Most practice owners assume that if their EHR is compliant and their bookkeeper is trustworthy, their financial records are covered.

Here's the problem: QuickBooks is not HIPAA compliant. Intuit says so directly in their own support documentation, and they will not sign a Business Associate Agreement. Without a BAA, no vendor is authorized to hold PHI on your behalf. That means any patient information sitting in your QuickBooks file is outside your compliance boundary, no matter how secure the rest of your systems are.

To be clear, you can absolutely use QuickBooks as a healthcare business. The issue isn't the software. The issue is what goes into it.

PHI rarely ends up in a bookkeeping file on purpose. It sneaks in through everyday workflows:

• A patient's name entered as a customer on an invoice

• Session dates or service descriptions in a memo line

• An EOB or superbill attached to a transaction

• A payment processor sync that pulls in patient names automatically

None of these feel like compliance decisions in the moment. They feel like normal bookkeeping. That's exactly why "we're careful" isn't enough. You need a process: rules for how income gets recorded, what payment syncs are allowed to bring over, what belongs in your EHR instead, and a periodic check to confirm nothing slipped through.

This is how I run bookkeeping for my healthcare clients. Income is recorded in ways that never require a patient's identity, patient-level detail stays in the systems built to hold it, and the QuickBooks file stays PHI-free.

If you're not sure what's in your file right now, that's a fixable problem. I offer a PHI review where I search your existing QuickBooks file and either send you a report of what I find or clean it out for you. Most owners are surprised by what's in there, and it's much better to find it yourself than to explain it later.

Schedule a consult and we'll take a look.