Under HIPAA, the risk of a careless vendor doesn’t stay with the vendor. If a tool handles your patients’ information without the right agreement and safeguards, your practice is the one out of compliance.
What “cheap” usually leaves out
- No Business Associate Agreement. HIPAA requires a signed BAA before any vendor creates, receives, stores or sends patient information for you (45 C.F.R. §§ 164.502(e), 164.504(e)). Many low-cost tools won’t sign one, or sign one their own vendors haven’t.
- Patient data sent wherever it’s cheapest. Consumer AI apps, text services and support teams that were never built for healthcare, and terms that let your patients’ data train someone else’s model.
- Too much in the message. Patient names, diagnoses and visit reasons in plain text messages that show up on lock screens.
- No consent controls. Texting without opt-out handling exposes your practice under the Telephone Consumer Protection Act, message by message.
- No audit trail. When something goes wrong, nobody can show who saw what, or when.
- Nobody accountable. No named leadership, no U.S. phone number, and no plan for your data if the company disappears.
What it can cost your practice
Federal penalties run up to $73,011 per violation, with annual caps of about $2.19 million for each type of violation.
North Memorial Health Care settled with HHS after giving a vendor patient data with no Business Associate Agreement in place. Raleigh Orthopaedic Clinic paid $750,000 for the same failure; a pediatric GI practice paid $31,000.
Statutory damages under the TCPA, per message. A careless texting tool and a patient list add up fast.
Healthcare has been the costliest industry for a data breach for 14 years running, and breaches of 500 or more patients are posted publicly by HHS.
Figures are the published maximums, settlements and averages cited. Actual exposure depends on the facts.
Seven questions to ask any vendor
Ask them of every tool that touches your patients. Here are our answers, in writing.
Built like the truck you’d take across the desert
Not the economy rental. DocsMD™ costs more than the cheapest option because it’s built to be there in year five: in writing, under a BAA, with real people accountable for it. It also pays for itself. Every recovered visit is itemized, and any month DocsMD doesn’t recover at least 2× your fee, your next month is free (up to three free months a year).
Who’s accountable
Built DocsMD™ to recover the revenue independent practices lose every day to missed calls, empty chairs and patients who never come back.
Physician, engineer and registered patent attorney with more than 35 years counseling medical-technology and healthcare companies. He keeps DocsMD™ built the way healthcare has to be: in writing, by the rules.
DocsMD LLC · Peoria, Arizona · (800) 299-9184 · hello@docsmd.com
General information, not legal advice. This page summarizes public rules, penalties and enforcement actions so practices can ask better questions. For advice about your practice’s obligations, talk to your own counsel.