HIPAA-Compliant Email For Practices Too Small To Interest The Big Vendors
Signed BAA, encrypted patient email and hosting for chiropractic, direct primary care and concierge practices — on servers we own in the United States.
The Short Answer
Yes, we sign a Business Associate Agreement, and the controls behind it exist rather than being promised. Encrypted patient email starts at $7.95 a mailbox a month, with website hosting, intake forms, backups and IT support for practices of one to ten people. It is built for chiropractic, direct primary care and concierge clinics — the practices the large compliance vendors write pages for therapists and hospitals and then ignore.
Yes, A Chiropractic Office Is Usually A Covered Entity
The test is electronic transactions, not the size of the practice
A health care provider becomes a HIPAA covered entity by transmitting health information electronically in connection with a covered transaction — eligibility checks, claims, referral authorisation and similar. A one-chair practice that does any of these is covered in exactly the same way a hospital is.
What that actually obliges you to do
A risk analysis, access controls, audit controls, transmission security and a written set of policies. It is not a certification you buy; it is a set of practices you maintain, and your vendors have to support it rather than undermine it.
Where a host fits in
We cannot make your practice compliant — nobody can sell you that. What we can do is sign a BAA, hold patient data on infrastructure we own in the United States, tell you in writing where it sits and who can reach it, and not be the weak link when you do your risk analysis.
Most solo practitioners genuinely do not know where they stand, and the answer is more specific than either extreme you will hear.
- We sign one, and it is not an upsell A signed Business Associate Agreement is part of onboarding, not a premium tier you discover later. If a vendor holding protected health information will not sign one, that is your answer about the vendor.
- It covers us, not everyone you use A BAA binds one vendor. Your practice management system, your imaging software, your billing service, your answering service and your backup provider each need their own. Most of the gaps we find are in that list rather than in the host.
- Signing is the floor, not the ceiling A signed agreement means nothing if the controls behind it are absent. Ours exist: access control and multi-factor authentication on administrative access, audit logging, encryption, tested restores and a written breach notification process. Ask us to show you, and ask your other vendors the same.
The BAA, And What It Does And Does Not Cover
Encrypted Patient Email Your Front Desk Will Actually Use
Built for people who are not technical
If secure email takes four extra clicks, staff will use their personal accounts instead and you will never find out. We set it up so the compliant path is the easy one.
Move PHI out of email where you can
The safest message is the one that does not contain protected health information at all. Intake forms, document exchange and a patient portal handle what email should not — Hub for Teams at $7.49 per user a month.
Retention and access you can evidence
Mail retention configured deliberately, access logged, and encrypted off-site backups from $2.09 a month with a restore we have actually run.
The most common HIPAA failure in a small practice is not a breach. It is a receptionist emailing an appointment reminder with a condition in the subject line.
- You may not be a covered entity at all A practice that never submits claims and never conducts a covered electronic transaction may fall outside HIPAA entirely. In practice most DPC clinics still do — e-prescribing, labs, referrals — so the answer is usually yes, but it is worth establishing rather than assuming in either direction.
- State law does not go away Even where HIPAA does not apply, state medical confidentiality and data breach statutes do, and several are stricter. We will tell you which questions to take to your counsel rather than pretend a BAA settles everything.
- Membership billing and the practice website Recurring membership billing, enrolment pages, a practice site that explains a model most patients have not encountered, and secure messaging. One-time and recurring payments are both supported.
Direct Primary Care And Concierge Practices
DPC physicians left insurance-based medicine to escape corporate control. The compliance picture is genuinely different, and almost nobody explains it properly.
- Signed Business Associate Agreement — included, not billed as an add-on
- Liberation Email from $1.95 per user/mo; Mail Pro $7.95 per user/mo — Mail Pro is the tier most practices use
- Hub for Teams $7.49 per user/mo for intake forms and document exchange
- Managed VPS from $59/mo on annual billing where the practice runs its own applications
- Website Builder $10.99/mo at the budget end, or a built practice site priced as a project
- CodeGuard encrypted off-site backups from $2.09/mo — an explicit line item in your security program, not an upsell
- SiteLock Fix $14.99/mo or Defend $49.99/mo
- Membership and patient payment processing — one-time and recurring
- Risk analysis support and practice IT scoped per clinic
What It Costs
Per mailbox, monthly. Small practices should not have to ask for a quote to find out.
Chiropractic, DPC & Cash-Pay Practices FAQs
Will you sign a BAA?
Yes, as part of onboarding rather than as a paid add-on, and the controls behind it exist: access control and multi-factor authentication on administrative access, audit logging, encryption, tested restores and a written breach notification process.
Is a chiropractic practice actually covered by HIPAA?
Usually. You become a covered entity by transmitting health information electronically in connection with a covered transaction — eligibility checks, claims, referrals. A solo practice doing any of those carries the same obligations as a hospital.
Does a BAA make my practice compliant?
No, and be careful of anyone who implies it does. A BAA binds one vendor. Compliance is your risk analysis, your policies, your training and an agreement with every vendor touching patient data. We make sure we are not the weak link.
We are a cash-pay DPC clinic. Does HIPAA apply to us?
Possibly not, if you never conduct a covered electronic transaction — but most DPC practices do, through e-prescribing, labs or referrals. And state confidentiality and breach laws apply regardless. It is worth establishing properly rather than assuming either way.
How much is encrypted patient email?
Mail Pro is $7.95 per mailbox a month, which is the tier most practices use. A three-person clinic is under $25 a month for email.
Can you move us without losing patient email history?
Yes. Mailboxes migrate with history intact and the cutover is scheduled outside clinic hours. We verify message counts on both sides before and after.
Ask Us For The BAA Before You Commit
Most vendors make you sign first and discover the agreement later. Ask to see ours, and ask what the controls behind it actually are. Then decide.
Custom Solutions
Take your business to the next level with Liberation's full suite of services & solutions.
Custom Management
Don’t like managing? We offer managed services for hosting, ecommerce, web sites, and more.
Our Promise Of Digital Independence
Liberating Your Digital World Is Our Passion
- U.S.A. owned and based
- We own and control our entire platform
- More security to protect your data
- No Censorship Guarantee
- 100% data ownership
- Your data is NEVER shared
Global Edge Network
Liberation’s global edge network provides enhanced performance & security.
Freedom Tech News
Stay informed on the latest tech news, new products, promotions, & more!
