Acuity Scheduling alternative for HIPAA-covered practices

No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, and a private certification does not stop HHS from later finding a violation. The HHS Office for Civil Rights enforces the rule through complaints, compliance reviews and audits, so the evidence you hold is what an investigator will examine. Any vendor or consultant offering a HIPAA certificate for a self-hosted system should be asked to explain exactly what they reviewed and what they did not. Independent auditors and certification bodies issue reports in their own frameworks, and DeployOpen prepares systems, controls and evidence for those assessments but does not issue audit reports or attestations.

Keep a written, dated risk analysis that covers every place the booking system creates, receives, maintains or transmits electronic protected health information, including the web server, database, backups, email reminders and any calendar sync. Pair it with a risk management plan that records which risks you reduced, accepted or transferred, who approved each decision and when you last reviewed it. The Security Rule's administrative safeguards in 45 CFR 164.308 require this kind of documented process. NIST SP 800-66 Rev. 2 explains how to implement the rule and is a useful reference for structuring the analysis. Update the document when the hosting, the intake fields or the integrations change, because an assessor will compare the record against the live system.

Show a current user list in which every staff member has an individual account, with role or provider restrictions recorded for each, and a dated procedure for creating, changing and removing accounts. Unique user identification is a required implementation specification under 45 CFR 164.312, and access control decisions should trace to the minimum necessary staff who need each record. Keep evidence of quarterly or otherwise defined access reviews, the removal dates for departed staff, and how shared logins are prevented. Also document how emergency access to records is granted and logged, since emergency access procedures are required as well. Confirm in your own environment which Easy!Appointments roles and permissions meet these needs, and where your database and server administrator accounts are controlled.

Retain logs that show who viewed, created, changed or exported appointment and intake records, when the access happened, and from where. Collect application logs from Easy!Appointments, web server access logs, database logs for administrative changes, and operating system logs for administrator logins. Define how long you keep them, where they are stored and who can read them, and show that they are reviewed and that someone acts on anomalies. Protect the logs from alteration, because an investigator will ask whether they could have been edited. Confirm with your own security team which events the application records by default and which need configuration or a separate logging layer.

Hold a signed business associate agreement with every organization that creates, receives, maintains or transmits ePHI for you. Under 45 CFR 164.314(a)(2)(i), the contract must require compliance with the Security Rule, flow the same terms down to subcontractors that handle ePHI, and require reporting of security incidents, including breaches of unsecured PHI. For a self-hosted system in your own cloud account or data center, the hosting provider may need a BAA, and so may any email, SMS, backup or support firm that can reach the data. Keep a list of each vendor, the service, whether it touches ePHI and the date its BAA was signed. Each entity that cannot sign or refuses a BAA is a reason to change the design, not a gap to explain away.

Keep configuration files, certificate records and screenshots or scan output that show TLS is enforced for every web and database connection, that certificates are current and that plain HTTP is redirected. Also document how the MySQL database and backups are encrypted at rest, where keys are stored and who can access them. Encryption specifications in 45 CFR 164.312 are addressable, which means you must assess them and either implement them or document an equivalent alternative and the reasons for it. Record that assessment in the risk analysis. Ask your team to confirm the exact TLS settings, storage encryption method and key management in your environment, since those choices are yours to make and defend.

Keep a written incident response plan with named roles, steps for containment, investigation and recovery, and a log of every security incident and its outcome. Include a breach assessment procedure that decides whether an event involves unsecured PHI and triggers notification under the HIPAA Breach Notification Rule. Show the timelines your business associate agreements require from your vendors and how they reach you. Test the plan with a tabletop exercise and keep the notes and any corrective actions. A restore test from backups should sit in the same file, since availability is part of the Security Rule. Your legal counsel should confirm the notification obligations that apply to your practice and state.

No tool is HIPAA certified, and no HIPAA standard requires an entity to certify compliance. HHS states that private certifications do not prevent it from later finding a violation. Compliance is a set of safeguards, policies and documentation that your practice operates, and that applies to the covered entity and to any business associate that handles electronic protected health information. Under 45 CFR 164.314, a business associate contract must require the vendor to follow the Security Rule, flow the same terms to subcontractors and report security incidents. If an outside firm hosts or maintains the system, ask for a business associate agreement and check what it covers. Ask for the risk analysis and the written safeguards, not a compliance badge.

The software license is not the main cost. Easy!Appointments is free with no recurring fees or booking commissions, according to its website. Your recurring costs are hosting in a environment you control, backups, monitoring, patching, and staff time. One-time costs include installation, configuration, custom intake forms, reminders, integrations and the documentation your risk analysis needs. Costs rise with the number of integrations, the number of provider calendars, the amount of custom intake logic, and the audit trail you need. When requesting a quote, ask for fixed-scope line items, what is one-time versus recurring, who holds hosting and backup responsibility, and which environment is priced (cloud account, data center or existing hosting).

Duration depends on scope and environment, so no fixed figure applies. The main variables are the hosting environment you already have, how many services and providers you book, how much intake data you collect, whether you need payments or reminders built out, and how quickly your team can review the policies and the data inventory. Installation itself follows a known path: create a database, copy the files, edit the configuration file and open the install URL. The longer work is the safeguards around it. Agree on a timeline in writing, with scope, deliverables and review points, before any work starts.

A technically capable office can install a simple Easy!Appointments setup without outside help, because the install is a short sequence of steps. Running it for ePHI is harder. The Security Rule expects unique user identification, emergency access procedures, automatic logoff, encryption decisions and documented risk management. Custom intake forms, reminders and integrations add data flows that must be mapped and secured. Patching, backups, restore testing and access reviews are ongoing operating tasks. If your team has no security or systems owner, plan for outside support for setup, hardening and periodic review, and confirm who handles incidents.

Three things matter most. First, a named owner with authority to make decisions about the system and its risk. Second, a data inventory listing every field the booking flow collects, where it is stored, who can see it and how long it is kept, so intake data is limited to what scheduling needs. Third, sign-off on the policies that the Security Rule requires, including access, backup, incident response and workforce training. Also ask for access to the hosting account or a documented handoff, since your practice keeps the records. These inputs are usually what sets the schedule, so confirm them in the written scope.

Do not wait for it. HHS proposed a major Security Rule revision on 6 January 2025, published at 90 FR 898. As of October 2026 no final rule has been published, and the Unified Agenda projects final action for July 2027. The current rule applies now to any electronic protected health information you hold. The proposal would likely raise expectations for documentation, asset inventories and resilience testing, so the same inventory, risk analysis and backup records you build today will support later changes. Check the final text once it is published and confirm with your counsel which requirements will apply to your practice.