9 min read
Abyde Alternatives for Small Practices (2026 Comparison)
Abyde prices by product, employee count and location. What its own calculator shows, and what the alternatives publish.
Find the gaps before OCR does.
Book your free 30-minute review
The library
Latest Articles
199 articles published
9 min read
6 min read
Compliancy Group Pricing (2026): What It Costs a Small Practice
Compliancy Group took its prices off its website in September 2026. Here is the last public list, dated, and the math for a 5 and a 10 person practice.
12 min read
HIPAA Small Breach Reporting: The Log and March 1
The misdirected fax was handled in April. The statement mailed to an old address was handled in August. Nobody has told HHS about either one, and the filing is due 60 days after the year ends.
9 min read
Is Stripe HIPAA Compliant? No BAA, Here Is What Works
Stripe is a superb card processor and a terrible place for a diagnosis. Its own agreement defines PHI, then tells you not to send it as third-party data.
9 min read
Is Salesforce HIPAA Compliant? BAA and Restrictions
Salesforce will sign a BAA through your account rep. Then its restrictions page puts encryption on you. You must encrypt all PHI you send, and the PHI you store where you control it.
9 min read
Is RingCentral HIPAA Compliant? BAA and Setup Guide
A cloud phone system turns every voicemail, fax, and text into a stored file. RingCentral can be covered under HIPAA. Old forwarding rules can be the problem.
10 min read
Is HubSpot HIPAA Compliant? Enterprise BAA Guide
HubSpot signs a BAA inside its Sensitive Data terms. PHI is then allowed in exactly the places HubSpot lists, and nowhere else, including your marketing emails.
9 min read
Is Google Gemini HIPAA Compliant? Workspace BAA Guide
There are at least four things called Gemini. One is on Google's HIPAA list, and one is explicitly excluded. With one, human reviewers may read some of your chats.
9 min read
Is Google Forms HIPAA Compliant? Workspace BAA Guide
Google Forms is on Google's HIPAA list, as part of Drive. The form your receptionist built on her own Gmail account last spring is not.
Key terms
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart C
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414
Keep going