Last verified: October 22, 2026, against Loom's HIPAA help article and Atlassian's BAA documentation. General information, not legal advice.
Is Loom HIPAA compliant? Not for patient information. Loom says it "currently is not able to sign Business Associate Agreements," and that holds on every plan, including Enterprise. That doesn't make Loom useless to a practice: it's a good way to explain a website change to your developer or record a front-desk how-to, as long as no patient information ever appears on screen. Around 50 US searches a month ask this question, and advertisers pay about $20.39 a click for it (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from Loom's own documentation
Short answer (verified October 2026): Loom's help article, "Is Loom HIPAA compliant?" (opens in a new tab), says: "Loom currently is not able to sign Business Associate Agreements" and "Please do not send any personal health information to Loom if doing so would violate any of your obligations under HIPAA." It adds: "While we are not yet HIPAA compliant, we do take security very seriously here at Loom."
Loom is now part of Atlassian, and the article lives on Atlassian's support site. Atlassian's Loom security FAQ (opens in a new tab) summarizes the same answer in one line: "Loom is not HIPAA compliant."
We also checked whether Atlassian's own BAA reaches Loom. Atlassian's HIPAA guide (opens in a new tab) says its BAAs cover "Jira, Jira Service Management, Jira Product Discovery, and Confluence." Loom isn't mentioned there, on the BAA signing page (opens in a new tab), or on Atlassian's HIPAA resources page (opens in a new tab).
What HIPAA requires before patient information goes in
A Loom video lives on Loom's servers. If it shows a patient's chart, Loom is storing protected health information (PHI) for your practice, and HIPAA allows that only with documented "satisfactory assurance" from the vendor (45 CFR 164.502(e) (opens in a new tab)) in a contract meeting 45 CFR 164.504(e) (opens in a new tab). That contract is a business associate agreement; our guide to business associate agreements explains the rest.
Loom won't sign one, so the rule for Loom is simple: no PHI in recordings. A BAA wouldn't settle everything anyway. Who receives the link, and where it's forwarded, would still be your responsibility.
The same thinking applies to your website. The free marketing audit flags privacy risks such as ad pixels on patient forms, using public information only.
Which Loom plans a BAA can cover
| Loom plan | Listed price (per user/month) | BAA available? |
|---|---|---|
| Starter | $0 | No |
| Business | $18 | No |
| Business + AI | $24 | No |
| Enterprise | Through sales | No: Loom says it can't sign BAAs |
Prices from loom.com/pricing, October 22, 2026, which mentions no HIPAA option on any plan.
Atlassian signs BAAs for other products on Standard, Premium and Enterprise plans and says "Free and trial plans are not eligible to sign BAAs." A practice with an Atlassian BAA for Confluence shouldn't assume Loom inherited it.
Screen recordings that capture patient screens
Loom records whatever is in frame, and a practice screen is crowded. These are the places PHI turns up when nobody meant to record it:
- The EHR itself. A schedule column, a patient banner, the "recent patients" list.
- Notifications. An email or message preview sliding in mid-recording.
- Browser tabs. Tab titles often include a patient's name or a lab result.
- The camera bubble. A whiteboard of the day's patients, or a chart on a second monitor.
- Audio. A hallway conversation or a phone call at the front desk.
Illustrative example: An office manager at Cedar Pediatrics records a two-minute Loom to show the EHR vendor a billing bug. The recording shows the claim screen with a child's name, date of birth and diagnosis code. The vendor's support team may well be covered by a BAA; Loom isn't, so the video is PHI sitting outside any BAA.
Safe uses and unsafe uses for a practice
Safe:
- Walking your web developer through changes on your public website
- Marketing clips, provider introductions and recorded office tours with no patients present
- Staff how-tos for tools with no patient data, such as the phone system or supply ordering
- EHR training recorded in a demo environment or with a clearly fictional test patient
Unsafe:
- Bug reports or training recorded on live patient records
- Recording a telehealth visit, or a staff huddle that discusses patients
- Sending a patient a Loom that walks through their own results or bill
- Any recording made with the full desktop shared and notifications on
Safer setup or alternatives
A short pre-recording routine keeps Loom useful:
- Record one window, not the whole screen.
- Close email, chat and the EHR unless the EHR is in training mode.
- Silence notifications on the computer and the phone next to it.
- Watch the recording before you share it, and delete it if a patient detail slipped in.
When a video truly needs real records, use your EHR vendor's support portal or a meeting tool whose vendor signs a BAA for your plan; see our Zoom verdict. And if your concern is tools that record visitors on your website, read our guide to session recording, a separate problem with its own rules. Every tool we've checked is in the HIPAA and marketing software hub.
Medfy doesn't sell Loom. On the website side, Medfy's HIPAA-compliant forms and chat store patient submissions in separate, encrypted HIPAA databases in the US or Canada, with role-based permissions and an audit log of who saw what, and Medfy signs a BAA with each practice for its own services. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will Loom sign a BAA?
No. Loom's help article, now hosted by its parent company Atlassian, says "Loom currently is not able to sign Business Associate Agreements" and asks customers not to send personal health information to Loom if that would violate their HIPAA obligations. Atlassian's own BAA covers Jira, Jira Service Management, Jira Product Discovery and Confluence on paid plans, and doesn't mention Loom. Verified October 2026.
Is the free version of Loom HIPAA compliant?
No. Loom doesn't sign a BAA on any plan: not the free Starter plan, and not Business, Business + AI or Enterprise. The free plan is fine for recordings with no patient information, such as a website walkthrough for your developer or a marketing clip. Anything that shows a chart, a schedule or a patient's name needs a different tool, or a recording made with test data.
Can a practice use Loom without patient information?
Yes, with discipline about what's on screen. Record in your EHR's training or demo environment, or with a test patient. Close email and messaging apps, turn off notifications, and record a single window instead of the full desktop. Watch each video before sharing it. Marketing, website feedback and staff how-tos about non-clinical tools are the safest uses.
What is a HIPAA-compliant alternative to Loom?
For training that must show real records, use your EHR vendor's own training environment or support channel, which falls under the BAA you already have. For recorded calls or meetings that involve patient details, use a video tool whose vendor signs a BAA for your plan. Zoom is a common comparison. Keep Loom for videos with nothing about patients in them.