Trust Where It's Needed: Security, Compliance, and Interoperability
Behavioral health records are some of the most sensitive data your practice holds. ICANotes protects them with certified safeguards and complete audit trails, and connects securely to the labs, clearinghouses, and exchanges you rely on.
ONC certified to the 2015 Edition Cures Update (ICANotes Classic), with a Business Associate Agreement for every customer.
How Does ICANotes Protect Behavioral Health Data?
ICANotes protects behavioral health records through certified compliance, layered security, and standards-based interoperability:
- Compliance: documentation built to support HIPAA, CMS, CARF, and Joint Commission requirements
- ONC Certification: certified health IT under the federal ONC Health IT Certification Program (ICANotes Classic)
- Security: encryption, role-based access, audit logs, login lockouts, and automatic idle logoff
- Integrations: secure connections to labs, clearinghouses, and health information exchanges
- FHIR API: FHIR R4 access for approved partner applications
Three Pillars of Trust
Compliant
Documentation built to meet HIPAA, CMS, and accreditation standards, with time-stamped notes, full audit trails, and supervisory sign-off.
Secure
Encrypted data, role-based permissions, detailed access logs, proactive security updates, and a signed BAA with every customer.
Connected
Data moves safely to labs, clearinghouses, HIEs, and partner apps through established integrations and a FHIR API that limits each partner to the practices it serves.
Compliance Is a Shared Responsibility
No software can make a practice compliant on its own, and any vendor that says otherwise is overselling. ICANotes secures the platform; your practice controls how it's used. Here's how the work divides.
What ICANotes Provides
- ONC-certified EHR software (Classic only)
- Encryption of data in transit
- Audit trails of every sign-in and record accessed
- Role-based access controls and login lockouts
- A Business Associate Agreement for every customer
- An annual security risk assessment of our own operations, based on NIST guidelines
- Regular security updates
What Your Practice Manages
- Who has access, and at what permission level
- HIPAA training for your staff
- Patient consents, including 42 CFR Part 2 consent for substance use disorder records where it applies
- Your own regular security risk assessments
- Security of the devices and networks your team uses
Our Trust and Security Features
Each part of ICANotes' trust program has its own page with the full detail. Start here.
Compliance and Certifications
Behavioral health documentation built around the standards auditors check: HIPAA, CMS, CARF, and Joint Commission. Notes are time-stamped and locked on signature, and supervisory sign-off keeps trainee documentation compliant. Eight detailed pages cover each standard in depth.
Compliance and Certifications
- HIPAA, CMS, CARF, and Joint Commission support
- Time-stamped notes, locked on signature
- Supervisory sign-off workflows
ONC Certification
ICANotes Classic is certified to the 2015 Edition Cures Update criteria under the federal ONC Health IT Certification Program. That confirms it meets federal standards for security, interoperability, and functionality, and supports your participation in Medicare, Medicaid, and value-based programs.
ONC Certification
- 2015 Edition Cures Update certified
- Listed on the federal CHPL
- Included in every plan at no extra cost
Security
Layered safeguards protect every account: encrypted data, role-based permissions, lockout after repeated failed logins, and automatic logoff of idle workstations. Audit logs show who signed in and which records they opened.
Security
- Encryption and role-based access
- Sign-in and record-access audit logs
- Separately protected psychotherapy notes
Integrations
ICANotes exchanges data with the labs, clearinghouses, and health information exchanges your practice already works with. Every integration meets the same security standards as the core platform.
Integrations
- 18 lab connections, including LabCorp and Quest
- Six clearinghouses, including Availity and Waystar
- HIE connections, including HealthInfoNet
FHIR API
For technology partners, ICANotes offers an HL7 FHIR R4 API built for secure server-to-server integration. Partners authenticate with OAuth 2.0, and each credential reaches only the practices linked to that partner's account.
Completing a Vendor Security Review?
Our team can share security documentation and help with your security questionnaire, so your review doesn't stall.
Verify It
You don't have to take our word for it. You or your compliance officer can check each of these yourselves.
- ONC certification: see ICANotes' listing on the federal Certified Health IT Product List (CHPL), CHPL ID 15.04.04.2755.ICAN.11.01.1.221224.
- Real World Testing: read our published Real World Testing plans and results, which certified health IT developers must produce each year, on our ONC Certification page.
- Business Associate Agreement: review our standard BAA before you sign.
- Security documentation: request security information and questionnaire responses from our team.
- Independent reviews: ICANotes is rated 4.5 stars for 2025 by ChoosingTherapy.
Trust and Security FAQs
Is ICANotes HIPAA compliant?
Yes. ICANotes operates as a HIPAA-compliant business associate. We maintain HIPAA policies, train our staff every year, complete an annual NIST-based security risk assessment, and sign a BAA with every customer. Your practice's own compliance also depends on how you set up access, train staff, and manage consents.
Does ICANotes sign a Business Associate Agreement?
Yes. Every ICANotes customer receives a Business Associate Agreement (BAA), which sets out how we safeguard the protected health information we store and process for your practice. You can review the standard BAA before signing, and our compliance team can answer any questions about its terms.
Is ICANotes ONC certified, and how can I verify it?
Yes. ICANotes Classic EHR/EMR for Behavioral Health is certified to the 2015 Edition Cures Update criteria by Drummond Group, an ONC-Authorized Certification Body. You can confirm it on the federal Certified Health IT Product List under CHPL ID 15.04.04.2755.ICAN.11.01.1.221224. Certified features come with every ICANotes plan.
How does ICANotes protect client data?
Data is encrypted in transit, and role-based permissions limit what each user can see. Repeated failed logins trigger a lockout and an alert to your administrator, idle workstations log off automatically, and audit logs record every sign-in and every record opened. Psychotherapy notes can be stored separately with extra password protection.
Does ICANotes support 42 CFR Part 2 requirements?
ICANotes provides the safeguards Part 2 programs rely on: role-based access, audit trails, encryption, and protected note storage. Under the updated Part 2 rule, programs remain responsible for patient consent and for how substance use disorder records are disclosed. Our compliance team can help you review your workflows.
Which systems does ICANotes integrate with?
ICANotes connects with 18 laboratories, including LabCorp and Quest; clearinghouses such as Availity, Waystar, and Claim.MD; and health information exchanges such as HealthInfoNet. Approved technology partners can also integrate through our FHIR R4 API. If you need a connection we don't support yet, our integrations team will review the request.
Protect Your Clients and Your Practice
See how ICANotes keeps behavioral health records secure, compliant, and connected, and get the security documentation your review needs.