Last verified: October 2026, against Zoom's own support, trust and healthcare pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is Zoom HIPAA compliant? Zoom signs a business associate agreement (BAA), and a paid Zoom account under that BAA can carry video visits. A free account, or a clinician's personal login, can't. After the contract, the settings decide the rest: who gets into the visit, whether it's recorded, and what Zoom's AI features do with the conversation.
Short answer (dated) from Zoom's own documentation
Short answer (verified October 2026): Zoom's compliance FAQ (opens in a new tab) says "Zoom has a standard BAA that can be entered into when required by our customers." Its BAA support article (opens in a new tab) describes BAAs for Pro, Business, Business Plus and Enterprise plans and for customers on other paid plans, and no route for a free account. It also warns: "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place."
Zoom's own FAQ adds that "There is currently no regulatory-backed certification available for HIPAA compliance." Its HIPAA page (opens in a new tab) says it aligns its controls with the HITRUST CSF security framework. Neither makes a practice compliant; the BAA plus your configuration does.
Which Zoom accounts a BAA can cover
Zoom's support article describes four situations.
| Your situation | How the BAA gets signed, per Zoom |
|---|---|
| Buying Pro | Buy from the healthcare section of Plans & Pricing, then select and accept the agreement for your country at checkout |
| Existing paid account | Web portal: Plans and Billing > Plan Management > "view more products" > enable the Business Associate Agreement (US only) |
| Business, Business Plus, Enterprise | Contact Zoom Sales |
| Free account | No route described |
Canadian billing addresses may see a Personal Health Information Annex (PHIA) instead of a BAA. Zoom says that "Once you execute a BAA with Zoom, no additional manual configuration is required." That covers Zoom's side. Your side is every account that runs a visit: a part-time clinician hosting from their own login is outside your BAA.
Settings for telehealth: waiting rooms, recording, chat
Use these as a checklist. Names follow Zoom's documentation as of October 2026.
- Waiting room on, and locked. Admin Center > Settings > Meeting > Security > "Enable waiting room." Zoom's waiting room article (opens in a new tab) explains how to lock it so hosts can't switch it off. Patients wait until the clinician admits them.
- Passcodes and room locking. Zoom's HIPAA Compliance Guide (opens in a new tab) lists forced passcodes and locked-room functionality among its admittance controls.
- Recording restricted. Zoom's healthcare deployment guide (opens in a new tab) suggests user groups so clinicians who receive "vital patient information" over video can't record.
- Chat kept administrative. The guide says admins can stop users from chatting with or adding external contacts. Keep clinical detail out of meeting chat.
- Two-factor authentication. The guide says admins can require it for every user.
- End-to-end encryption where it fits. Zoom says it's available when everyone joins from the Zoom desktop app, mobile app or Zoom Rooms, so it won't suit patients joining from a browser.
Recordings, transcripts and AI summaries: where PHI ends up
Every recording, transcript or summary is another copy of protected health information (PHI). Before turning one on, decide where it is stored, who can open it and when it's deleted.
- Cloud recording. Zoom's November 2020 announcement (opens in a new tab) said Zoom for Healthcare licenses include "cloud recording for clinical applications" under its BAA. Covered isn't the same as needed: most visits don't need a recording, and state recording-consent laws may apply.
- Local recording. A file saved to a clinician's laptop is outside Zoom's cloud controls and inside your device policy.
- AI Companion. Zoom says AI features "are available to customers with BAAs in place," with the caveat quoted above, so check which ones your account shows. Its HIPAA guide says Zoom doesn't use customers' audio, video or chat "to train Zoom's or its third party artificial intelligence models." When a meeting summary is running, Zoom's AI whitepaper (opens in a new tab) says attendees see an AI Sparkle icon; tell the patient before it starts.
- Third-party note-taker bots. A bot that joins the call is a separate vendor with its own terms. See AI note-takers in meetings.
Pandemic-era flexibility has ended
On March 17, 2020, HHS's Office for Civil Rights (OCR) issued a Notification of Enforcement Discretion (opens in a new tab). It said OCR wouldn't penalize providers for good-faith telehealth over non-public-facing apps, including Zoom, even without a BAA.
That is over. The Federal Register notice (opens in a new tab) of April 13, 2023 says the notifications expired "at 11:59 p.m. on May 11, 2023," and the 90-calendar-day telehealth transition expired "at 11:59 p.m. on August 9, 2023." Since then, the ordinary rules apply: a BAA with your video vendor and Security Rule safeguards on every account.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Other video options to compare
If your practice already pays for an office suite, the video tool inside it may be covered by a BAA you've already signed:
- Google Workspace practices: Google Meet for telehealth.
- Microsoft 365 practices: Microsoft Teams and HIPAA.
- Clinicians still on FaceTime from 2020: FaceTime and HIPAA.
Email, messaging and file-sharing checks are on the HIPAA-compliant email and messaging hub. If you're promoting virtual visits, see telehealth marketing.
Medfy doesn't sell video or telehealth tools. For its own services, Medfy signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit checks how your telehealth pages and booking links appear to patients searching online.
Frequently asked questions
Is the free version of Zoom HIPAA compliant?
No. Zoom's BAA article describes BAAs for paid plans, including Pro, Business, Business Plus and Enterprise, and describes no route for a free account. Without a BAA, Zoom isn't acting as your business associate, so a free account shouldn't carry patient visits. A Pro plan bought through Zoom's healthcare pricing page can include the BAA at checkout. Confirm your choice with your compliance officer or attorney.
Does Zoom sign a BAA?
Yes. Zoom's compliance FAQ says it has 'a standard BAA that can be entered into when required by our customers.' Pro buyers accept it at checkout from the healthcare pricing page, existing US accounts can enable it under Plans and Billing, and Business, Business Plus and Enterprise customers sign through Zoom Sales. Canadian billing addresses may see a Personal Health Information Annex instead.
Can we record telehealth visits on Zoom?
Under a BAA, yes: Zoom announced cloud recording for clinical use on its healthcare licenses in 2020. Whether you should is a policy decision. Each recording is another copy of PHI that needs access limits, a retention period and patient notice, and state recording-consent laws may apply. If you don't need recordings, turn recording off for clinician user groups. Confirm the approach with your compliance officer or attorney.
Do therapists need a special Zoom plan?
Not a special product, but a paid plan with Zoom's BAA in place. For a solo therapist, Zoom's support article describes buying Pro from its healthcare pricing page and accepting the BAA at checkout. Then lock the waiting room on, decide on recording, and check which AI features your account shows before turning on meeting summaries. Confirm the setup with your compliance officer or attorney.