Last verified: October 2026, against Doxy.me's homepage, pricing page, security page and help center. General information, not legal advice — confirm with your compliance officer or attorney.
Is Doxy.me HIPAA compliant? Doxy.me is built for telehealth and offers a business associate agreement (BAA) that you generate yourself in the app. The catch in 2026 is that its public pages describe plans differently, so a practice needs to confirm which BAA its own account carries, and whether it's meant for one provider or a whole clinic.
Is Doxy.me HIPAA compliant? Doxy.me's own answer
Short answer (verified October 2026): Doxy.me's pricing page (opens in a new tab) lists "HIPAA compliant" and "BAA included" on its Premium plan, and its homepage (opens in a new tab) lists a "Free BAA." Its help article on getting a BAA (opens in a new tab) says "All doxy.me users get a free Business Associate Agreement (BAA)," generated from the BAA tab in Account Settings. Another help article (opens in a new tab) says "The BAA found in our Free and Professional accounts is meant for individual providers only," and multi-provider practices should contact Doxy.me about a clinic BAA.
What we couldn't confirm: the help articles are dated June 30, 2023 and use older plan names (Free, Professional, Clinic), while the current pricing page shows a Premium plan and doesn't describe a free plan's features. Check the BAA tab in your own account before your first visit.
Search interest is modest: "is doxy.me hipaa compliant" gets about 110 searches a month in the US, at a CPC of $10.70 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
A telehealth platform transmits PHI in every visit. HIPAA allows that only when the practice has "satisfactory assurance" that the vendor will safeguard the information, "documented through a written contract" (45 CFR 164.502(e) (opens in a new tab)). 45 CFR 164.504(e) (opens in a new tab) says the contract must, among other things, limit how the vendor uses the data and require appropriate safeguards. For a refresher, see business associate agreements.
Doxy.me's own help center agrees on scope: a BAA "is applicable to U.S. entities that meet the definition of a Covered Entity." If you're a US practice seeing patients, that's you.
A downloaded BAA covers Doxy.me's side. Your side, from who opens the waiting room to what's said in chat, is still your practice's responsibility.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which Doxy.me plans a BAA can cover
| Account type (as Doxy.me describes it) | BAA, per Doxy.me | Source and date |
|---|---|---|
| Premium | "BAA included" | Pricing page, checked October 2026 |
| Free | BAA "meant for individual providers only" | Help center, June 30, 2023; homepage lists "Free BAA" |
| Professional (older plan name) | Same individual-provider BAA | Help center, June 30, 2023 |
| Clinic (multi-provider) | Contact Doxy.me; only clinic admins can generate it | Help center, June 30, 2023 |
How the self-serve BAA works, per Doxy.me: open Account Settings, select the BAA tab, enter your details, then generate and download the agreement. Doxy.me says it will "keep a copy of the BAA in your account permanently." The article describes generating and downloading, not a countersignature, so file your downloaded copy with your other vendor agreements.
Free vs paid plans for telehealth
For a solo clinician, the free tier is the question: Doxy.me's help center says even Free accounts get the individual-provider BAA. For a group practice, the individual BAA doesn't stretch to colleagues, and the Premium plan adds the things a team needs: "Multi-user capable," "Roles and permissions," "Shared Rooms for team-based care" and "Patient transfer and routing between providers."
Paid features also change what's stored. Doxy.me's 2023 help article says "the session is never recorded or otherwise stored" and that transferred files are "automatically and permanently deleted after 15 minutes." The current Premium plan lists "Automated notetaking and session summaries," and Doxy.me's security page (opens in a new tab) mentions "Optional data retention (coming soon)." Ask Doxy.me where notes and summaries are kept, for how long, and confirm they fall under your BAA.
General video tools work differently: the BAA usually depends on a specific plan and an admin step. Google, for example, lists Google Meet among the Workspace services in its BAA (Google (opens in a new tab)). Compare the details in our zoom and google meet pages.
Safe uses and unsafe uses for a practice
| Use | Safe? | Note |
|---|---|---|
| Solo clinician's visits with the individual BAA downloaded | Yes | Keep the BAA on file |
| Group practice sharing one provider's free account | No | The individual BAA covers individual providers only |
| Group practice on a clinic or Premium account with a BAA | Yes | Assign roles; remove departed staff |
| Sending lab results through in-session file transfer | Use sparingly | Your portal is a better record |
| AI session summaries | Only after confirming storage and BAA scope | Ask Doxy.me in writing |
| SMS invitations with a reason for visit in the text | No | Keep invite texts generic |
Safer setup or alternatives
- Download the BAA from the BAA tab before the first visit, and keep a copy outside Doxy.me.
- Match the account to the practice. One provider, individual BAA; several providers, clinic BAA.
- Keep invitations generic. Doxy.me can invite patients by email or SMS; leave diagnoses and visit reasons out of the message.
- Decide on AI notes before turning them on, with your clinical lead.
- Review users whenever someone joins or leaves.
If your EHR includes telehealth, using it keeps the visit next to the chart. Our hub on HIPAA and everyday tools covers the other tools a practice runs on.
Medfy doesn't run video visits. It covers the step before: a patient finds your practice online and sends a request through your website's HIPAA-compliant forms or chat, which Medfy stores in separate, encrypted HIPAA databases in the US or Canada under a BAA it signs with each practice (how Medfy handles patient data). A free marketing audit shows how your practice shows up online, including whether Claude and Gemini name you.
Frequently asked questions
Will Doxy.me sign a BAA?
Yes. As of October 2026, Doxy.me's homepage lists a "Free BAA," its pricing page shows "BAA included" on the Premium plan, and its help center says all users get a free BAA, generated and downloaded from the BAA tab in Account Settings. That self-serve BAA is for individual providers; practices with more than one provider are told to contact Doxy.me. Confirm your account type with your compliance officer or attorney.
Is the free version of Doxy.me HIPAA compliant?
Doxy.me's help center says Free accounts get a BAA meant for individual providers, and its homepage advertises a free BAA. Its current pricing page, though, shows the BAA only on Premium and doesn't describe the free plan. Before a solo clinician sees patients on a free account, check that the BAA tab is in Account Settings and download the agreement. Group practices should ask Doxy.me about a clinic BAA.
Can a practice use Doxy.me without patient information?
Hardly. A telehealth visit is a patient encounter, so names, faces and health details are PHI the moment the call starts. Doxy.me without a BAA suits only non-patient uses such as a staff meeting or a demo with a colleague. For any visit, have the BAA in place first, and keep chat messages and file transfers to what the visit needs.
What is a HIPAA-compliant alternative to Doxy.me?
Any video tool whose vendor signs a BAA for the plan you use: your EHR's built-in telehealth, Google Meet on a Google Workspace plan with the BAA accepted, or another telehealth platform with a BAA. Compare waiting rooms, recording and note-taking features, and where session data is stored. Then confirm the plan and settings with your compliance officer or attorney.