HIPAA (Health Insurance Portability and Accountability Act) is a U.S. law that protects people’s private health information. It sets rules for how doctors, hospitals, and insurance companies can use and share your health data.

Key Points:

Unlike general-purpose scheduling software, DaySmart Appointments is purpose-built to meet HIPAA standards. It requires no plug-ins, no extra tools, and no complex setup. Just secure, seamless scheduling from day one. DaySmart Appointments helps support the HIPAA audit process companies face to ensure compliance.

From their first scheduled visit, your clients trust you with their most sensitive information. Give yourself peace of mind with a scheduling platform featuring fully HIPAA-compliant security measures that safeguard client privacy from the moment they book their first appointment.

When your HIPAA account is created, the system automatically sets important configurations to ensure your account stays compliant and consistent. Here’s what happens:

The system automatically treats the following fields as sensitive PHI data:

Two staff types are created by default:

Permissions for PHI fields are automatically set for both Manager and Staff roles.

To help your business meet HIPAA requirements from day one, certain data fields are automatically marked as Protected Health Information (PHI) when your HIPAA account is created.

The following fields are classified as PHI by default:

This ensures that sensitive information is properly protected right from the start.

As your organization grows or your needs change, you may want to mark additional fields as PHI.

When your HIPAA account is created, the system automatically sets up two default Staff Member Types to help manage roles and permissions:

These roles come with built-in settings that support consistent, secure access across your organization.

Each role includes a set of default permissions and configurations.
This helps streamline role-based access control and ensures your team members have the right level of access.

If you’d like to review or update these settings — or create new custom types — here’s how:

Go to: More > Lists > Advisor/Staff Member Types

From here, HQ Admins can:

Users assigned to the ‘Staff’ role have limited access to sensitive data, helping to protect your organization’s information and support HIPAA compliance.

Staff members can only view or edit fields that have been specifically set to ‘Show’ for their role.
If a field is not marked as ‘Show’, it will be either:

This ensures that each team member only sees the data they need, promoting data minimization best practices.

Your system comes with built-in default field permissions for the ‘Staff’ role to help you get started securely.

Want to make changes? It’s easy:

Go to: More > Lists > Advisor/Staff Types
Then select the ‘Staff’ type to update which fields they can access or edit.

Manager Role based permission: The following are the default field access settings for users with the ‘Manager’ Staff member type. By default, all fields are marked as ‘Show’

For all business types except Chiropractor, the system automatically configures data field visibility for the ‘Staff’ and ‘Manager’ role as follows:

Below is the configuration for Chiropractor:

To support the unique roles within your organization, the HQ Admin (with the ‘Manager’ role) has the ability to create custom Staff/Advisor Types.

This feature lets you define field-level access and system permissions tailored to each role—ensuring that team members only access the data they need.

Let’s say you want to add a new role called ‘Custom Type’.
The HQ Admin can create this type and then assign specific permissions for:

This gives you the flexibility to align access with your organization’s operational and compliance needs.

When adding a new staff member to your account, it's essential to assign the correct Staff Member Type—such as Staff, Manager, or a Custom Type—based on that person’s role and responsibilities.

The Staff Member Type determines each user's level of access to Protected Health Information (PHI) within the system.

Always double-check that the correct Staff Member Type is assigned before saving the staff record. This helps:

If a staff member is not assigned a Staff Member Type and tries to log in, they’ll see the following error message:

To avoid this, be sure every new staff member has a valid type assigned during setup.

Access to audit log reports is tightly controlled to protect sensitive data and support compliance with HIPAA and other regulatory requirements.

Only users who meet both of the following criteria can view audit reports:

This ensures that only authorized personnel with elevated privileges can monitor system activity and access history.

Audit reports track specific user actions (called Action Types) performed on different parts of the system (called Resource Types).

The audit table helps HQ Admins understand:

If an HQ Admin pulls an audit report for Appointments, the log may include actions like:

However, selecting Download as an action type for Appointments will return no results, because that action is not tracked for that resource.

To help protect Protected Health Information (PHI) and reduce the risk of accidental exposure, PHI data is intentionally excluded from all SMS message templates.

SMS messages will not contain sensitive fields such as:

This precaution ensures that no PHI is shared through unsecured channels like text messaging, helping your organization stay aligned with HIPAA compliance standards.

To further protect Protected Health Information (PHI), all customizable sections of customer-facing email templates have been designed to exclude PHI data.

PHI fields such as appointment notes, service details, or other sensitive information are not included in the email body. This helps prevent the unintentional disclosure of private information.

Instead of displaying PHI in the email:

Below is an example of how the email appears to the customer:

The updated staff email template now includes a secure link to the staff login page, making it easier and safer for team members to access their information.

With this update, staff members can:

This ensures that internal communications stay protected, while still enabling staff to efficiently manage their schedules and appointments.

To help internal users manage accounts more efficiently, a new HIPAA Account Filter has been added to the portal interface.

A simple checkbox option now allows internal users to:

This update helps streamline internal workflows and ensures that teams can focus on accounts requiring HIPAA compliance, without unnecessary clutter.

To ensure the secure handling of sensitive files, Role-Based Access Control (RBAC) has been implemented for managing access to pictures and documents, while still allowing flexibility in upload permissions.

All staff members are allowed to upload pictures and documents, regardless of role.
This supports common workflows such as:

While uploads are open, access to view or download files is restricted based on staff roles:

This ensures that sensitive content is only visible to those who are authorized to access it.

All file interactions are fully tracked to support audit requirements, including:

You can a: Settings > Document Viewer

When this staff member accesses an appointment, only the fields they have permission to view are visible:

A staff member named ‘Srin’ is assigned the ‘Manager’ Staff Member Type.

When a staff member edits an appointment:

This RBAC framework ensures that data security, operational control, and compliance are maintained throughout your system workflows.