Before you sign, get written answers to five questions. How long are we committed? How and when can we leave? What can the price become? How do we get our data out? Will you sign a business associate agreement (BAA)? The headline monthly price is rarely where the trouble is. It is in the renewal clause, the notice window, the yearly increase and the cost of leaving.
We sell software to clinics ourselves, so treat this as the list we expect to be asked.
Term and renewal
- How long is the initial term? Ask whether a month-to-month or shorter first term is available, and what it costs compared with a longer one.
- Does the contract renew automatically? If so, ask for how long. A renewal for another full term is a very different commitment from a renewal that runs month to month.
- What is the notice window? Find the number of days before the renewal date by which you must cancel, and the method the vendor accepts. Some contracts require written notice to a specific address, and an email to your sales contact may not count.
- When does the term start? It may begin at signature, well before you are live. Ask for the clock to start at go-live or on a fixed date after it.
Once you sign, put the notice deadline on a shared calendar with a reminder a month ahead. An auto-renewal only catches the practices that forget the date.
Price, and what it can become
Ask for the full first-year cost and the full second-year cost in writing. The gap between the two tells you a lot.
- Who counts as a seat? Per-seat pricing can cover providers only, or every login including part-time front-desk staff. Ask how seats are added and whether they can be removed mid-term.
- What is charged by usage? Text messages, fax pages, eligibility checks and storage are often billed per unit. Ask for the unit price, what is included, the overage rate and whether unused volume carries over. For texting, ask whether a long message is billed as more than one.
- Are there minimums? A minimum monthly spend or message volume means you pay for capacity whether you use it or not.
- What are the one-time fees? Onboarding, setup, training, data migration and number porting can each carry a charge. Ask which are included and get a ceiling on the rest.
- How can the price change? Look for a price-escalation clause. Ask whether increases are capped, when they can take effect, and whether renewal is at your current rate or at the vendor's list price at that time.
- Does a discount expire? A first-year discount that ends at renewal is a price increase with a delay.
Leaving, and taking your data with you
The time to negotiate your exit is before you sign.
- Can we export our data ourselves? Ask what can be exported, in what format, and whether it needs a support request. Spreadsheet-readable files for patient lists and PDFs for documents are a reasonable minimum.
- Is there a fee to export or to hand data to a new vendor? Get the answer in the contract.
- How long do we have access after termination? Ask for a defined period to retrieve data, and what happens to it afterward.
- Can we end the contract early? Ask what the early-termination charge is, whether you can leave without penalty if the vendor fails to deliver, and whether prepaid fees are refunded.
HIPAA has something to say here. A business associate contract must provide that, at termination, the vendor will return or destroy all protected health information if that is feasible. Ask the vendor how it does that and how long it takes. Your practice may still need those records long after the software is gone, so make sure you have a complete export before anything is destroyed.
The BAA and the security questions
If the software will hold patient information, the BAA is not optional. HHS explains that a covered entity may share patient information with a business associate if it obtains satisfactory assurances in a written agreement that the vendor will safeguard it. HHS also publishes sample BAA provisions that you can compare against a vendor's draft.
- Will you sign a BAA before any patient data is loaded? A vendor that hesitates is telling you something.
- Which subcontractors handle our data? The same HHS guidance says a business associate must have agreements with its own subcontractors.
- How and when will you tell us about a security incident? The BAA has to require reporting. Ask for a stated time frame.
- Who at your company can see our patient data, and is access logged?
- How is access removed when one of our staff leaves?
Be careful with labels. HHS states that it does not certify any persons or products as "HIPAA compliant," so there is no official certification for a vendor to hold. Compliance is an obligation of the practice, as the covered entity, and of its vendors under the BAA. Specific answers to the questions above are worth more than a badge.
Support and service
- What are the support hours, and how do we reach a person?
- Is there an uptime commitment, and what do we get if it is missed?
- Who does the setup work, and how long does it take?
- Can features be removed or moved to a higher plan during our term?
Clauses to read twice
| Clause | Why it matters | What to ask for |
|---|---|---|
| Automatic renewal for a full term | One missed date commits you again | Month-to-month renewal, or a reminder from the vendor |
| Long cancellation notice window | The deadline passes before you review the tool | A shorter window and notice by email |
| Renewal at list price | Your rate can rise without a negotiation | A cap on increases, stated as a percentage |
| Minimum volumes | You pay for messages or seats you do not use | Pricing based on actual use |
| Export on request, fee applies | Leaving costs money and time | Self-service export at no charge |
| Term starts at signature | You pay during setup | Term starts at go-live |
| Vendor may change terms by posting them online | The contract you signed can shift | Changes require written agreement |
Not every vendor will agree to every change. The answers still tell you how the relationship will go.
A checklist to send the vendor
- What is the initial term, and is a shorter one available?
- Does it renew automatically, and for how long?
- How many days of notice are needed to cancel, and by what method?
- What is the total cost in year one and in year two?
- Who counts as a seat, and can seats be removed?
- What is billed by usage, and at what rates?
- What one-time fees apply?
- How and when can prices change?
- How do we export our data, in what formats, and at what cost?
- What happens to our data after termination?
- Will you sign a BAA before we load patient data?
- How quickly will you tell us about a security incident?
Ask us the same twelve. We sell Klauve through a conversation, not a self-serve signup, so there is time to go through them. The pricing and why Klauve pages are a place to start.
If you are comparing vendors and want straight answers to this list, talk to us.
Frequently asked questions
What is an auto-renewal clause in a software contract?
It is a term that extends the contract automatically unless you cancel by a stated deadline. The details that matter are the length of the renewal and the number of days of notice required. Put the deadline on a calendar the day you sign.
How long should a practice-software contract be?
There is no correct length. A shorter term gives you flexibility if the tool does not work out, while a longer term may come with a lower price. If you are new to the vendor, ask for a shorter first term or the right to leave early if agreed milestones are missed.
What happens to our patient data if we cancel?
That depends on the contract, which is why you should ask before signing. HIPAA requires the business associate agreement to provide for the return or destruction of patient information at termination where feasible. Make sure the contract also gives you a clear way to export everything, a format you can use and enough time to do it.
Does a software vendor have to sign a BAA?
If the vendor creates, receives, maintains or transmits patient information on your behalf, HIPAA requires a written agreement. If a vendor will not sign one, do not put patient information into its product. Tools that never touch patient data do not need one.
Is "HIPAA certified" software a real thing?
No official certification exists. HHS says it does not certify persons or products as "HIPAA compliant," and it does not endorse private certifications of Security Rule compliance. Ask a vendor for a signed BAA and specific answers about access, logging and incident reporting instead.