Is a QR Code Check-In System HIPAA Compliant? What Therapists and Small Practices Need to Know

If you run a therapy practice, chiropractic office, acupuncture studio, or any small healthcare-adjacent business, you've probably asked some version of this question before adopting new software: does this put my HIPAA compliance at risk?‍ ‍

It's a fair question, and an important one. Here's a straightforward answer.

The short version

A client check-in system like Check-In App doesn't collect, store, or transmit Protected Health Information (PHI). When a client scans a QR code in your waiting room, all that happens is: they select their provider, and you get a text message letting you know someone has arrived. The notification doesn't include any identifying information by default — just a timestamp, like "Your client has arrived at 11:03 AM." Providers who want a bit more context can optionally enable initials (e.g. "J.S. has arrived at 11:03 AM"), but even that falls well outside the definition of PHI. No diagnosis codes, no treatment notes, no insurance information, no medical history — none of it ever touches the system.

Because of that, for most small practices, Check-In App falls outside the kind of tool that requires a Business Associate Agreement (BAA) under HIPAA.

Why that matters

HIPAA requires a BAA when a vendor creates, receives, maintains, or transmits PHI on your behalf. A check-in notification — "Your client has arrived at 2:14 PM" — isn't PHI. It doesn't reveal a name, a diagnosis, the nature of treatment, or any clinical detail. It's functionally similar to a front desk sign-in sheet, just digital and instant.

That distinction is what allows solo practitioners and small practices to use a tool like this without taking on the administrative weight of a formal compliance program built around it.

The bottom line

‍ Most small practices using Check-In App don't need to think about HIPAA compliance at all, because there's simply no PHI involved in what the system does. A de-identified arrival timestamp isn't a medical record — it's closer to a doorbell.

‍ If you're still not sure where your practice falls, reach out and we're happy to talk through it.