Compliance question
Is Brightwheel HIPAA compliant?
No, and Brightwheel says so plainly. But the same page also makes an argument that most write-ups on this question quietly leave out, and if you have read it you deserve an answer to it rather than a page that pretends it is not there.
The vendor’s own answer.
Brightwheel’s security FAQ addresses HIPAA and FERPA together. On HIPAA it says to consult a compliance officer, and then this:
“Although brightwheel meets many of the requirements of HIPAA, brightwheel does not certify HIPAA compliance for its platform.”
Note what it does and does not say. It is not a claim to fall short technically — Brightwheel says it meets many of HIPAA’s requirements, and that is credible. What it declines to do is certify, which is the part a covered entity needs. On its own compliance posture Brightwheel speaks in FERPA terms, and FERPA is the statute for education records.
Now the argument everyone skips.
Immediately after that sentence, Brightwheel makes a substantive legal point, and cites it properly:
“HHS explains that HIPAA does not apply to schools in most cases because a school: “(1) is not a HIPAA covered entity or (2) is a HIPAA covered entity but maintains health information only on students in records that are by definition “education records” under FERPA and, therefore, is not subject to the HIPAA Privacy Rule.”
This is accurate. It is real HHS guidance and it says what Brightwheel says it says. If you are a preschool, that is very likely the end of your enquiry, and Brightwheel is a reasonable tool for you.
The difficulty is that it is guidance about schools, offered by a company that sells to schools, and an ABA clinic is not one. Both limbs of the carve-out have to be read against what your organisation actually is.
Why the carve-out does not reach a clinic.
A clinic is a covered entity. A preschool usually is not.
The HHS carve-out turns on whether the organisation is a covered entity at all. An ABA clinic that bills a health plan for a prescribed treatment is providing healthcare and transmitting health information electronically in connection with a claim. That is the definition. A preschool collecting nap times is not doing that, which is exactly why the guidance reads the way it does.
Your records are not education records.
The second limb of the carve-out only applies where the health information lives in records that are education records under FERPA. FERPA attaches to schools and to educational agencies receiving federal education funding. A behavioral health clinic does not hold education records, so there is nothing for that limb to attach to.
The information itself is more sensitive, not less.
An ABA update is not "had a good day". It is behaviour frequency, antecedents, a diagnosis on the account, sometimes a restraint or a protocol change. That is clinical content about a child’s disability, and it is the kind of information a family has the strongest possible interest in keeping controlled.
The vendor still has to agree to hold it.
Even where you are convinced of your own analysis, a business associate relationship is a contract. It does not arise because you decided it had. If the vendor will not sign, you are the only party carrying the exposure, and you are carrying it having been told in writing not to.
None of this is legal advice, and we are not your counsel. It is the reasoning we would want a clinic owner to have in front of them before a procurement call, so that the conversation with an actual compliance officer starts from the right question.
The part that would still be a problem.
Suppose the paperwork were available tomorrow. You would still be putting an ABA caseload into a data model built around a class: a room of children moving through a shared routine, with one teacher, on a schedule that is the same every day.
An ABA day is not that shape. It is a stack of individual sessions, each one a named child with a named technician for a bounded block, on a schedule that gets rewritten at 7am when somebody calls out. Broadcast to the whole room is a feature in a classroom and a hazard in a clinic. We went through that mismatch in detail on classroom apps in an ABA clinic, including what to look for in a tool that does sign a BAA.
Questions clinics ask about this.
Is Brightwheel HIPAA compliant?
No, by the vendor’s own account. Brightwheel’s security FAQ states that although brightwheel meets many of the requirements of HIPAA, brightwheel does not certify HIPAA compliance for its platform, and directs readers to consult a HIPAA compliance officer. Brightwheel describes its compliance posture in FERPA terms, which is the framework for education records rather than health records.
Brightwheel says HHS guidance means HIPAA does not apply. Is that wrong?
It is correct, and it is correctly cited. HHS has said HIPAA generally does not reach schools, because a school is either not a covered entity or holds health information only in records that are education records under FERPA. The point is that neither limb describes an ABA clinic. A clinic billing insurance for a prescribed treatment is a covered entity, and it does not hold education records. The guidance is about schools, and it is being quoted by a company that serves schools.
Does Brightwheel sign a business associate agreement?
We have found no offer of a BAA in Brightwheel’s published security documentation, and a vendor that states it does not certify HIPAA compliance for its platform is not positioned to sign one. Treat the absence as the answer until the vendor tells you otherwise in writing, and ask them directly rather than relying on this page.
We are a childcare centre, not a clinic. Does any of this apply to us?
Probably not, and this page is not aimed at you. If you are a preschool or a daycare and you are not billing a health plan for treatment, Brightwheel is built for precisely your situation and the HHS guidance it cites is likely to cover you. The problem only appears when an organisation delivering a prescribed medical treatment picks up a tool designed for the other case.
Our clinic looks like a preschool. Does that change anything?
No. The test is what you do and how you are paid, not what the room looks like. This is the single most common way clinics end up in the wrong tool: the environment reads as early childhood, so early childhood software feels like the natural fit, and nobody re-examines it until an audit or a departing employee raises it.
What should we look for instead?
A signed BAA before any child’s name is loaded, a record scoped to one child and one session rather than to a room, attribution on every entry so the handoff and the audit trail are the same record, and strict per-family access so no parent can ever see another child. Those are the requirements a classroom tool will fail on design grounds even where the paperwork is available.
Sources
Every claim about another product on this page is a quote from that product’s own documentation, linked below with the date we last read it there. Vendors revise these pages. If you find one of these out of date, tell us and we will correct it.
- [1] brightwheel — brightwheel Security FAQs · checked August 26, 2026
- [2] brightwheel — brightwheel Security FAQs · checked August 26, 2026
Show us what you are using now.
Fifteen minutes. If what you have works for your caseload, we will tell you to keep it.