HIPAA and Cannabis Clinic Software: Questions to Ask Every Vendor
No software is HIPAA compliant on its own. Compliance depends on the vendor signing a Business Associate Agreement, hosting data with providers that also sign BAAs, technical safeguards like access controls and audit logs, and your clinic's own policies and risk assessment. Ask every vendor for specifics on each of these before you enter patient data.
- Ask for a signed BAA before any real patient data goes in.
- Ask which hosting and storage providers hold your data.
- Look for role-based access, audit logs and locked signed records.
- Your clinic still needs its own policies and risk assessment.
The questions
- Will you sign a Business Associate Agreement with our clinic?
- Which cloud, database and file storage providers store our data, and do they sign BAAs with you?
- How is our data separated from other clinics' data?
- What does the audit log record, who can see it, and can anyone edit it?
- How are user roles and permissions enforced?
- How are uploaded documents stored and shared?
- What happens to a note after it is signed?
- How do we export our data if we leave?
Red flags
- "We're HIPAA certified" (there is no official HIPAA certification)
- No BAA, or a BAA only on an expensive tier
- Audit logs that administrators can edit
- Shared logins for staff
How Everchart approaches it
Everchart includes per-clinic data isolation enforced in the database, server-side role permissions, an append-only audit log, database-locked signatures and private document storage. Before a clinic enters real patient data, we review a BAA-backed hosting setup together.
Frequently asked questions
Is there such a thing as HIPAA certification for software?
No. HHS does not certify software. Vendors can be assessed by third parties, but compliance is shared between the vendor and the clinic.
This guide is general operational information, not legal or medical advice. Medical cannabis rules differ by state and change over time. Always follow your state program's current official guidance.