Therap Services is an electronic health record and documentation platform designed for intellectual and developmental disability (I/DD), home and community-based services (HCBS), and long-term services and supports (LTSS) providers and government agencies. Organizations can use the platform to document health information, manage incidents, coordinate care, support electronic visit verification, and handle billing and claims.

Is Therap Services HIPAA compliant? Yes, based on our research, Therap Services can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed changes to Therap Services’ HIPAA-related policies or business associate agreement (BAA) terms.

Therap continues to state that its platform is HIPAA compliant. Its current website also says the company completes an annual SOC 2 Type II assessment and uses ISO 27001-certified data centers. Therap’s website privacy policy was last updated on November 19, 2025, and does not announce a narrower HIPAA scope or a change to BAA availability.

 

Will Therap Services sign a BAA?

Yes, Therap Services will sign a BAA. our previous review found that the BAA was included in Therap’s 41-page End User Legal Agreement.

Therap does not currently provide a working public link to that agreement or a downloadable BAA on its website. Organizations should therefore request and review the current BAA directly from Therap Services before entering or transmitting PHI.

 

What does the Therap Services BAA cover?

Therap states, “Therap is built HIPAA-compliant from the ground up, with dedicated IT security and operations teams overseeing data protection.”

Therap’s legal notice also requires authorized users to comply with HIPAA and other federal and state privacy requirements when accessing PHI through the platform.

 

What does the Therap Services BAA exclude?

Therap’s current public materials do not identify specific services, modules, data types, or healthcare use cases that are excluded from its BAA. Because the current BAA is not publicly available, organizations should review the executed agreement to confirm whether it covers every module, integration, support channel, and data flow they plan to use.

Therap’s website privacy policy is separate from its BAA and states, “This Policy does not apply to information that our customers collect or process through the Services.” This distinction means the website privacy policy should not be used to determine the contractual scope of protection for patient or resident information stored in Therap.

 

Conclusion

Therap Services was previously found to sign a BAA and is therefore HIPAA compliant. Organizations should obtain the current BAA and confirm that it covers their intended services and data flows before using Therap Services with PHI.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.