HIPAA-compliant telehealth platforms explained

A telehealth platform is software that lets clinicians and patients hold visits remotely, usually by video. No platform is "HIPAA certified." A platform can be used in a HIPAA-compliant way when the vendor signs a Business Associate Agreement (BAA) that covers the features you use, provides appropriate safeguards, and your practice configures and uses it correctly. This guide explains the BAA requirement, the security features to check, how needs differ for medical, therapy and psychiatry practices, how pricing works, and which questions to ask a vendor before you sign.

What a telehealth platform is

A telehealth platform is software for remote clinical visits, usually by video. Most platforms also handle some of the work around the visit, such as scheduling, intake forms, patient messaging and payments.

Telehealth vs telemedicine. People often use the terms interchangeably. In practice, "telemedicine" usually means remote clinical care: diagnosis, treatment and prescribing. "Telehealth" is the broader term. It also covers remote education, care coordination and administrative contact. Vendors use both words, so judge a product by its features, not its label.

Main delivery models:

• Standalone video visit tools. A secure video room, usually joined through a browser link. These are quick to set up but have little workflow around the visit.
• Telehealth built into an EHR or practice management system. The video visit launches from the appointment, and documentation and billing stay in one system.
• Full virtual care platforms. These cover scheduling, intake, video, messaging, payments and sometimes remote monitoring. They are aimed at larger groups and health systems.
• White-label platforms. The practice brands the app or web portal as its own, typically under a custom contract.

What telehealth platforms are not. A telehealth platform is not internal staff chat, and it does not replace your EHR unless the vendor explicitly includes those functions. Patient-facing reminders and secure messages are also a separate category. If that is what you are evaluating, see our guide to patient communication and messaging software.

What makes a telehealth platform HIPAA compliant

There is no official HIPAA certification for software. A badge that says "HIPAA certified" is marketing, not a government credential.

A platform supports compliance when two things are true:

1. The vendor signs a BAA with your practice.
2. The vendor provides administrative, physical and technical safeguards appropriate to the PHI it handles.

Your practice stays responsible for how the platform is used.

Why the BAA matters. A telehealth vendor creates, receives, stores or transmits PHI on your behalf: video sessions, intake answers, appointment details and sometimes recordings. That makes the vendor a business associate, and HIPAA requires a BAA before PHI flows through its service (45 CFR 164.502(e) and 164.504(e) under the Privacy Rule; 164.308(b) and 164.314(a) under the Security Rule) (ecfr.gov). The BAA sets out how the vendor protects PHI, reports breaches and handles data when the contract ends.

Pandemic-era flexibility has ended. During the COVID-19 public health emergency, OCR used enforcement discretion for good-faith use of non-public-facing consumer video tools. That discretion ended on May 11, 2023 (federalregister.gov), and the transition period ended on August 9, 2023 (federalregister.gov). Practices that kept using consumer video apps without a BAA should treat that as a gap to close now. Audio-only telehealth has its own OCR guidance ("Guidance on How the HIPAA Rules Permit Covered Health Care Providers and Health Plans to Use Remote Communication Technologies for Audio-Only Telehealth," issued June 2022), which says the Security Rule does not apply to audio-only care over a standard landline but does apply to electronic technologies such as VoIP (hhs.gov).

A common trap: the plan matters, not the brand. Many vendors offer a free or basic plan without a BAA and a paid healthcare plan with one. Two clinicians can use the same video brand, and only one of them may be covered. Check which plan you are on and confirm the signed BAA names it.

Shared responsibility. Even with a signed BAA, your practice must still:

• complete a risk analysis that includes telehealth
• set access policies and offboard departing staff promptly
• train staff on the platform
• make sure clinicians hold visits from private spaces on secured devices

Use our HIPAA compliance checklist for clinics to cover the practice side.

Security and privacy features to check

• Encryption, described precisely. Ask whether video is end-to-end encrypted or encrypted in transit only. Ask how stored data such as recordings, chat logs and intake forms is encrypted at rest. Vendors use these terms differently.
• Access controls. Each provider should have a unique login. Look for two-factor authentication, role-based permissions (front desk vs clinician vs billing) and automatic logoff on idle sessions.
• Virtual waiting room and admission controls. The clinician should admit each patient, so the 10:30 patient cannot drop into the 10:00 session. Check whether rooms are per-provider or per-visit and whether links expire.
• Audit logs. You should be able to see who accessed which session or record, and when.
• Recording policy. Ask whether sessions can be recorded at all, where recordings are stored, who can access them and how long they are kept. Many practices simply turn recording off.
• Data retention settings. Check whether you can set how long messages, files and visit metadata are kept.
• What the BAA actually covers. Add-ons often sit outside the core agreement. Common examples are SMS reminders, transcription, AI note-taking and third-party integrations. Ask for a written list of covered services and subprocessors. Before turning on AI features, read how HIPAA applies to AI tools like ChatGPT and our overview of the benefits, risks and ethics of AI in healthcare.

Telehealth needs by practice type

Primary care and specialty medical practices. EHR integration is usually the deciding factor. Visits should launch from the schedule, notes should land in the chart, and charges should flow to billing. Check the handoff to e-prescribing and whether the platform supports the billing codes and place-of-service codes your payers require (as of October 2026, CMS says Medicare telehealth flexibilities, including care from any US location and audio-only care at home, run through December 31, 2027; use POS 02 for telehealth outside the patient's home and POS 10 for telehealth in the patient's home) (cms.gov).

Therapists and behavioral health. Look for:

• simple join links that don't require patients to install an app
• built-in intake and consent forms
• session notes
• reliable video for 50-minute sessions

Programs that handle substance use disorder records may also fall under 42 CFR Part 2, which adds confidentiality rules beyond HIPAA (Part 2 applies to federally assisted programs that provide substance use disorder diagnosis, treatment or referral for treatment, and some requirements reach recipients of their records; the 2024 final rule took effect April 16, 2024, and compliance was required by February 16, 2026) (hhs.gov). If you run a small or cash-pay practice and are unsure where you stand, read does HIPAA apply to therapists.

Telepsychiatry. Prescribing controlled substances via telemedicine without a prior in-person visit is governed by DEA rules. The temporary flexibilities have been extended several times (the fourth temporary extension by DEA and HHS currently runs through December 31, 2026; a permanent special registration rule is not yet final) (federalregister.gov). The platform does not make prescribing lawful. Your prescribing workflow and documentation do.

Group practices and health systems. Typical requirements include:

• multi-provider scheduling and shared waiting rooms
• SSO
• admin reporting on visit volume and no-shows
• white-label branding

Ask how the platform handles provider onboarding and offboarding at scale.

Cross-state care. Licensure follows the patient's location at the time of the visit, not the clinician's location or the platform's. Interstate compacts can simplify multi-state practice (for example, the Interstate Medical Licensure Compact for physicians, PSYPACT for psychologists and the Nurse Licensure Compact for nurses; check each compact's official site for current member states) (imlcc.com). Some platforms flag patient location at check-in, but compliance still rests with the clinician.

Examples of telehealth platforms by category

The table below shows the main categories with example vendors. It is not a ranking. Every cell must be confirmed against the vendor's current pricing and legal pages before you rely on it. To understand how to judge any "HIPAA compliant" claim, see what qualifies as HIPAA-compliant software.

Category	Example	BAA offered, and on which plan	Starting price model
Standalone video	Doxy.me	Yes. Individual BAA on the Free plan; clinic-level BAA on Premium (helpcenter.doxy.me)	Free plan plus paid tiers; check the vendor's pricing page
Standalone video	Zoom for Healthcare	Yes, on paid plans (a BAA is required to enable HIPAA compliance) (zoom.us)	Per user per month; Pro from $14.16/user/month billed annually ($16.99 billed monthly) (zoom.us)
Therapy-focused practice management with telehealth	SimplePractice	Telehealth included on all three plans; BAA accepted at signup (support.simplepractice.com)	Tiered plans; check the vendor's pricing page
EHR-embedded telehealth	athenahealth (athenaTelehealth, an add-on within athenaOne) (athenahealth.com)	Ask the vendor	Ask the vendor
Enterprise virtual care	Teladoc Health	Ask the vendor about its provider offering and BAA	Ask the vendor
White-label	Ask shortlisted white-label vendors	Ask the vendor	Typically a custom contract

Vendor plans and BAA terms change. Confirmed as of October 19, 2026.

Don't rely on a "HIPAA compliant" badge on a vendor's website. Request the BAA itself and read it. Check three things: which entity signs, which services are covered, and what happens to your data when the contract ends.

How much telehealth software costs

Common pricing models:

• Per provider per month. This is the most common model for standalone and therapy-focused platforms.
• Per visit. Usage-based pricing, sometimes used for low-volume or seasonal telehealth.
• Tiered plans by feature. The BAA, group rooms, payments or integrations often appear only on higher tiers.
• Custom enterprise or white-label contracts. These usually involve setup fees, minimum terms and negotiated BAAs.

Typical ranges. Per-provider monthly prices vary widely by vendor and plan, so check current vendor pricing pages. Compare the total cost for your number of providers, not just the headline price.

Free plans. Free tiers are usually limited, and many exclude a BAA. A free plan without a signed BAA is not suitable for visits involving PHI, unless the vendor confirms BAA coverage in writing.

Hidden costs to ask about:

• SMS and reminder message fees
• payment processing fees
• storage for recordings
• EHR integration or interface fees
• onboarding, training and premium support tiers
• extra charges for group sessions or additional waiting rooms

Checklist: questions to ask a telehealth vendor

1. BAA scope. Will you sign a BAA, and on which plan? Which features and subprocessors does it cover? Are SMS, transcription and AI features included?
2. Encryption and hosting. Is video end-to-end encrypted or encrypted in transit? How is stored data encrypted, and where is it hosted? Can sessions be recorded, where do recordings go, and who can access them?
3. Integrations. Which EHR, scheduling and billing systems do you integrate with? Is each integration inside the BAA?
4. Patient experience. What does a patient need to join: an app download, a browser link, or a phone fallback? How does the platform work for older patients, patients with disabilities and patients on poor connections?
5. Admin and support. What admin controls and audit logs are included? What uptime commitment is in the contract? What are the support hours, and what happens when a visit fails mid-session?

Ask for written answers. They become part of your vendor file for the next risk analysis.

The part telehealth platforms don't cover: staff coordination

A virtual visit depends on internal work that happens outside the video room. For example:

• the front desk confirms tomorrow's telehealth appointments and flags two patients who haven't completed intake
• a patient can't connect at 2:05, and someone needs to call them while the clinician waits
• mid-visit, a clinician needs admin to resend a consent form
• after the visit, someone has to schedule a follow-up, chase a missing insurance card and send a referral

Telehealth platforms handle the visit, not these handoffs. Staff fill the gap with personal text messages or long email threads. That creates two problems:

• PHI ends up on personal devices without a BAA.
• Nobody can tell who owns the follow-up.

Our guide to HIPAA rules for texting explains where personal texting goes wrong.

One option for this internal layer is a team chat built for staff. Chanty is HIPAA-compliant chat for staff that you use alongside your telehealth platform and EHR, not instead of them. Staff coordinate in chats and calls, and any message can become an assigned task with an owner and a deadline. That way, "can someone resend the consent form" doesn't get lost. HIPAA with a signed BAA is available from the Business plan.

Keep clinical records in the EHR and patient-facing communication in the systems designed for it. Use team chat for operational coordination. For related topics, browse more guides on healthcare communication and HIPAA.

FAQ

What is a HIPAA-compliant telehealth platform?

It is a telehealth platform whose vendor signs a BAA with your practice and provides safeguards such as encryption, access controls and audit logs. Compliance also depends on how your practice configures and uses the platform.

Is there such a thing as a HIPAA-certified telehealth platform?

No. There is no official HIPAA certification for software. Vendors may hold security certifications or audits, but "HIPAA certified" is not a government credential. Look for a signed BAA instead.

Do I need a BAA with my telehealth vendor?

Yes, if the vendor creates, receives, stores or transmits PHI for your practice, which a telehealth vendor does (45 CFR 164.502(e) and 164.504(e) under the Privacy Rule; 164.308(b) and 164.314(a) under the Security Rule) (ecfr.gov). Sign the BAA before the first patient visit.

Can I still use regular Zoom, FaceTime or Skype for telehealth visits?

Not under the pandemic-era flexibility. OCR's enforcement discretion for consumer video tools ended on May 11, 2023 (federalregister.gov), with a transition period through August 9, 2023 (federalregister.gov). Consumer apps that don't offer a BAA are not suitable for visits involving PHI. Some vendors offer separate healthcare versions with a BAA (for example, Zoom signs a BAA on paid plans through Zoom for Healthcare) (zoom.us).

Are there free HIPAA-compliant telehealth platforms?

Some vendors offer free tiers, but many of them exclude a BAA. A free plan is only suitable for PHI if the vendor confirms in writing that the plan includes a signed BAA.

What should therapists look for in a telehealth platform?

Look for:

• a signed BAA on the plan you'll actually use
• browser-based join links
• intake and consent forms
• secure session notes
• clear recording controls
• pricing that fits a solo or small-group caseload

If you treat substance use disorders, also check 42 CFR Part 2 obligations (the 2024 final rule took effect April 16, 2024, and compliance was required by February 16, 2026) (hhs.gov).

How much does telehealth software cost per provider?

Most platforms charge per provider per month, with prices that vary by vendor, plan and feature tier. Add SMS, payment processing, storage and integration fees to get the real total.

What is a white-label telehealth platform?

It is a telehealth platform that a practice or health system brands as its own, with its own name, logo and domain. White-label platforms are typically sold under custom contracts, often with setup fees and a negotiated BAA.

Is Chanty a telehealth platform?

No. Chanty is internal team chat for staff. It is not used for patient video visits, patient messaging or clinical documentation. Practices use it alongside their telehealth platform and EHR to coordinate operational work. HIPAA with a signed BAA is available from the Business plan, and the Free plan does not include a BAA.