Most scheduling platforms grew up in salons and bolted healthcare on later, or sell HIPAA back to you as an add‑on. MySpark+ was built for patient data from the first line of code, and the BAA is included in the price.
The Business Associate Agreement is executed self‑service during onboarding on every plan. Not a $297/mo add‑on, not an enterprise-only clause.
TLS in transit, encryption at rest for the database and file storage, and sessions in secure HttpOnly cookies that page scripts cannot read.
Every view and change of patient data is logged with who, what and when. Append‑only, retained six years, and viewable by clinic admins.
Front desk, providers, managers and admins each get scoped access. Sensitive actions like exports and staff changes are manager‑and‑up.
TOTP two‑factor login, enforced for administrator accounts and available to every user. Failed logins are rate‑limited and locked out.
Generate a complete patient record export on request. Exports are manager‑gated and purge themselves after seven days.
Automated daily backups with restore drills actually performed, not assumed. Deployed content is versioned so rollback is one step.
Outbound staff notifications are structurally split: patient names can appear on the in‑app bell, never in the emails or texts that leave the platform.
Patient communication consent is tracked per channel. STOP is honored instantly and permanently. Marketing sends respect quiet hours automatically.
When healthcare is an afterthought, compliance is a checkbox layered over a salon booking system. When software is born inside a working clinic, the boundary is architectural. In MySpark+, the rule that outbound staff texts and emails must never contain patient names is enforced by the build system itself: a release fails if a notification is wired wrong. Audit logging is not a feature someone remembers to call, it is required on every endpoint that touches patient data.
That is the practical difference between HIPAA‑compliant practice management software and practice management software with a HIPAA page.
Yes. MySpark+ was built for healthcare from the first line of code. HIPAA compliance with a signed Business Associate Agreement is included on every plan, at no extra charge.
Yes. The Business Associate Agreement is executed self‑service during onboarding on every plan. It is included in the plan price, not sold as an add‑on.
Yes. Every view and every change of patient data is logged with who, what and when. Audit records are append‑only and retained for six years, in line with HIPAA documentation retention expectations.
Data is encrypted in transit with TLS and at rest in the database and file storage. Sessions use secure HttpOnly cookies rather than browser‑readable tokens.
Yes. MySpark+ supports HIPAA Right of Access with a patient data export that managers can generate, and exports are automatically purged after seven days so copies do not linger.
HIPAA and the BAA come with every plan, from Studio at $29/mo, staff included.
View pricing
MySpark