, the answer has to come from a log you can trust.
Vendors that stall on the BAA
Many software vendors stall when a practice asks for a Business Associate Agreement, and the practice carries the risk meanwhile.
How it works
How to get a BAA account
Ask BaseCloud for a BAA
Tell our team you handle health information, and we sign a Business Associate Agreement with your practice.
We switch your account
Our team switches your account to a BAA account. The change is recorded in the activity log.
Your team works as usual
Calls, texts, reminders and automations run exactly as before. Private notifications and the HIPAA notice switch on for every user.
What it does
HIPAA safeguards on every screen
HIPAA is included on every plan. Here is how BaseCloud protects your patients' information, from the first sign-in onward.
BAA accounts
Ask BaseCloud for a BAA and our team switches your account to a BAA account. Every change to that setting is recorded in the activity log.
Six-year, tamper-proof audit logs
Audit logs of file access, database activity, sign-ins, key vault reads and admin changes are kept for six years in a tamper-proof, write-once archive.
Microsoft Defender and malware scanning
Microsoft Defender protects the servers, the file store, the key vault and the database. Every file uploaded to BaseCloud is scanned for malware.
Private notifications
In a BAA account, phone and computer notifications read 'New message', 'Incoming call', 'Missed call' or 'Upcoming meeting'. Opening one shows the full details inside BaseCloud, and Mark as done still works.
- A HIPAA notice in Settings > your user > Notifications
- The BaseCloud Phone app shows the caller once the call reaches the phone
Permissions everywhere your team works
Permissions apply in the CRM, the Phone app, the API and connected AI apps. Field access hides a field in lists, exports, reports, merge tags and PDFs.
Staff access over a private network
BaseCloud staff reach the phone systems over a private network, and every sign-in is recorded by name. Staff access ends the moment someone leaves BaseCloud.
Encrypted Keys
API keys and passwords are stored encrypted in Settings > App Connections & Keys and never shown again, to anyone, the account owner included.
AI on BAA-covered providers
Workflow AI runs on OpenAI and Anthropic, the providers covered by a BAA. Connect any AI app whose provider has signed a BAA with your practice; Settings > AI Connections reminds every account of this before anything is connected.
Email that respects privacy law
Every bulk and automated email is marked Marketing or Transactional, so unsubscribes are respected under CAN-SPAM and GDPR while appointment confirmations always get through. South African practices are covered under POPIA too.
One platform
HIPAA protection runs through every BaseCloud feature
The same safeguards cover your phone system, your calendar, your AI receptionist and your automations. The security page gathers every proof point in one place for your compliance lead.
Security and trust
Permissions enforced everywhere, tamper-proof audit logs, malware scanning and encrypted keys.Phone system
Browser and mobile calling, numbers, IVR, ring groups and transfers.AI receptionist
An AI voice that answers your calls, books appointments and hands callers to your team.CRM calendar and scheduling
Google and Outlook calendar sync, team scheduling, reminders and AI booking.
Popular with
Learn more
- Security and trust at BaseCloudEvery safeguard on one page, ready to send to your compliance lead.
- BaseCloud is HIPAA compliantThe announcement, and how to get a BAA account.
- CASA Tier 2 certifiedBaseCloud's independent security assessment.
- HIPAA compliant phone systemCalls and texts for practices, from the blog.
FAQ
Questions buyers ask
Do you sign a BAA?
Is HIPAA included on every plan?
Can patients get appointment reminders by text?
Can we connect our EHR?
Which AI providers are covered?
Are calls and texts covered?
Run your practice on a HIPAA compliant CRM
Book a demo and we'll show you a BAA account on a live screen, from private notifications to the audit trail, and send your BAA for signing.