Which med spa software offers a BAA?
Prospyr and several other practice platforms offer Business Associate Agreements. Compare how the agreement is signed and what your account needs before you add patient information.
Published by Prospyr · Reviewed September 8, 2026
Prospyr offers a BAA.
Review the agreement with your onboarding team, alongside the clinical tools, patient communication, and integrations your practice will use.
Talk through your Prospyr setupHow other platforms arrange the agreement
| Platform | BAA process | Part of your setup review |
|---|---|---|
| PatientNow | Published BAA tied to the order form | Effective date and the entity on your order |
| Boulevard | Sign in the dashboard with HIPAA coverage | Medspa package or add-on and account settings |
| Zenoti | Arrange a signed BAA with Zenoti | Execution before storing patient information |
| Mindbody | Notify support and request its BAA | Agreement in place before PHI use |
| Jane App | Request the standard BAA | Agreement for your practice and account |
| Mangomint | Request enablement; sign the supplied BAA | Wait for HIPAA enablement confirmation |
| Vagaro | In-app BAA signing during HIPAA setup | Read the agreement and configure notifications |
For Aesthetic Record, Moxie, and Pabau, obtain the agreement and signing instructions directly during your sales review. Public signing instructions were not established in this audit; that is not a finding that they do not offer a BAA.
This compares the signing process, not a security ranking. Plan terms and covered services belong in the agreement you review.
What the agreement does
A BAA sets responsibilities for a vendor handling protected health information on behalf of a covered entity, including permitted uses and safeguards. Both covered entities and business associates can have direct obligations under HIPAA. HHS explains the relationship.
Review the covered services, subcontractors, incident reporting, and what happens to patient information when the agreement ends. See HHS’s sample BAA provisions.
Med spa BAA questions
Does Prospyr offer a Business Associate Agreement?
Yes. Ask the Prospyr team for the agreement as part of your onboarding review. Review its scope alongside your account configuration and any connected services before adding patient information.
When does a med spa need a BAA with its software vendor?
When the practice is a HIPAA covered entity and the vendor handles protected health information on its behalf, a business associate agreement is generally required. Covered-entity status depends on the practice’s activities, including standard electronic transactions; being a med spa alone does not settle that question.
Does HIPAA-compliant software make my practice compliant?
No. Software and a signed BAA are parts of the arrangement. Your practice still needs appropriate access controls, staff training, policies, and safeguards for how patient information is used. Review your own obligations with qualified compliance counsel.
What if a vendor does not publish its BAA online?
Ask for the agreement directly. Many commercial agreements are supplied during sales or onboarding. A missing public signing guide does not prove that the vendor refuses a BAA or that its software is unsuitable.
Does one BAA cover every integration and communication channel?
Do not assume it does. Review the agreement’s covered services, the vendor’s subcontractor arrangements, and any separate tools your practice connects. Messaging, photos, AI services, prescribing, and labs may have distinct terms or configuration requirements.