'HIPAA-Compliant Charting' Isn't One Thing

Updated October 31, 2026. Jason Vargas, Grove Wellness

Every booking platform that touches a needle puts "HIPAA compliant" somewhere on its pricing page. Boulevard, Mangomint, Vagaro, and GlossGenius all say it. Read what's actually behind the claim on each and you get four different products.

Quick answer

Boulevard's Aesthetics (medspa) plans include charting, photo markup and sign-off on every tier, starting at $199/month. Mangomint includes forms and charting in its single plan; HIPAA mode turns on after you sign its BAA, with no listed fee. GlossGenius puts charting only on its two Practice tiers ($168/month and up), though its free HIPAA/BAA add-on starts at Gold. Vagaro includes SOAP notes in every plan, but some medical-spa operators don't trust it for clinical charting and run a second tool alongside it. "HIPAA compliant" tells you almost nothing about which of these you're getting.

Part of a bigger picture: see the Medspa Compliance Guide for the other decisions in this cluster.

What does "HIPAA-compliant charting" mean for booking software?

HIPAA doesn't certify software. "HIPAA compliant" is supposed to signal a signed Business Associate Agreement (a contract making the vendor legally responsible for the patient health information it stores on your behalf), encrypted storage, access controls tied to individual staff logins, and an audit trail on anything touching a patient chart. Every vendor here markets HIPAA compliance somewhere in its lineup, so ask for the signed BAA itself. The differences are in what each builds around it and charges for it.

HIPAA applies if your medspa is a covered entity, which for a provider usually means it bills or checks coverage with insurers electronically. Many cash-pay medspas aren't, but state privacy laws can still apply, and HIPAA-grade handling is the safe default.

How do Boulevard, Mangomint, Vagaro, and GlossGenius compare on HIPAA charting?

Boulevard includes charting, photo markup and sign-off on every Aesthetics (medspa) plan, from $199/month. Mangomint includes forms and charting in its single plan at $120/month per location plus $10 per user. Vagaro includes SOAP notes in every plan and charges $10/month for forms. GlossGenius includes charting only on Practice Essentials ($168/month) and Practice Advanced ($298/month), not on Standard ($28), Gold ($56) or Platinum ($168).

Platform Charting cost Where it lives What's in it
Boulevard Included on every Aesthetics (medspa) plan, from $199/mo All Aesthetics tiers; on Salon & Spa Essentials and Premier, forms are a $65/mo add-on Forms and charting, photo markup and sign-off, HIPAA compliant. ePrescribe is separate at $45/prescriber.
Mangomint Included, $120/mo + $10/user Single plan, no add-on; HIPAA enabled after you sign the BAA Forms and charting with image markup. BAA on request through support, no listed fee.
Vagaro SOAP notes included; forms $10/mo Core plan plus Forms add-on SOAP notes, Forms add-on ($10/mo), E-Prescribe add-on ($40/doctor + $5/MA per month). Trust gap in practice, see below.
GlossGenius Included, but only on Practice Essentials ($168/mo) or Practice Advanced ($298/mo) Two of five tiers; free HIPAA/BAA add-on from Gold up SOAP notes, charting, photo markup, medical-director sign-off. Charting absent on Standard ($28), Gold ($56) and Platinum ($168).

None of these figures include the base scheduling and payments platform each charging structure sits on top of: this table is charting specifically, not the full monthly bill. Ask any rep for the all-in number before you compare a $199 plan to a $298 tier and assume the second one is the expensive choice.

Does it matter whether HIPAA charting is included or a paid upgrade?

Mangomint includes charting for every customer, and HIPAA mode is one BAA and a support request away, with no listed fee. Boulevard splits by business type: its Aesthetics (medspa) plans include charting on every tier, while its Salon & Spa plans charge $65/month per location for the Forms add-on on Essentials and Premier. GlossGenius's approach is the one to watch closely, because it's structured in a way that can quietly bite a growing practice.

A solo esthetician doing dermaplaning and lash lifts on GlossGenius Standard at $28/month has no reason to think about charting. Then she adds Botox. Now she needs SOAP notes, photo documentation with markup, and a medical director's sign-off on every injectable chart, and none of that exists on her current plan. The jump isn't a feature toggle; it's a tier change from $28 or $56 up to $168 or $298 a month, a 3-10x increase in the software line item, discovered mid-year instead of budgeted for at signup. GlossGenius publishes its tiers, so it isn't a hidden fee, but it's the kind of thing a sales conversation glosses over when the practice is booking a $28/month demo and adding injectables isn't on the table yet.

Do medspa practitioners trust Vagaro's EMR for clinical charting?

Some don't. Vagaro includes SOAP notes in every plan and sells forms ($10/month) and E-Prescribe ($40 per doctor plus $5 per medical assistant a month) as add-ons, so on paper it covers the basics. Operators in r/MedSpa say Vagaro isn't meant for medical work, and some clinics keep it for booking and payments while charting in a separate tool such as RXPhoto.

"Vagaro's not meant for anything medical." Reddit, r/MedSpa

That's the sentiment showing up repeatedly from operators actually running medical services on the platform, not a formal complaint against any specific bug. Some clinics keep Vagaro for booking and payments and run a separate tool like RXPhoto for the clinical charting itself, paying for two systems where the pricing page implies one would do. The gap isn't a missing checkbox on a feature list. It's the difference between a platform that was built medical-first and one that added a medical module onto a scheduling tool built for hair and nails. Boulevard and Mangomint were both built specifically for the medspa/med-adjacent market from early on; Vagaro's roots are broader, and its charting module reads that way to the people using it daily.

Can Boulevard, Mangomint, Vagaro, or GlossGenius replace a full EMR?

No. None of the four is a full standalone EMR of the kind a dermatology practice or plastic surgery clinic uses, even at the top tier. Prescribing is add-on territory across the board: Boulevard's ePrescribe runs $45 per prescriber, Vagaro's E-Prescribe is $40 per doctor plus $5 per medical assistant a month, and GlossGenius doesn't list e-prescribing on its pricing page.

If your practice is running compliance-heavy protocols beyond injectables and light medical aesthetics (actual prescribing volume, controlled substances, multi-provider clinical oversight), all four of these should be evaluated as booking-and-light-charting platforms, not EMR replacements. That's a different buying decision.

How do you evaluate a booking platform's HIPAA charting claim?

To evaluate a booking platform's HIPAA charting claim, get the signed BAA document in writing, price charting as its own line item, confirm which tier the HIPAA-covered plan requires, ask how long stored PHI and photos are retained after cancellation and whether they export, price e-prescribing separately, and ask current users whether they trust the platform for clinical documentation.

  1. Ask for the signed BAA in writing before you sign anything, not a mention in a sales deck, the actual document.
  2. Get the charting cost as a line item separate from the base platform price, and ask if it's per location or per account.
  3. Confirm which tier the HIPAA-covered plan actually requires: some vendors gate it, and the sales rep may not lead with that.
  4. Ask what happens to stored PHI and photos if you cancel: how long is it retained, and can you export it.
  5. If you prescribe or plan to, price the e-prescribing add-on separately: it's rarely included in the base HIPAA claim on any of these four.
  6. Ask current users, not the sales team, whether they trust the platform for actual clinical documentation or run something else alongside it.

Is Boulevard HIPAA compliant?

Yes, on its Aesthetics (medspa) plans. Every Aesthetics tier includes forms and charting, photo markup and sign-off, and HIPAA compliance, starting at $199/month ($179 billed annually) for up to 3 providers. Salon & Spa plans differ: forms are a $65/month per-location add-on on Essentials and Premier, bundled in Prestige. It is not a full EMR. Prescribing requires a separate ePrescribe add-on at $45 per prescriber.

Which booking platform includes HIPAA-compliant charting without an extra fee?

Two of the four include charting in the plan price. Mangomint includes forms and charting in its single plan at $120/month per location plus $10 per user; HIPAA mode requires signing Mangomint's BAA and having support enable it, with no listed fee. Boulevard includes charting, photo markup and sign-off on every Aesthetics (medspa) plan, from $199/month. Vagaro includes SOAP notes in its core plan but charges $10/month for forms, and GlossGenius includes charting only on its Practice Essentials ($168/month) or Practice Advanced ($298/month) tiers, not on Standard, Gold or Platinum.

Is Vagaro's charting module actually used for real clinical documentation?

It covers the basics on paper: SOAP notes come in every plan, forms are a $10/month add-on, and E-Prescribe (ScriptSure, on the Surescripts network) costs $40 per doctor plus $5 per medical assistant a month. But practitioners in medical-spa communities online describe it bluntly as not built for real medical charting, and some clinics run a separate tool like RXPhoto alongside Vagaro rather than trusting the native module for clinical documentation. The feature list and the way operators actually use it are two different things.

What does a signed BAA actually guarantee you?

A Business Associate Agreement is a legal contract that makes the vendor responsible for the PHI it stores and processes on your behalf, required under HIPAA's Privacy Rule when a vendor stores or handles PHI on your behalf. It doesn't certify software quality, and it doesn't mean the platform is a real EMR. Mangomint and GlossGenius publish that they sign BAAs, and Boulevard lists HIPAA compliance on every medspa plan. Get the signed BAA from whichever vendor you choose, and check what that plan includes on top of it.

Not sure what your current charting setup covers?

The free Grove assessment checks whether your current platform's HIPAA claim holds up in practice, from the signed BAA to the charting tier you're on, and what it would cost to get full charting coverage if you switch platforms.

Run my numbers →