Choosing Clinic Software: Questions to Ask Vendors About BAAs, Data Export and Pricing (2026)

Write down your must-haves

List what the system has to do on day one: your disciplines, number of practitioners, rooms and equipment, insurance billing or self-pay, online booking rules, intake, charting, telehealth, payments and reporting. Mark each as essential or nice to have.

Pick your three hardest workflows

The appointment that needs a specific practitioner and room, the course of treatment booked as a package, the visit that needs a form completed beforehand. These are the scenarios to test in every trial. If a system handles all three without workarounds, it will handle the easy ones.

Know whether HIPAA applies

If your clinic transmits health information electronically for standard transactions such as insurance claims, it is a HIPAA covered entity and every vendor holding patient data needs a business associate agreement. Cash-only practices may fall outside HIPAA but still have state-law obligations.

Will you sign a BAA, and when?

Ask for the agreement itself, not a statement of compliance. Vendors handle this differently. Jane’s guide tells clinics to sign a BAA with Jane and explains how to request one. Cliniko’s help centre explains that you enable its HIPAA setting, then request the BAA from your account’s privacy settings. Whatever the process, the agreement should be in place before you import patient data.

HHS’s guidance on cloud computing says a provider that stores electronic PHI is a business associate even if the data is encrypted and the provider holds no key. “We can’t see your data” is not a reason to skip the BAA.

Does the BAA contain the required terms?

45 CFR 164.504(e) requires the agreement to limit the vendor’s uses of PHI, require safeguards and Security Rule compliance, require reporting of breaches and unauthorized uses, bind subcontractors to the same terms, support patients’ access and amendment rights, open the vendor’s records to HHS, and require return or destruction of PHI at termination where feasible. HHS publishes sample provisions you can compare against.

Which subcontractors handle our data?

Ask which hosting, texting, email, payment and AI providers process your patients’ data, and where the data is stored. A reminder text goes through a messaging provider; an AI scribe may use a model provider. Each should be covered by the vendor’s own subcontractor agreements.

Which features are covered?

Some vendors exclude certain integrations or add-ons from their HIPAA coverage. Cliniko’s guidance, for instance, notes that using its features doesn’t make a practice automatically compliant and that some third-party integrations may not be HIPAA compliant. Ask which parts of the product and which integrations are in scope.

Can we export everything, ourselves?

Ask for a full export of patients, appointments, clinical notes, documents, invoices and payments, in documented formats such as CSV and PDF. Ask whether you can run it yourself or must request it, how long it takes, and whether there is a fee.

For certified health IT, there is a federal benchmark. ONC’s EHI export criterion, 45 CFR 170.315(b)(10), required certified Health IT Modules in products that store electronic health information to support exporting a single patient’s EHI at any time without developer help, and the whole patient population’s EHI, by December 31, 2023. Ask whether the product is certified and supports it. Many smaller practice systems aren’t certified, so ask what they offer instead.

Can we meet patients’ access requests?

Under 45 CFR 164.524, a covered entity must act on a patient’s request for their records within 30 days (with one 30-day extension if notified in writing), and provide an electronic copy in the form and format requested if readily producible. Your software has to make that practical: ask how a single patient’s record is exported.

What happens after we cancel?

Ask how long you can still log in and export after cancelling, and how and when the vendor deletes your data. The BAA should cover return or destruction of PHI; the subscription terms should give you a practical export window.

Scheduling

Can it book rooms and equipment as resources, handle packages and courses of treatment, restrict online booking by appointment type and patient status, run a waitlist, and send reminders with a reschedule link? Configure your three hardest scenarios in the trial.

Intake, charting and telehealth

Do intake answers flow into the chart? Are there templates for your discipline? Is telehealth built in and covered by the same BAA?

Billing and payments

If you bill insurance, does it submit claims and check eligibility, and through which clearinghouse? If you’re self-pay, does it handle card-on-file, packages and memberships? What are the card processing rates?

Reports

Ask to see the reports you actually use: no-show rate, practitioner utilisation, new patients by referral source, outstanding balances. If you rebuild them in a spreadsheet each month, the data is there but the reporting isn’t.

What adds to the base plan

Look at how vendors publish their own add-ons. Jane’s pricing page lists its Insurance Billing add-on at $20 a month plus $5 per additional full-time or $2.50 per part-time practitioner, and AI Scribe at $15 a month per opted-in practitioner. Cliniko lists SMS credits at 10¢ per message. Open Dental lists US support at $199 a month per office for the first 12 months, then $149, covering up to three providers with $20 a month for each additional provider, with data conversion priced separately.

Introductory pricing and notice periods

Check what happens after a discount ends: SimplePractice’s pricing page, for example, shows 50% off for the first three months. Check notice periods too: NexHealth’s pricing page says monthly plans need notice before the next billing cycle and annual plans need 90 days’ notice.

A worked annual estimate

An illustrative example using Jane’s listed prices: a clinic on the Practice plan at $79 a month for one full-time practitioner, with the Insurance Billing add-on at $20 a month plus $5 for one more full-time practitioner, spends $1,248 a year before the second practitioner’s own licence (which Jane prices separately) and card processing. Build the same table for each shortlisted vendor with your real team.

Taking “HIPAA compliant” as an answer

Compliance is a shared responsibility documented in a BAA. Ask for the agreement.

Importing data during the trial

Real patient data in a trial account before the BAA is signed is a compliance problem. Use made-up patients until the agreement is in place.

Never testing the export

Run a full export during the trial and open the files. If you can’t read them, neither can your next vendor.

Comparing base prices only

Add licences, add-ons, messaging, processing and onboarding before comparing.

Letting one person decide

Have a practitioner, the front desk and whoever does billing each test their part of the trial.

What should I ask a practice management software vendor?

Will you sign a BAA and can I see it; how do I export all my data and in what format; which subcontractors handle patient data; do you support multi-factor sign-in, roles and audit logs; can I test my hardest workflows in a trial; and what will a year cost for my clinic, itemised.

Does clinic software need a BAA?

If your clinic is a HIPAA covered entity and the software stores or transmits PHI for you, yes. HHS says this applies even if the vendor only stores encrypted data it can’t read.

What should be in a business associate agreement?

45 CFR 164.504(e) requires limits on uses of PHI, safeguards and Security Rule compliance, breach reporting, subcontractor obligations, support for patients’ rights, access for HHS, and return or destruction of PHI at termination where feasible.

Who owns the data in clinic software?

Your contract decides the practical answer. Ask for the right to export all data in documented formats, during the subscription and for a period after cancelling, without fees.

What is EHI export?

A federal certification criterion (45 CFR 170.315(b)(10)) requiring certified health IT that stores electronic health information to export a single patient’s data on demand and the whole population’s data, in a computable format. It applied from December 31, 2023.

What if no vendor fits our workflow?

Keep clinical records in a system whose vendor signs a BAA, and consider building the missing piece yourself. If you’d rather not do that by hand, an AI app builder such as Floot can build internal tools; it doesn’t offer a BAA, so use it only for data that isn’t PHI.