Is HoneyBook HIPAA compliant?

No. HoneyBook's own help center says "Currently, HoneyBook itself isn't HIPAA-compliant." It adds that "since HoneyBook's product isn't targeted to those industries, this isn't something that's prioritized." The article, dated April 30, 2025, doesn't mention a business associate agreement, the contract HIPAA requires with any vendor that holds patients' information.

That matters because HoneyBook markets itself to therapists. Its page for therapists talks about tracking "session history, progress notes, treatment goals" and sending consent forms. A practice that read that page could reasonably assume HoneyBook was built for it. By HoneyBook's own account, it wasn't.

Can a therapist use HoneyBook at all?

Yes, for work that holds no client health information. No, for client records, if your practice is a HIPAA covered entity.

CMS's guide says health care providers "who submit HIPAA transactions, like claims, electronically are covered." A practice that bills insurance electronically almost certainly is. A cash-only coach may not be. If you're unsure which you are, ask a healthcare lawyer. This is not legal advice.

What can stay in HoneyBook, and what has to move?

HHS defines health information as identifiable information, "including demographic data", about a person's health or "the provision of health care to the individual". For a covered practice, a client's name next to a service they booked counts.

What a practice's HoneyBook actually holds

Take a solo therapist who sees 25 clients a week and keeps four items in HoneyBook for each one. Those are the booking, the invoice, the payment and a message thread. These numbers are assumptions for the example.

That is 25 times 4, which is 100 items a week. Over 52 weeks it is 5,200 items a year, each tying a client's name to therapy, in a tool that says it isn't HIPAA compliant. Moving them is a project, so start with the export.

Which client tools sign a BAA?

We read each company's own pages on November 6, 2026.

If you want to swap HoneyBook for something that looks like it, Dubsado won't solve the problem. If you need notes and insurance claims, an EHR with a BAA is the cleaner move, since one BAA covers the notes and the bookings.

How do you move off HoneyBook?

1. Export your client list and records from HoneyBook before you cancel, and check what the export includes.
2. Sign the BAA with the new tool before you import anything.
3. Import active clients first, then past ones.
4. Rebuild your contract, consent and invoice templates.
5. Send new booking links to current clients, and turn off HoneyBook's booking page.
6. Delete the data from HoneyBook once the new tool has it, and keep a note of the date you did.

Where software fits

If your practice runs on an EHR such as SimplePractice or Jane, use it for everything clinical, and you may not need anything else.

If you want booking, client records, invoices and consent forms in one place next to an EHR, dailybuilt is one option. Its Healthcare Edition comes with a BAA on any plan. dailybuilt switches it on for your workspace, the owner accepts the BAA in the product, and online booking stays closed until then. It can produce superbills with your NPI and the client's ICD-10 codes, and the Foundation plan adds signed consent forms, including informed consent and telehealth consent templates. The Healthcare Edition turns off texts, AI features and ad tracking. You can export all of your data on any plan. dailybuilt is not an EHR and keeps no session notes. Plans are on the pricing page.

For how HoneyBook compares for businesses outside healthcare, see HoneyBook vs Jobber vs GoHighLevel vs dailybuilt. If you bill clients for insurance after a session, how to make a superbill for therapy covers the receipt.

Questions people ask

Will HoneyBook sign a BAA?HoneyBook's help center says it isn't HIPAA compliant and doesn't mention a BAA. Without a BAA, a covered practice shouldn't keep client information in it.

Can HoneyBook be used by healthcare providers at all?For work with no client health information, such as business contracts or workshop bookings, yes. For client records at a covered practice, no.

What is a business associate agreement?A contract between a HIPAA covered entity and a vendor that handles its patients' information. It commits the vendor to protect that information under HIPAA's rules. Without one, the practice shouldn't share client information with the vendor.

Is Dubsado HIPAA compliant?No. Dubsado's help center says "Dubsado is not HIPAA compliant."