Doctible is a patient communication and engagement platform built for healthcare practices, including dental, orthodontic, chiropractic, and vision practices.

With Doctible, practices can automate appointment reminders, send two-way text messages, collect digital intake forms, manage online reviews, and run email campaigns.

Is Doctible HIPAA compliant? Yes, based on our research, Doctible can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed changes to Doctible’s HIPAA-related policies or BAA terms.

 

Will Doctible sign a business associate agreement (BAA)?

Yes, Doctible will sign a business associate agreement, which can be reviewed here.

 

What does the Doctible BAA cover?

The Doctible BAA covers the use and disclosure of protected health information (PHI), stating, "At Doctible, we constantly invest in processes and technology to support your every effort in upholding HIPAA’s privacy and security rules. Our data infrastructure is HITRUST CSF certified which means that we take extreme measures to protect all data and has all the right processes built in to ensure the security and compliance requirements that apply to a healthcare practice."

Doctible’s privacy and security procedures include the following:

  • Doctible does not sell, rent, disclose or use PHI without patient authorization or unless permitted or required by law.
  • Doctible employs security measures to store and protect PHI. PHI is firewall-protected and is under electronic surveillance 24 hours a day, 7 days a week.
  • Patient data is stored in a highly-secured data center, protected by multi-layer security. This means:
  • The servers that house the data are stored in a secured building with multiple layers of physical security.
  • At the network level, these servers are placed in a secure subnet and protected by firewalls.
  • The security of all server networks is monitored by an intrusion detection system that is staffed 24/7 by trained security professionals.
  • Within the database server, the data is stored in an encrypted form. Patient data is stored using AES encryption, with a key size of 256 bits.

Conclusion

Doctible signs a BAA and is therefore HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.