Skip to content
    HIPAA Compliance

    HIPAA Compliant CRM and Marketing Software for Healthcare Practices

    LeadLeaf offers a HIPAA enabled environment for healthcare practices that need to store, send, or discuss protected health information. Eligible accounts run on a secure, access controlled server, LeadLeaf signs a Business Associate Agreement with every HIPAA enabled client, and the environment is available as a paid monthly add on to any LeadLeaf plan.

    HIPAA enabled secure server environmentSigned Business Associate Agreement includedAvailable as a monthly add on to any planCovers calls, texts, email, forms, and CRM recordsPricing quoted per practice

    Which practices need a HIPAA enabled account?

    Any organization that qualifies as a covered entity or business associate under HIPAA and transmits protected health information electronically needs a HIPAA enabled account. The practice types below typically fall into this category.

    Medical practices and primary care

    Plastic surgery and cosmetic surgery

    Medical spas and aesthetics

    Chiropractic care

    Dental and orthodontic practices

    Physical therapy and rehabilitation

    Mental health, therapy, counseling and psychiatry

    Dermatology

    Optometry and ophthalmology

    ENT and audiology

    Podiatry

    OB GYN and fertility clinics

    Pain management

    Urgent care and occupational health

    Weight loss, hormone and IV therapy clinics

    Home health, hospice and senior care

    Imaging centers and diagnostic labs

    Pharmacies and DME suppliers

    Medical billing and revenue cycle companies

    Veterinary practices (generally not covered)

    Veterinary practices, gyms, wellness coaches, and non clinical spas are generally not covered entities under HIPAA and usually do not need the add on. If you are unsure whether your practice qualifies, contact us and we will help you determine the right configuration.

    What is included in a HIPAA enabled LeadLeaf account?

    A signed Business Associate Agreement

    A dedicated secure server environment with encryption of protected health information in transit and at rest

    Role based access controls and permission management

    Audit logging of user activity

    Secure two way SMS and email

    HIPAA aware form and intake handling

    Secure storage of conversation and appointment records

    Restricted data retention and deletion controls

    Configuration support during onboarding

    What is a Business Associate Agreement and why does it matter?

    A Business Associate Agreement, or BAA, is a written contract required by HIPAA whenever a vendor handles protected health information on a practice's behalf. The BAA defines how the vendor safeguards that information, what happens in the event of a breach, and what obligations each party has under the law.

    Without a signed BAA, a practice cannot legally use a platform to store or transmit protected health information, no matter how secure that platform is. The BAA is the legal foundation that allows a covered entity to share PHI with a vendor like LeadLeaf.

    LeadLeaf signs a BAA with every HIPAA enabled client as part of the add on. The agreement is included in the HIPAA enabled environment and is put in place before any protected health information is stored or transmitted through the platform.

    Compliance is a shared responsibility

    LeadLeaf provides the secure environment, the controls, and the BAA. The practice remains responsible for its own workforce training, access management, policies, and how staff use the system.

    Shared responsibility between LeadLeaf and your practice for HIPAA compliance
    LeadLeaf providesYour practice manages
    Signed Business Associate AgreementWorkforce HIPAA training
    Secure server environment with encryptionAccess management and user permissions
    Role based access controlsInternal policies and procedures
    Audit logging of user activityHow staff use the system day to day
    Secure two way SMS, email, and formsReviewing audit logs and responding to incidents
    Data retention and deletion controlsDetermining what data to store and for how long

    How much does the HIPAA add on cost?

    HIPAA enablement is priced per practice based on account configuration and number of locations. It is billed monthly on top of your LeadLeaf plan. We will quote it on a short call so the price matches your specific setup.

    Request HIPAA Pricing Book a Demo

    HIPAA FAQ

    LeadLeaf offers a HIPAA enabled environment built to support HIPAA compliance. The environment includes encryption of protected health information in transit and at rest, role based access controls, audit logging, and a signed Business Associate Agreement. Using the HIPAA enabled environment is one part of a practice's overall compliance obligations.

    Need a HIPAA enabled CRM for your practice?

    Request HIPAA pricing or book a demo to see the secure environment in action.

    Request HIPAA PricingBook a Demo

    This page is general information about the LeadLeaf HIPAA enabled environment and is not legal advice. Consult your own compliance counsel about your obligations under HIPAA.