HIPAA-compliant video calls for healthcare staff

No video tool is HIPAA compliant on its own. Compliance depends on four things: a signed Business Associate Agreement (BAA), a plan that includes it, the right safeguards, and how your staff use the tool. Chanty handles internal staff calls, such as huddles, admin check-ins and cross-location meetings. These calls run in the same workspace as your team chat, tasks and files. HIPAA with a signed BAA is available from the Business plan. Chanty is not a telehealth or patient video visit platform, so if you need to see patients over video, you need a different tool.

Is video conferencing HIPAA compliant? The short answer

You may see the claim that "most video conferencing software is HIPAA compliant." As written, that's false. Software isn't compliant or non-compliant by default. A video tool can be used in a HIPAA-compliant way when two conditions are met:

1. The vendor signs a BAA with your organization.
2. Your organization configures and uses the tool correctly.

HIPAA has no official certification for software. Be cautious with any vendor that calls its product "HIPAA-certified." Ask instead whether it signs a BAA, which plans include it, and what the BAA covers.

It also helps to split the question into two use cases early:

• Internal staff calls. Morning huddles, front desk to manager check-ins, operations meetings across locations, IT support.
• Patient video visits (telehealth). Clinical sessions with patients or clients. These use different tools and carry different requirements.

Chanty covers the first use case. It provides internal staff video and voice calls, with HIPAA and a signed BAA available from the Business plan. It is not built for telehealth, patient visits or streaming video to patients or the public.

If you're checking a specific product, see is it HIPAA compliant? popular tools checked.

What HIPAA requires of a video calling tool

A Business Associate Agreement. A vendor that creates, receives, maintains or transmits protected health information (PHI) on your behalf is a business associate. You need a BAA with that vendor before PHI goes through its service (45 CFR 160.103 defines a business associate as one who "creates, receives, maintains, or transmits protected health information" on a covered entity's behalf; the BAA requirement itself is in 45 CFR 164.308(b), 164.502(e) and 164.504(e)) (ecfr.gov). If staff will discuss patients on calls, even briefly ("Can you call Mrs. R. back about her referral?"), plan for PHI.

Security Rule safeguards. The technical safeguards that matter most for video are (45 CFR 164.312 sets five standards: access control, audit controls, integrity, person or entity authentication, and transmission security; encryption is addressable, not required) (ecfr.gov):

• Access controls. Only authorized staff can join calls and see related conversations.
• Unique user identification. Every person has their own account. No shared front desk logins.
• Transmission security. Call data is protected in transit.
• Audit controls. You can review activity on systems that handle PHI.

What the vendor can't do for you. A BAA doesn't cover your own operations. Your organization still decides who gets an account and removes access when people leave. It also sets device rules, such as screen locks and no shared family tablets, and writes and trains staff on policies.

The conduit exception. Some services that only transmit data, such as a basic phone line, may not be business associates. This exception generally doesn't apply to video platforms that store or process data, such as chat history, files or account records HHS limits the conduit exception to transmission-only services with only transient access, such as the postal service; a provider that stores or processes electronic PHI, such as chat history, files or other stored content, is a business associate even if the data is encrypted and it holds no key (hhs.gov).

COVID-era enforcement discretion. During the public health emergency, HHS OCR relaxed enforcement for good-faith telehealth using non-public-facing video apps. That discretion has ended ; it applied only to covered health care providers serving patients via telehealth, never to internal staff calls, and expired at 11:59 p.m. on May 11, 2023, with a telehealth transition period ending August 9, 2023 (federalregister.gov). If your team adopted a consumer app during that period for internal calls, review it now.

Internal staff calls vs. patient video visits

Internal calls are the everyday coordination that keeps a clinic running:

• A five-minute morning huddle between the practice manager and front desk across two sites
• A front desk lead calling the clinic manager about an overbooked afternoon
• A weekly operations meeting for a multi-location group
• IT walking a receptionist through a printer or login issue with screen sharing
• HR onboarding calls for new staff

Patient visits are a different purchase. They typically need patient-facing scheduling, virtual waiting rooms and visit workflows tied to your EHR. A team chat tool doesn't provide these, and Chanty doesn't integrate with EHRs or patient records. For patient visits, evaluate dedicated telehealth platforms and confirm each one's BAA.

For therapists. If you searched for "HIPAA-compliant video conferencing for therapists," note that sessions with clients are telehealth. Chanty isn't the tool for them. It can cover your practice's internal calls, such as a clinical director meeting with admin staff about intake backlog or billing questions.

Why one consumer app for everything is risky. Some practices use a personal messaging or video app for both staff calls and patient contact. That usually means personal accounts, no BAA and no admin who can remove a departing employee. It's the most common gap, and it's easy to close by separating the two use cases.

Video and voice calls in Chanty

Chanty puts calls next to the rest of your team's work, so a call doesn't end up as a disconnected event. You can browse all Chanty features for healthcare teams, but here is how calls fit in.

Calls start where the work is. Calls live in the same workspace as your HIPAA-compliant chat for staff, shared files and tasks. Suppose a billing question comes up in your #front-desk-north conversation. You can start the call from that conversation, then turn call follow-ups into assigned tasks with an owner and a deadline. For example: "Maria to resend the corrected claim by Thursday." The decision doesn't depend on someone remembering it.

What each plan includes Free ($0, up to 5 members, unlimited one-on-one audio and video calls, 20GB storage, no BAA); Business ($3 per user per month, adds group calls, screen sharing, custom roles and retention, HIPAA compliance and BAA, SSO, 2FA, IP allowlist, 99.9% uptime); Enterprise (contact sales, adds SAML SSO, SCIM, data residency, DLP) (chanty.com):

• Free: unlimited 1:1 calls
• Business: unlimited group calls and screen sharing

Capacity. The Chanty site states up to 1,000 video participants and 49 videos on screen ; Chanty doesn't name a plan for this figure, and group video calls are on Business and Enterprise only (chanty.com).

Apps on every device. Chanty runs on iOS, Android, macOS, Windows and web. A medical assistant can join a huddle from a phone between rooms, and a manager at another site can join from a laptop. The interface feels like familiar messaging apps, so staff need little training.

Voice messages for staff who can't join live. Staff who are with a patient or off shift during the huddle can catch up through a recorded voice note in the conversation. They don't need a separate call.

Plans, BAA and security controls for calls

Free plan: no BAA. Don't discuss or share PHI on the Free plan. That includes calls, messages and files. Use Free for trials and non-PHI coordination only. It's limited to 5 members, so it works for testing rather than running a clinic. If you're looking for "free HIPAA-compliant video conferencing," this is the honest answer: without a signed BAA, a free plan isn't suitable for PHI.

Business plan: HIPAA with a signed BAA. The Business plan also includes:

• Customizable roles and retention settings
• Two-factor authentication and SSO
• IP allowlisting (Business and Enterprise) (chanty.com)
• A 99.9% monthly uptime commitment in the plan terms

The BAA covers all data in the team space: messages, files, voice notes, tasks and Teambook.

Enterprise plan. Enterprise adds:

• The BAA with a negotiated MSA
• SAML SSO, directory sync and SCIM
• DLP and governance controls
• Unlimited custom roles
• Data residency in the US, EU or APAC
• An on-premise option

Encryption. Chanty encrypts data in transit with TLS 1.2+, using forward secrecy and AES-128-GCM, and encrypts file storage. On calls, signalling runs over TLS 1.2+ and call audio and video travel over encrypted WebRTC (DTLS-SRTP) between participants and Chanty's media servers. Chanty calls are not end-to-end encrypted.

Guests. External guests, such as contractors and vendors, can only see the conversations you add them to. Business includes 3 free guest seats per paid member. To keep guests out of internal calls, follow two rules:

• Put a guest only in a dedicated conversation, such as #it-vendor-support.
• Run staff huddles from conversations that have no guests in them.

For SOC 2 Type II and ISO/IEC 27001 details, see Chanty security, HIPAA and BAA details. Both reports cover the Chanty services and are available on request.

Call recording and HIPAA: what to know

A recording that contains PHI is PHI. Before anyone presses record, you need to know where the recording will be stored, who can access it, how long it's kept, and whether that storage is covered by a BAA.

When you evaluate a recording or archiving tool, check five things:

• BAA scope. The BAA explicitly covers recordings and transcripts, not just live calls.
• Retention controls. You can set how long recordings are kept ; HIPAA's six-year retention rule (45 CFR 164.316(b)(2)(i)) applies to compliance documentation, not call recordings, so recording retention is set by state law and your own policy (ecfr.gov).
• Access permissions. Recordings are limited by role, not open to everyone in a meeting.
• Export and deletion. You can retrieve recordings for requests and delete them on schedule.
• Audit logs. You can see who viewed or downloaded what.

Consent is a separate issue. State laws differ on whether one party or all parties must agree to a recording.

Does Chanty record calls? Audio and video call recording is available on the Enterprise plan only, and customers control the compliance settings of recordings for HIPAA. Free and Business don't include call recording. On those plans, if your workflow requires recorded or archived calls, use a dedicated recording or archiving tool that signs a BAA covering recordings.

Integrations are outside Chanty's BAA. Third-party integrations, including file storage connectors like Google Drive, Dropbox, OneDrive or Box, aren't covered by Chanty's BAA. Check each vendor's BAA separately. The same logic applies to any file, so read more about sharing files securely with your team.

How Chanty compares with other video options for staff

Tool	BAA availability and qualifying plan	Team chat and tasks in the same app	Mobile apps
Microsoft Teams	BAA included by default via the Microsoft Data Protection Addendum for in-scope commercial and government services, including Teams (learn.microsoft.com)	Chat yes; tasks through Microsoft 365 apps	iOS and Android
Zoom	Standard BAA available on request; qualifying plans not confirmed (zoom.com)	Chat yes (Zoom Team Chat); check vendor for task features	iOS and Android
Google Meet	Business Associate Amendment accepted in the Admin console; covers only services on Google's HIPAA Included Functionality list (Meet inclusion and editions not confirmed) (knowledge.workspace.google.com)	Chat in Google Chat, a separate Workspace app; check vendor for task features	iOS and Android
Slack (huddles)	Signed BAA on Enterprise Grid only, with DLP, SSO and archival required; huddles coverage not confirmed (slack.com)	Chat yes; check vendor for task features	iOS and Android
Chanty	Signed BAA on Business and Enterprise; none on Free	Yes: chat, calls, tasks (list and Kanban) and files	iOS, Android, macOS, Windows, web

Where another tool fits better:

• Microsoft 365 organizations. If you're standardized on Microsoft 365 and want Teams-native meetings and telephony, Teams is the natural fit.
• Patient telehealth. If you need patient visits, choose a dedicated telehealth platform.

Where Chanty fits. Chanty suits outpatient clinics and multi-location practice groups that want calls, chat, announcements and tasks in one simple app, with a BAA from the Business plan.

Honest limitations:

• Some reviews report video-call and notification reliability issues.
• Chanty has no built-in shift scheduling.
• Its native integration catalog is smaller than Slack's or Teams'. Zapier, Make and n8n extend it.

For full vendor checks, see team chat tools compared for HIPAA.

Setting up staff video calls safely

1. Sign the BAA first. Upgrade to Business or Enterprise and sign the BAA before anyone discusses or shares PHI. Until then, treat the workspace as PHI-free.
2. Lock down access.
   • Set roles and permissions so each role sees only the conversations it needs. For example, front desk staff see front desk and site channels, not HR.
   • Require 2FA, and SSO where you have an identity provider.
   • Keep guests in their own dedicated conversations.
3. Write a one-page staff policy. Cover:
   • Where work calls happen (Chanty, not personal apps)
   • When PHI may be discussed: minimum necessary, and never in a waiting room or other public area
   • Device rules: screen lock, no shared personal devices
   • A clear ban on personal messengers for work calls
4. Offboard the same day. Remove access when someone leaves. Don't wait until the end of the pay period.

You can start on Chanty for free, then upgrade to Business for the BAA before PHI enters the picture: sign up for Chanty.

FAQ

Is Zoom, Google Meet or Microsoft Teams HIPAA compliant?

None of them is compliant by default, and neither is any other tool. Each can be used under HIPAA only with a signed BAA on a qualifying plan, plus correct configuration. Microsoft includes its BAA by default in its Data Protection Addendum and Google's is accepted in the Admin console, so the accurate requirement is a BAA in place plus correct configuration; a plan restriction is confirmed only for Slack (Enterprise Grid). (learn.microsoft.com)

Is there a free HIPAA-compliant video conferencing tool?

Chanty's Free plan doesn't include a BAA, so it isn't suitable for PHI. Free tiers rarely include a BAA. A BAA is a contract that commits the vendor to specific safeguards and obligations, and vendors usually tie it to paid plans with admin controls. Slack, for example, supports a BAA only on Enterprise Grid; check each vendor's terms rather than assuming. (chanty.com)

Is most video conferencing software HIPAA compliant?

No. Compliance comes from a signed BAA plus how your organization configures and uses the tool. The software alone doesn't make you compliant.

Do I need a BAA for internal staff video calls?

You need one if PHI may come up on those calls or in related chats and files. In a clinic, it usually does. If you're certain calls never involve PHI, a BAA may not be required, but that's hard to guarantee in practice (business associate status turns on creating, receiving, maintaining or transmitting PHI under 45 CFR 160.103) (ecfr.gov).

Can I use Chanty for telehealth or patient video visits?

No. Chanty is for internal staff communication. For patient or client sessions, use a dedicated telehealth platform with its own BAA.

Does Chanty record video calls?

Yes, on the Enterprise plan only, with customer-controlled compliance settings for HIPAA. Free and Business don't include call recording. On those plans, if you need recordings, use a dedicated tool whose BAA covers them.

Are Chanty video calls end-to-end encrypted?

No. Chanty encrypts data in transit with TLS 1.2+ (forward secrecy, AES-128-GCM) and encrypts file storage. Call signalling runs over TLS 1.2+, and call media travels over encrypted WebRTC (DTLS-SRTP) between participants and Chanty's media servers.

Which Chanty plan includes group video calls and screen sharing?

The Business plan, which also includes HIPAA with a signed BAA. The Free plan includes unlimited 1:1 calls (audio and video, for teams of up to 5 members) (chanty.com).

Can contractors or vendors join staff calls without seeing other conversations?

Guests can only see the conversations you add them to. Create a dedicated conversation for each contractor or vendor. Hold internal huddles in conversations that have no guests.