Can healthcare teams run patient-facing workflows on Moxo?

Moxo Says It Signs BAAs but Publishes None

Moxo told Automation Atlas in writing on 6 October 2026: "Yes, we sign BAAs." No document came with it, and moxo.com carries no BAA.

The Description of Services, read 13 October 2026, says "The underlying AWS services used by the Service are HIPAA-eligible." That sentence describes Amazon's services. It is not an agreement with Moxo.

What the Patient and the Practice Each Do

Moxo's healthcare page, read 13 October 2026, splits the work: "AI handles preparation, validation, and follow-up", while staff keep "the work that requires clinical and operational expertise." The outsider gets "a secure link", sees "exactly what's needed" and responds. The Description of Services calls that link "secure, time-limited" and tied to "a specific assigned task".

Note who the outsider is. The page's external participants are "Referring physicians, specialists, payers, labs", not patients. Patient-facing use rests on customer stories read 13 October 2026: Eden Wellstyle, an online wellness provider, cites a "140% increase in client intake", and therapist Sasha Esposito MFT runs sessions in a branded digital channel. Neither mentions HIPAA, a BAA or an EHR.

The Zapier and Make Route Moves the PHI Off Moxo

Moxo names Zapier and Make as routes, and that is the trap. Moxo API 2.0.0 (read 13 October 2026) says a step.completed webhook carries the step's results, which for a form are "each field's integration key". An intake form's answers travel in the webhook. So does the flow name, whose example in the spec is "Onboarding - Acme Corp". Name flows by case number, not patient.

Zapier's Terms bar using the service "to upload or transmit any Sensitive Personal Data", a term that includes protected health information, and its privacy FAQ says it "can’t sign business associate agreements" (both read 13 October 2026). Make's security and Enterprise pages mention no BAA. A BAA with Moxo covers Moxo. The webhook's receiving end needs its own: an endpoint the practice controls, or an integration vendor that signs one. Zapier says it cannot.

Three Questions to Put to Moxo Before Signing

Ask which plans the BAA covers, and whether the plan with the API and webhooks is one of them. Moxo stopped publishing prices: by 13 October 2026 moxo.com/pricing redirected to its homepage. The last published list, read 28 September 2026, put Team at $5,000 a year for 100 flows and listed webhooks and REST APIs under Scale, a custom quote. Ask whether the BAA reaches Moxo AI steps that read patient documents. Ask whether the customer picks the US or EU zone at setup and whether the contract fixes it.

When Moxo Is the Wrong Choice

Pick another platform if the workflow must read or write clinical data in an EHR. Moxo's healthcare page says it connects to "EHR, practice management, payer portals", yet its written answer is "No native connectors today." The two fit only if the practice builds the connection through the API.

The Healthcare ranking puts Moxo 5th of 8 at 5.8 as of 13 October 2026, below UiPath (8.3), Power Automate (8.0), Automation Anywhere (7.5) and Boomi (7.3). Boomi documents FHIR Client and MLLP for HL7 v2, though neither is named for Epic or Cerner (as that ranking cites help.boomi.com, read 29 September 2026).

Editor's Note: A form's answers can leave Moxo inside its step.completed webhook: the example in Moxo's API reference carries an Intake Form's company name and email address, and Moxo's written answer of 6 October 2026 names "REST API, webhooks, or Zapier/Make" as integrations. For a patient form that is PHI in the payload. A BAA with Moxo covers Moxo, and Moxo's "Yes, we sign BAAs" names no plans. Zapier's Terms bar sensitive personal data and its FAQ says it "can’t sign business associate agreements". We would treat every outgoing webhook URL in a template as a PHI endpoint, point it only at a system the practice controls or a vendor that signs its own BAA, and name flows by case number. — Rafal Fila, ShadowGen