Your front desk, artists, and whoever handles payroll may need different access.
Ask who can see identification, health disclosures, private photographs, and financial records. Who can refund a payment or export the client list? If someone changes a deposit or appointment, can you find out who changed it?
Permission to publish a client’s photograph deserves its own check, separate from consent to perform the service.
Make them explain the claims
“HIPAA compliant” sounds reassuring. But an ordinary tattoo or piercing studio doesn’t become subject to HIPAA just because its release form asks medical questions. HHS explains who the rules cover.
If a software company leads with that claim, ask what it means for your business. What has actually been assessed? Which protections does it provide? Does the company understand whether the law applies to you, or is it borrowing a healthcare term because it sounds impressive?
Your client records deserve protection whether HIPAA applies or not. Ask for the actual practices behind the claim.
Read the data policy, too. Does it cover the client records you’ll actually keep, or just cookies on the company’s website? Look for where records are stored, when the company’s own staff can access them, which outside services receive information, and what happens when records are deleted. Does the company sell client data or use it for marketing? “We take your privacy seriously” isn’t an answer.
You can read REV23’s data protection policy before signing up. It explains those points, including what happens to records when you stop using REV23. Ask other vendors for the same detail.
Consider what happens when an artist leaves with future appointments and outstanding deposits. You still have clients to look after and money to account for. Make sure the software supports the arrangements you actually have.