Is Zoom HIPAA Compliant? Zoom, FaceTime and HIPAA for Healthcare Video

Zoom can be used for patient video in a HIPAA-compliant way only on an eligible plan, with a signed business associate agreement (BAA), and with the account configured and governed by your practice. Free Zoom and accounts without a BAA are not appropriate for protected health information (PHI). FaceTime depends on whether Apple will sign a BAA that covers it, so confirm Apple's current position before using it with PHI. No video app is "HIPAA certified." This page gives the verdict for each product, what to check, and how to set Zoom up.

Short answer: Zoom yes with a BAA, FaceTime only if Apple signs one

Zoom: Zoom offers a BAA on certain plans. Confirm with Zoom which ones. Your practice is only covered if it has a signed BAA in place before any session involving PHI. You also need to confirm whether Zoom for Healthcare is still the required route.

Free Zoom and standard Pro: A free account does not come with a BAA, so it should not be used for patient sessions. For Pro and Workplace Pro, the answer depends on whether Zoom will sign a BAA for that account type. If there is no signed BAA, treat the account as not suitable for PHI, whatever its other features.

FaceTime: FaceTime is a consumer calling feature on Apple devices. Whether it can be used with PHI depends on Apple signing a BAA that covers it. Encryption does not change this.

About "HIPAA certified": HIPAA has no official certification program for software. When a vendor or reseller calls a tool "HIPAA certified," read that as marketing. Compliance comes from three things together: a signed BAA, correct configuration, and your practice's own safeguards, policies and training.

Product	BAA available	Plan required	Typical use	Notes
Zoom (free)	No	—	Not for PHI	Use for non-patient calls only
Zoom Pro / Workplace Pro	Ask Zoom	Ask Zoom	Depends on BAA	Confirm with Zoom before use
Zoom Workplace Business / Enterprise	Ask Zoom	Ask Zoom	Telehealth, staff meetings	BAA scope must name the products you use
Zoom for Healthcare	Ask Zoom	Confirm current plan names	Telehealth	Confirm the current offering and sales process
Zoom Phone	Confirm in BAA	Ask Zoom	Patient and staff calls	Check whether the BAA covers it
Zoom AI Companion	Confirm in BAA	Ask Zoom	Summaries, transcripts	Check coverage and default settings
Apple FaceTime	Confirm with Apple	—	Personal calls	Encryption is not a BAA

For other common tools, see more HIPAA tool checks.

Why a BAA decides the answer

A business associate agreement is a contract between a covered entity, such as your practice, and a vendor that creates, receives, stores or transmits PHI on your behalf. HIPAA requires one before that vendor handles PHI. A video platform that carries a patient's face, voice, symptoms and name during a visit is handling PHI. So is any recording, transcript or chat message saved from that visit.

The BAA sets out what the vendor must do to protect that information, how it reports breaches, and which of its products and services are covered. If you want a plain definition of the terms, see what a business associate agreement is in our glossary.

A BAA does not:

• Configure your account. Waiting rooms, recording and AI features are still your settings to manage.
• Train your staff or write your policies.
• Cover third-party apps, integrations or add-ons connected to the platform unless the BAA names them.
• Cover products the BAA does not list. If your BAA covers meetings but not phone or AI features, those stay outside it.

Encryption alone is not enough. An app can encrypt calls and still be inappropriate for PHI if the vendor has not signed a BAA. Encryption is one safeguard. The BAA is the legal relationship that makes the vendor accountable for protecting your patients' information.

Zoom and HIPAA: which version and what it costs

Zoom for Healthcare. Zoom has marketed a healthcare offering for clinical use. Ask Zoom how it is sold today. Before you buy, confirm three things with Zoom in writing: whether it still exists under that name, whether it is required to get a BAA, and which products it includes.

Zoom Workplace plans. Zoom sells several paid plan tiers, and BAA eligibility can differ between them. Do not assume that a higher tier automatically includes a BAA. Ask which plans are eligible and get the plan named in the agreement.

Pricing. We don't publish Zoom prices here because they change and can depend on seat counts and sales terms. Check Zoom's pricing page or ask its sales team, and record the date you checked. When you compare quotes, ask whether there is a seat minimum for the BAA-eligible plan. That can matter for a three-provider practice.

Zoom Phone. If you plan to use Zoom Phone for patient calls, such as appointment follow-ups or a front desk line, confirm that the BAA covers it. Voicemails and call recordings with patient details are PHI.

AI Companion, recordings, transcripts and cloud storage. Meeting summaries, transcripts and cloud recordings all create stored copies of PHI. Check two things:

1. Whether each feature is covered by your BAA.
2. Whether it is on or off by default on your account.

If a feature isn't clearly covered, turn it off for clinical sessions until you have confirmation. If recordings or transcripts are saved to another service, see Dropbox, iCloud and HIPAA-compliant cloud storage.

How to set up Zoom for HIPAA use

Step 1: Confirm eligibility and sign the BAA first. Get written confirmation that your plan is BAA-eligible. Sign the BAA before the first patient session, and keep a copy where your privacy officer can find it.

Step 2: Review account settings. If Zoom provides HIPAA configuration guidance for your account, use it as the baseline. Settings to review at the account level, not just per meeting:

• Waiting rooms, so a clinician admits each patient.
• Meeting passcodes or unique meeting links per session.
• Cloud recording: off unless you have a documented reason and BAA coverage.
• In-meeting chat and file transfer: restrict or disable if staff might share intake forms or lab results there.
• AI features (summaries, transcripts): off unless covered and approved.
• Lock settings at the account level so individual users can't switch them back on.

Step 3: Control who can host. Use accounts that your practice manages, not personal accounts that staff signed up for themselves. Limit who can create meetings. Offboard departing staff the same day, just as you would for your EHR.

Step 4: Document, train and check locations. Write a short policy that covers:

• Which tool to use for patient video.
• Where sessions may be held.
• What staff must never do, such as recording sessions on a phone or sending patient files in meeting chat.

Train staff on it. Check the devices and rooms used for sessions. A therapist on a laptop in a shared office with an open door is a privacy issue no BAA can fix.

Shared responsibility. Zoom is responsible for securing its platform under the BAA. Your practice is responsible for configuration, access, devices, policies and staff behavior.

Is Zoom safe for telehealth and therapy?

"Safe" for telehealth comes down to four practical things:

• A signed BAA on an eligible plan.
• Correct configuration, as described above.
• A private location on both ends where possible.
• Patient identity verification, for example confirming name and date of birth at the start of the visit before discussing care.

Therapy-specific points. Behavioral health sessions often involve especially sensitive information.

• Decide whether sessions are ever recorded. Many practices simply prohibit it.
• Keep session notes in your EHR or clinical documentation system, not in meeting chat or AI summaries.
• Check whether your state has additional telehealth or behavioral health requirements.

When a dedicated telehealth platform may fit better. Some practices prefer a telehealth tool that connects to their EHR or scheduling workflow, so visits launch from the appointment and intake happens in one place. Compare options on BAA scope and how well they fit your clinical workflow, not on the label "HIPAA compliant."

Separate questions. HIPAA covers privacy and security. Telehealth billing rules, payer requirements and clinician licensure across state lines are different questions. A BAA-covered Zoom account answers none of them.

FaceTime and HIPAA: what changed after the pandemic

During the COVID-19 public health emergency, HHS's Office for Civil Rights (OCR) announced it would not penalize providers for using non-public-facing communication apps such as FaceTime for telehealth in good faith, even without a BAA. That is why many practices used FaceTime in 2020 and 2021, and why older articles say it was "allowed."

That enforcement discretion has ended. The public health emergency ended, and OCR gave providers a transition period to move to compliant tools. It no longer applies.

Why encryption doesn't settle it. Apple describes FaceTime as encrypted. Strong encryption is good, but HIPAA still expects a BAA with a vendor that handles PHI for you. Unless Apple signs a BAA covering FaceTime, FaceTime does not meet that requirement.

Practical verdict for 2024–2025. If you were using FaceTime for patient visits during the pandemic, move those visits to a video tool that has a signed BAA and is configured for your practice. That could be a BAA-eligible Zoom plan, video within a productivity suite under that vendor's BAA, or a dedicated telehealth platform.

Zoom vs FaceTime vs other video tools at a glance

Tool	BAA for video	Plan or bundle	Admin controls for practice	Notes
Zoom (BAA-eligible plans)	Yes, on eligible plans	Confirm eligible plans with Zoom	Account-level settings, managed users	Check AI, recording and Phone coverage
Apple FaceTime	Confirm with Apple	Consumer feature	Confirm with Apple	Encryption is not a BAA
Google Meet in Google Workspace	Check Google's BAA scope	Google Workspace plan; confirm eligibility	Workspace admin console	See Google Meet and HIPAA
Microsoft Teams in Microsoft 365	Check Microsoft's BAA scope	Microsoft 365 plan; confirm eligibility	Microsoft 365 admin	See Microsoft 365 and HIPAA

Selection checklist:

• BAA signed before any patient session.
• Your plan or product is named in the BAA.
• Recordings, transcripts and AI features are covered, or turned off.
• Admin controls let you lock settings and manage users centrally.
• Staff are trained, and the policy names the approved tool.
• Offboarding removes access the same day.

Patient video vs internal staff calls

Most practices have two different kinds of video and calling:

• Patient telehealth visits. These are clinical encounters, so they need a video tool chosen for that purpose, under a BAA.
• Internal staff communication. These are morning huddles, a call between the front desk and billing about a claim question, or a weekly check-in between clinic managers at three locations.

Many practices use one tool for patient video and a separate workspace for internal coordination. That separation keeps clinical sessions in a controlled environment. It also gives staff a proper place to coordinate instead of personal group texts.

For the internal side, Chanty brings staff chat, calls and assigned tasks into one workspace. Chanty supports HIPAA compliance with a signed BAA on Business and Enterprise plans, covering data in the team space such as messages, files, voice notes and tasks. It is a tool for staff coordination, not a telehealth or patient video tool. See HIPAA-compliant chat for staff and Chanty security and BAA details.

To weigh internal options side by side, see team chat tools compared on HIPAA.

FAQ

Is free Zoom HIPAA compliant?

No. A free Zoom account does not include a BAA, so it should not be used for sessions involving patient information.

Is Zoom Pro or Zoom Workplace Pro HIPAA compliant?

Only if Zoom signs a BAA for that account. Without a signed BAA, don't use it for PHI.

Which Zoom version is HIPAA compliant?

No version is compliant on its own. Zoom offers a BAA on specific plans, so confirm with Zoom which ones apply. Compliant use also requires correct configuration and practice policies.

How much does HIPAA-compliant Zoom cost?

Check Zoom's current pricing or ask its sales team, and note any seat minimums.

How do I make my Zoom account HIPAA compliant?

1. Confirm your plan is eligible and sign the BAA.
2. Lock account settings, including waiting rooms, recording, chat, file transfer and AI features.
3. Use managed accounts and limit who can host.
4. Train staff under a written policy.

Is Zoom AI Companion covered by Zoom's BAA?

Confirm with Zoom. Until you have written confirmation, keep it off for patient sessions.

Is Zoom Phone HIPAA compliant?

Only if your BAA covers Zoom Phone and you configure voicemail and call recording appropriately.

Is FaceTime HIPAA compliant for telehealth in 2025?

Not unless Apple signs a BAA covering it. The COVID-era enforcement discretion that allowed it has ended.

Can therapists use Zoom for sessions under HIPAA?

Yes, if three conditions are met:

• The plan is BAA-eligible and the BAA is signed.
• Recording and AI features are controlled.
• Sessions are held in private locations.

Check state rules too.

Is there such a thing as HIPAA-certified video software?

No. HIPAA has no official software certification. Look for a signed BAA, clear scope, and admin controls you can configure.