Is FaceTime HIPAA compliant? Telehealth after the pandemic rules

Short answer (dated)

Encryption protects the call in transit. It doesn't supply the contract HIPAA expects with a vendor that handles your patients' information.

What HHS allowed during the COVID-19 emergency

On March 17, 2020, HHS's Office for Civil Rights (OCR) issued a Notification of Enforcement Discretion (opens in a new tab) for telehealth. OCR said it would not penalize providers for HIPAA noncompliance connected to the good-faith provision of telehealth during the emergency.

The notice named non-public-facing apps providers could use, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom and Skype. It said public-facing apps such as Facebook Live, Twitch and TikTok should not be used. Providers would not be penalized for lacking a BAA with a video vendor.

This was a decision not to enforce, not a change to HIPAA. The Security Rule and the BAA requirement never went away; OCR set them aside for the emergency.

When the enforcement discretion ended

The notice says OCR "will no longer use the Telehealth Notification as a basis to exercise its discretion" for noncompliance after that last date. One trap: HHS's older FAQ on expiration (opens in a new tab), last reviewed July 17, 2020, still says the notification "does not have an expiration date." The 2023 notice superseded it.

Does Apple sign a BAA?

Not that we could find. As of October 2026:

• Apple's FaceTime & Privacy page (dated December 12, 2025) says Apple "can't access the content of your calls" and has no mention of HIPAA, health information or BAAs.
• Apple's healthcare page (opens in a new tab) talks about connecting with patients remotely but doesn't mention HIPAA or BAAs.
• The only HIPAA language we found from Apple is in its iCloud terms (opens in a new tab), which say covered entities and business associates will not use iCloud "to create, receive, maintain or transmit any" protected health information. That clause is about iCloud, not FaceTime, but it shows Apple's posture.

Some argue that an end-to-end encrypted call is a pass-through service. HHS's cloud computing guidance (opens in a new tab) says the conduit exception "is limited to transmission-only services." Whether any app fits is a legal judgment, and neither Apple nor HHS has confirmed it for FaceTime on the pages we checked.

FaceTime also lives on personal devices and Apple Accounts. Calls come from a clinician's own number or email, and call history sits on a phone that may be shared at home. People on Android or Windows join by web link after giving a name; Apple's page doesn't say whether those calls are protected the same way.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Moving patients to a covered video tool

A transition you can finish in a month:

1. Choose a tool with a BAA for your plan. Your EHR's telehealth module, Zoom for telehealth, Google Meet video visits or Microsoft Teams and HIPAA. Practices on Google Workspace or Microsoft 365 may already have a BAA that covers video.
2. Sign the BAA and configure it first. Waiting room or lobby on, recording off unless you need it.
3. Update visit instructions. Confirmation templates, your website's telehealth page and the front desk's phone script.
4. Tell patients. One short message, sent through your portal or usual reminder channel.
5. Stop booking new FaceTime visits. Pick a cut-off date and remove FaceTime from scheduling notes.
6. Clean up phones. Remove patient contacts saved on personal devices for FaceTime calls.

If FaceTime came with texting patients over iMessage, the same review applies there; see WhatsApp and iMessage. What a BAA must contain is covered in business associate agreements, and every tool we've checked is on the HIPAA-compliant email and messaging hub.

Medfy doesn't sell telehealth tools. For its own services, it signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit shows whether your website explains virtual visits clearly to new patients.

Frequently asked questions

Can I still use FaceTime for telehealth?

Not as a routine telehealth tool. HHS's pandemic-era enforcement discretion, which named FaceTime, ended with a transition period that closed at 11:59 p.m. on August 9, 2023. Today a vendor that carries your video visits needs a BAA, and Apple publishes no BAA offering for FaceTime. Move visits to a covered tool and set a date to stop. Confirm the decision with your compliance officer or attorney.

Does Apple sign a BAA for FaceTime?

We found no Apple page offering one as of October 2026. Apple's FaceTime privacy page doesn't mention HIPAA or business associate agreements, and Apple's iCloud terms tell covered entities not to use iCloud for protected health information or in any way that would make Apple their business associate. Treat that as a no unless Apple puts a BAA in writing for your practice.

Is FaceTime encrypted end to end?

Apple says it designed FaceTime to use end-to-end encryption and that it can't access the content of your calls. Encryption is one safeguard, not the whole HIPAA test: a business associate agreement, device controls and access management still apply. Apple's page doesn't say whether calls with people who join by web link from Android or Windows are protected the same way.

What should replace FaceTime for video visits?

A video tool whose vendor signs a BAA for the plan you use: the telehealth module in your EHR, Zoom on a paid plan with Zoom's BAA, or Google Meet or Microsoft Teams under the BAA you may already have for email. Pick one, set up the waiting room or lobby, update patient instructions, and stop booking new FaceTime visits from a fixed date.