Is Zoom HIPAA Compliant for Telehealth?What Zoom's own documents say about its BAA, what HHS requires for video visits, and five settings to check.
Zoom can be used for telehealth when the practice has a signed BAA with Zoom. A Zoom account without a BAA is not covered. Here is what Zoom and HHS say.
On this page
Zoom can be used for telehealth when the practice has a signed Business Associate Agreement (BAA) with Zoom. A Zoom account without a BAA is not covered. We read Zoom's healthcare page and its HIPAA compliance guide on October 9, 2026. This guide covers what Zoom says, what HHS requires, and which settings to check.
Zoom and HIPAA at a glance
- Zoom signs BAAs. Its healthcare page says Zoom for Healthcare enables HIPAA compliance "by executing a Business Associate Agreement (BAA)."
- Zoom's public pages do not list which plans qualify. Zoom staff direct BAA requests to its Sales team.
- HHS telehealth leniency from the pandemic expired at 11:59 p.m. on August 9, 2023.
- Zoom states that customers are responsible for making their use of Zoom fit their HIPAA duties.
Does Zoom sign a BAA?
Is AI recommending you?
Webpatch can show you how your practice appears in ChatGPT, Google’s AI, and search — and what to fix first.
Check your visibility →Yes. Zoom's HIPAA compliance guide states that Zoom "enters into business associate agreements (BAAs) to facilitate our customers' compliance with HIPAA." Zoom's healthcare page repeats this for its Zoom for Healthcare offering.
Neither document names the plans that qualify. In Zoom's community forum, a Zoom employee answered a BAA question by calling it "the scope of our Sales team." Do three things before the first patient visit:
- Contact Zoom Sales and ask which plan includes a BAA for your practice size.
- Get the signed BAA and save a dated copy.
- Confirm that every clinician signs in to the covered account, not a personal one.
What does HHS require for video visits?
HHS requires a BAA with any telehealth vendor that is more than a conduit for patient information. During the COVID-19 emergency, the HHS Office for Civil Rights did not penalize good-faith telehealth on everyday video apps. That policy ended. HHS says the notifications expired on May 11, 2023, and the transition period for providers expired "at 11:59 p.m. on August 9, 2023."
HHS explains the conduit rule in its audio telehealth guidance.
| BAA required? | HHS wording | |
|---|---|---|
| A phone carrier that only connects the call | No | The vendor "has only transient access to the PHI it transmits" |
| An app that stores recordings or transcripts in its cloud | Yes | "The provider would need to enter into a BAA with the app developer before it can use the app with patients" |
A video platform with accounts, chat, recordings, and transcripts falls on the second row.
What security does Zoom document?
Zoom's HIPAA compliance guide documents these controls.
Encryption at rest
"Customer data-at-rest is encrypted using a minimum 256-bit AES-GCM."
Encryption in transit
Data is encrypted between customers and Zoom, using TLS 1.2 or 256-bit AES-GCM where supported.
Access control
Unique user IDs, automatic logoff, and monitoring of failed logins. Admins can enable two-factor authentication.
Audits
Meetings, Team Chat, Phone, and Contact Center have undergone SOC 2 + HITRUST audits.
The same guide puts the final duty on the customer: "Zoom's customers are responsible for ensuring their use of Zoom's services aligns with their obligations under HIPAA."
Which Zoom settings should a practice check?
Turn on two-factor authentication
Require it for every clinician and staff account.
Use a waiting room and passcode
Admit each patient by name. Never reuse one open meeting link for back-to-back visits.
Decide on recording
Turn recording off unless the practice has a clinical reason and a storage plan. A recording is patient information.
Review AI features
Ask Zoom whether meeting summaries and other AI features are covered by your BAA before you enable them.
Review third-party apps
Remove marketplace apps that can read meeting data unless each vendor has its own BAA with the practice.
Is the patient's booking link covered too?
Not by Zoom's BAA. A telehealth visit usually starts with a booking tool and a reminder email. Each of those vendors handles patient information and needs its own BAA. Our guide to Calendly and HIPAA covers scheduling tools.
How Webpatch helps
Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want your telehealth booking flow reviewed, contact Webpatch.
This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.
Frequently asked questions
Does Zoom sign a BAA?
Yes. Zoom's HIPAA compliance guide says Zoom enters into business associate agreements to facilitate customers' compliance with HIPAA. Zoom directs BAA requests to its Sales team.
Is free Zoom HIPAA compliant?
Zoom's public healthcare page and HIPAA guide do not list a BAA for a free account. Do not use any Zoom account for patient visits until Zoom has signed a BAA for that account.
Can doctors still use any video app for telehealth?
No. The HHS enforcement discretion that allowed everyday video apps during the COVID-19 emergency expired at 11:59 p.m. on August 9, 2023.
Is Zoom encrypted?
Zoom's HIPAA compliance guide states that customer data at rest is encrypted using a minimum of 256-bit AES-GCM, and that data in transit between customers and Zoom is encrypted.
Does a Zoom BAA make a practice HIPAA compliant?
No. Zoom states that its customers are responsible for ensuring their use of Zoom's services aligns with their obligations under HIPAA.
References
Related articles
More guides on getting found — and chosen.
