Does DrChrono sign a HIPAA BAA?

Yes. DrChrono executes a Business Associate Agreement with covered entity practices. The BAA covers DrChrono's handling of PHI in the EHR, billing, and patient communication tools. It does not satisfy the covered entity's obligation to provide patients with a Notice of Privacy Practices.

What does DrChrono provide for HIPAA compliance?

DrChrono provides a BAA, HIPAA-compliant cloud EHR, encrypted data storage and transmission, audit logging, role-based access, and electronic patient intake forms. The intake forms are customizable by the practice — DrChrono does not supply a pre-built Notice of Privacy Practices as part of any plan.

What do I still need if I use DrChrono?

You still need a HIPAA-compliant NPP under 45 CFR § 164.520, updated to the HHS February 2026 model, posted on your public website, displayed at your physical location, and provided to each patient at first service. DrChrono does not produce or maintain this document.

EHR & Vendor

Does DrChrono Provide a Notice of Privacy Practices?

Q: Does DrChrono provide a Notice of Privacy Practices?

No. DrChrono does not provide a HIPAA Notice of Privacy Practices for your practice. DrChrono signs a BAA and offers a HIPAA-compliant EHR, but the NPP — required by 45 CFR § 164.520 — must be produced and distributed by your practice.

By NPP Generator Research Team · Published Apr 24, 2026 · Last reviewed Apr 24, 2026 · 4 min read

Key Takeaways

✓ DrChrono does not produce a HIPAA Notice of Privacy Practices for your practice
✓ DrChrono does sign a BAA — covering vendor handling of PHI, not patient-facing HIPAA notices
✓ DrChrono is a mobile-first EHR popular with small and independent practices
✓ Electronic intake forms in DrChrono are practice-customized; DrChrono does not supply an NPP template
✓ The NPP obligation belongs to your practice regardless of EHR

Quick answer: No — DrChrono does not provide a HIPAA Notice of Privacy Practices. It signs a BAA and provides a HIPAA-compliant cloud EHR, but the NPP — the patient-facing document required by 45 CFR § 164.520 — is your practice's responsibility to produce, post, and distribute.

DrChrono is a cloud-based, mobile-first EHR used by solo and small independent practices — particularly those who favor iPad-based charting and Apple device integration. Like all EHR platforms, DrChrono provides the infrastructure side of HIPAA compliance but does not produce the patient-facing documents required of the covered entity.

What DrChrono Provides

Business Associate Agreement. DrChrono executes a BAA with covered entity practices, committing to HIPAA obligations for PHI processed through the platform.
HIPAA-compliant cloud EHR. Encrypted records, audit logging, role-based access, and secure data transmission.
Electronic intake forms. Customizable forms for medical history, consent to treat, and other intake documents — but DrChrono does not supply a Notice of Privacy Practices.
Patient portal. Secure messaging, appointment requests, and document sharing.
Medical billing and coding. Claims submission through HIPAA-standard electronic transactions.

What You Still Need if You Use DrChrono

If you are a HIPAA covered entity using DrChrono, you must independently produce and maintain a Notice of Privacy Practices. The required elements under 45 CFR § 164.520(b) include:

HHS-prescribed header statement
Description of all permitted uses and disclosures of PHI
Disclosure of uses requiring patient authorization
All eight individual patient rights under HIPAA
Covered entity duties to protect PHI
Complaint procedures to internal Privacy Officer and HHS OCR
Privacy Officer name and contact information
Effective date — and, since February 16, 2026, the HHS revised model language integrating 42 CFR Part 2 SUD protections

You also must post the NPP on your public practice website, display it at physical service sites, and provide it to each patient at first service. See NPP requirements in 2026 for the full compliance checklist.

How to Add Your NPP to DrChrono

Generate your NPP as a PDF
In DrChrono, go to Intake Forms and create a new intake document
Upload the NPP PDF and configure it as a required acknowledgment for new patients
Post the same NPP on your public practice website and at your physical office

Frequently Asked Questions

Does DrChrono provide a Notice of Privacy Practices?▼

No. DrChrono provides a BAA and HIPAA-compliant EHR infrastructure but does not produce a Notice of Privacy Practices. The NPP is required by 45 CFR § 164.520 and must be produced by your practice.

Does DrChrono sign a BAA?▼

Yes. DrChrono executes a Business Associate Agreement with covered entity practices. This covers DrChrono's handling of your patients' PHI — it does not satisfy the NPP requirement.

What's the cheapest way to get a compliant NPP?▼

HHS publishes free model NPP templates, but you must manually fill in practice-specific details and add 2026 Part 2 language. NPP Generator captures your information via a guided intake and produces a formatted PDF and Word file in under 5 minutes for $49 one-time — no subscription.

Can DrChrono's intake forms replace an NPP?▼

No. DrChrono's intake forms are practice-customized documents for medical history, consent, and policies. They do not contain the mandatory regulatory content required by 45 CFR § 164.520. Both are needed independently.

Generate your NPP in under 5 minutes.

Upload the PDF to DrChrono's intake system, post it on your website, and you're covered. HHS February 2026 model with Part 2 SUD language. $49 one-time — no subscription.

Start your NPP — $49

Free watermarked preview available. See sample →