Practice Binder

For solo & small therapy practices · Free early access

If you can't prove it, HIPAA says it didn't happen.

HIPAA Compliance Binder

Riverbend Therapy, PLLC

Generated August 1, 2026 · Practice Binder

Gap summary

Security risk assessmentCurrent
Access review (Q3)Due in 12 days
BAA — Google WorkspaceMissing

+ 14 pages of dated records, organized by category

You did the training. You signed the BAAs. You thought about risks. But if it's scattered across folders, inboxes, and half-finished spreadsheets, an auditor sees nothing. Practice Binder keeps your proof organized, dated, and one click from a clean PDF binder.

🔒 Zero patient data. Ever. That's a feature — read why below.

The spreadsheet isn't the problem. Finding it under pressure is.

🗂️

Scattered proof

Training certificates in email. BAAs in a drawer. The risk assessment… somewhere. Each one exists; none of it is findable.

📅

Silent deadlines

Annual risk assessment. Annual training. Quarterly access reviews. BAA renewals. Nothing reminds you — until a records request does.

😨

The 3am question

“If OCR asked tomorrow, could I hand them anything?” For most small practices the honest answer is a long, anxious pause.

What's inside

Behind the gap summary: every record, dated.

Page one tells an investigator what's missing. The pages behind it prove everything else — each category in its own section, every entry dated, with the regulation it satisfies printed alongside. Exactly the shape of documentation an investigator, insurance panel, or attorney asks for.

  • Staff HIPAA training log — who, what, when, certificate reference
  • Security risk assessments with next-due dates
  • Quarterly access reviews
  • Security incident log with mitigation steps
  • BAA tracker across EHR, email, storage, telehealth, billing
  • Policy & procedure review history
Build my binder

Staff HIPAA Trainings

45 CFR §164.308(a)(5)

Dr. Rivera — HIPAA Basics

Jan 15, 2026

Current

Dana Kim — HIPAA Basics

Jun 20, 2025

Overdue

Business Associate Agreements

45 CFR §164.308(b)(1)

SimplePractice (EHR)

Signed Feb 1, 2025

Current

Google Workspace (Email)

Not on file

Missing

Every record, dated and grouped by category.

What Practice Binder does not do — on purpose

Practice Binder stores zero protected health information. No client names. No session data. No notes. Nothing about the people you treat — only your practice's own compliance activity.

Why this matters to you

Pasting client details into general-purpose tools (spreadsheets in personal accounts, AI chatbots, note apps) without a BAA is itself a HIPAA problem. Practice Binder is built so that mistake can't happen here.

What that means legally

Because no PHI ever touches Practice Binder, we are not a business associate and you don't need a BAA with us. One less agreement to track — in the tool that tracks your agreements.

Questions therapists ask us

Does Practice Binder store any patient or client information?

No — by design, and we're loud about it. There are no fields for client names, sessions, diagnoses, or notes anywhere in the product. Practice Binder tracks your practice's own compliance activity: trainings completed, assessments done, agreements signed. That means we are not a business associate and no BAA is needed to use it.

Is this legal advice? Will it make me HIPAA compliant?

No. Practice Binder is a documentation and organization tool. It helps you keep the dated, exportable proof that you did the work — which is what an auditor asks for — but it doesn't replace a compliance attorney, official OCR guidance, or actually doing the underlying work.

What do I get when an auditor (or insurance panel) asks for documentation?

One click generates a dated PDF compliance binder: a gap summary up front, then every record organized by category — trainings, risk assessments, access reviews, incidents, BAAs, and policy reviews.

How much does it cost?

It's free during early access. If we ever charge, early users will get generous grandfathering and plenty of notice.

What about my certificates and signed BAAs — do I upload them?

You keep the actual files wherever you already store practice documents. Practice Binder records the file name/location as a reference, along with the dates that matter. Your binder points to everything without us holding any of it.

I'm a solo practice. Is this overkill?

Solo practices are held to the same HIPAA documentation standards as group practices — annual risk assessment, annual training (yes, for yourself), signed BAAs, and written policies. The requirements don't scale down; the tooling should.

Be able to answer the 3am question.

Set up takes about 5 minutes: answer 8 questions about your practice and Practice Binder builds your compliance checklist with the right due dates.

Not ready yet? Get occasional, genuinely useful compliance reminders: