Compliance & Telehealth

The HIPAA-Compliant Tool Stack for a Solo Dietitian (Email, Video, Forms, AI)

Build a HIPAA-compliant tool stack for your solo nutrition practice: which email, video, forms, storage, and AI tools sign BAAs — and the common leaks to plug.

By Alva Health Team · Published July 12, 2026 · ← All articles

Most HIPAA violations in solo practice don't come from hackers. They come from convenience: the session note emailed from a personal Gmail, the quick client question answered over SMS, the intake PDF sitting in a consumer Dropbox. Each felt harmless in the moment; each put PHI into a tool with no Business Associate Agreement behind it.

The good news is that a compliant stack for a solo RD is neither expensive nor exotic in 2026. It mostly requires knowing one filter and applying it without exceptions.

The universal filter: the BAA

A Business Associate Agreement is a contract in which a vendor handling PHI on your behalf accepts HIPAA obligations. The rule that simplifies every purchasing decision:

No BAA = no PHI. Period.

Not "probably fine." Not "it's encrypted anyway." If the vendor won't sign — or your tier doesn't include one — client-identifiable information cannot touch that tool. This single filter disqualifies most free tiers, because free consumer products almost never come with BAAs.

Two caveats. First, a BAA is necessary, not sufficient: you still have to configure the tool sensibly (access controls, 2FA, sensible sharing defaults) and often enable the BAA in an admin setting rather than assume it. Second, vendor terms change — everything below reflects commonly known arrangements, and you should confirm the BAA in the specific plan you buy, in writing.

The stack, category by category

A few categories deserve detail.

Email

Paid Google Workspace can cover Gmail, Drive, and Calendar under Google's BAA for included services — but you typically must accept the BAA in the admin console; it isn't automatic. Paid Microsoft 365 business plans offer equivalent coverage. Even with a BAA, keep clinical detail out of subject lines and confirm addresses before sending — the BAA doesn't cover you emailing the wrong person.

Video

Telehealth-specific platforms built for healthcare include BAAs by default and are the low-friction choice. Major general-purpose vendors (Zoom among them) offer healthcare plans with BAAs — the key word is plans: standard consumer tiers don't qualify, and FaceTime has no BAA at all, so it's out regardless of how convenient it is. Vendor terms shift, so re-verify at purchase. While you're setting up video, get the billing side right too — see our guide to telehealth billing for dietitians.

Forms, e-signature, and storage

Your intake forms are PHI from the moment a client types a diagnosis into them. Use a form vendor whose plan includes a BAA, or better, an intake system inside an already-covered platform. Same logic for e-signatures on consent documents and for wherever the completed PDFs live afterward.

AI tools

Scribes, charting assistants, and automation platforms process the most sensitive content you generate — session audio and clinical notes — so the BAA filter applies with full force. Reputable healthcare AI vendors sign BAAs on paid tiers; consumer chatbots generally don't, and some free tiers use your inputs for training. Our guide to AI charting for dietitians covers what else to check, including recording consent.

Texting and reminders

The pragmatic pattern: use a reminder platform with a BAA, keep messages to date, time, and a link — no conditions, no clinical content — and document client consent to receive texts. What gets solo RDs in trouble is drift: the reminder thread slowly becomes a clinical conversation over unencrypted SMS.

The three common leaks

1. The personal phone. Client calls and texts on your personal number mean PHI in your personal message history, backed up to a consumer cloud with no BAA. Use a practice line or a covered communication tool.
2. SMS with clinical content. "How did the new meal plan go with your glucose readings?" is PHI over plaintext. Move clinical conversation into a covered portal or email.
3. Free-tier creep. The practice that started on paid Workspace but keeps a free Canva/Dropbox/notes app in the workflow "just for this one file." The BAA filter has to apply to every tool PHI touches, not just the main ones.

The 10-item self-audit

Run this quarterly. Every "no" is a task.

1. Does every tool that touches PHI have a signed BAA on file — including the tier you actually pay for?
2. Is your email a paid business plan with the BAA accepted in the admin settings?
3. Do video sessions run only on a BAA-covered platform (never FaceTime or a consumer tier)?
4. Are intake forms, consents, and their stored PDFs all inside covered tools?
5. Is two-factor authentication on for every account with PHI?
6. Is client communication off your personal phone number and personal inboxes?
7. Do text reminders contain zero clinical detail, with client consent documented?
8. Do your AI tools have BAAs, and is recording consent captured per session?
9. Are old devices, downloads folders, and exports free of stray PHI?
10. Could you list, from memory, every tool in your practice that stores PHI? (If not, inventory them today.)

For the fuller version with policies and training requirements, work through our HIPAA checklist for solo dietitians.

Compliance for a solo practice isn't a certification you buy — it's a short list of disciplined defaults. Apply the BAA filter once when you choose each tool, and you mostly never have to think about it again.

How Alva helps: Alva consolidates the highest-risk categories — intake forms, session recording and AI charting, reminders, and billing — into one BAA-covered platform, so there are fewer tools to audit and fewer places for PHI to leak. At $99/month, it shrinks both your stack and your checklist. Start a 7-day free trial — no credit card required.