Every practice signs its own agreement.
Not a checkbox at sign-up. A real agreement, sent, signed and countersigned, before anything is collected on that practice's behalf.
Three arrangements, because there are three situations.
The right instrument for the jurisdiction.
A practice in the United States signs a business associate agreement. A practice under GDPR signs a data processing agreement.
A veterinary practice signs a data protection and confidentiality agreement, because animal records are not protected health information and sending a vet a HIPAA contract would be papering the wrong statute.
You can always see where every practice stands.
Sent, signed, countersigned, expiring. Send reminders, withdraw one, or download an executed copy.
A practice whose agreement lapses stops collecting, automatically.
Start by finding out what your websites are leaking.
A free scan of any practice site tells you in ninety seconds which trackers are loading on pages that collect patient information. No account, no card.