Best HIPAA-compliant video conferencing platforms in 2026: pricing, BAA checklist, and therapist picks

HIPAA compliant video conferencing qualifies on four criteria: a signed Business Associate Agreement, end-to-end encryption, user authentication controls, and session audit logs. No platform qualifies on a single criterion. This guide compares nine hipaa-compliant video conferencing tools by BAA status, pricing, and free-tier availability, addresses whether Zoom, Google Meet, and Teams qualify, and covers the tracking compliance gap most practices miss. For practices running paid acquisition, platform choice also affects whether your tracking can follow the patient from ad click to booked appointment, a gap that no video BAA covers on its own.

What makes a video platform HIPAA-compliant?

A video platform qualifies as HIPAA-compliant when all four requirements are met simultaneously: a signed BAA between your organization and the vendor, encryption covering data in transit (TLS 1.2 or higher) and at rest (AES-256), access controls that restrict session entry to authenticated participants, and an audit log recording who accessed a session and when.

The BAA is necessary but not sufficient. A signed agreement with unchanged vendor defaults still exposes protected health information. If the platform records sessions to a server outside the BAA scope by default, or if AI-generated transcripts are active, data flowing through those features is not covered, regardless of what the BAA says.

Think of the four criteria as a system. Remove any one, and the others stop protecting you.

What the four criteria do not cover is the acquisition path that brought the patient to your booking page. Tracking from ad click to confirmed appointment runs through your ad stack, not your video platform, and no video BAA extends that far.

Most video conferencing software is HIPAA compliant only after manual configuration changes and a signed BAA are both in place. The subscription alone does not create compliance. Configuration without the BAA, or a BAA without the required settings changes, leaves PHI exposed.

The BAA checklist: 6 items to verify before you sign

No top-10 competitor for this keyword provides this checklist. Completing it before signing takes about 15 minutes and eliminates the most common post-audit finding: a BAA that technically exists but does not cover the features in active use.

1. Named parties. The covered entity (your organization) and the business associate (the vendor) are identified by legal name. References to "customer" or "subscriber" are not sufficient.
2. PHI scope. Session metadata and recordings are explicitly included, not only file attachments. Many BAA templates default to a narrow PHI definition that excludes session logs.
3. Breach notification timeline. The vendor commits to notifying you within 60 days of a discovered breach, the minimum required under the HIPAA Breach Notification Rule. Some agreements allow 90 days or longer.
4. Encryption standards. AES-256 at rest and TLS 1.2 or higher in transit are named explicitly. Vague language like "industry-standard encryption" does not confirm the specific standards required.
5. Auto-logout configuration. Session timeout is configurable by your organization, not locked to vendor defaults. A vendor default of 60 minutes on shared clinical devices is a Security Rule gap.
6. Tier coverage. The BAA applies to the product tier you are purchasing. Some agreements cover only an enterprise tier one level above what is being contracted.

Does Zoom, Google Meet, or Microsoft Teams count as HIPAA-compliant?

All three can qualify for HIPAA compliant video conferencing, but only on specific paid tiers and only after manual configuration changes. Free accounts on all three platforms do not qualify under any circumstances.

Zoom for Healthcare requires a Business or higher plan with a signed BAA from Zoom's healthcare compliance team. Three default features must then be disabled: AI-generated meeting transcripts, meeting summaries, and any third-party recording integrations that route session data outside the BAA boundary.

For a full breakdown of Zoom's account-type requirements, see Is Zoom HIPAA compliant in 2026?.

Google Workspace for Healthcare and Life Sciences requires an enterprise agreement with a signed BAA. A standard Google Workspace account, even a paid one, does not include the healthcare BAA by default. Sessions on a standard workspace plan expose PHI to Google's infrastructure outside any BAA boundary.

Microsoft Teams qualifies under Business and Enterprise Microsoft 365 plans that include the healthcare BAA. Teams AI features, Copilot transcripts, and Loop components must each be evaluated against the BAA scope before use. Enabling Copilot on an account with an active healthcare BAA does not automatically mean Copilot session data is covered.

The shared failure point across all three is assuming that a paid subscription alone creates compliance. The BAA must be requested, signed, and stored, and the features it covers must match what the organization actually uses.

HIPAA video compliance and your digital marketing stack

Choosing a compliant video platform covers the call. It does not cover the rest of the patient acquisition path. This is the angle absent from every current top-10 result for this keyword, and it directly affects practices running paid acquisition.

Meta Pixel and Google Ads conversion tags capture URL-level data by default. On telehealth sites, URLs frequently encode session type, condition category, or appointment type in query parameters. A URL like /schedule?condition=weight-loss&type=consultation transmits PHI to ad platforms not covered by any video BAA.

The video session is compliant. The ad attribution event that fired when the patient clicked "Book appointment" is not.

Two compliant approaches exist for practices running paid acquisition. Google's Consent Mode v2 prevents tag firing on users who decline consent, but it does not eliminate URL-parameter PHI exposure unless the tracking implementation strips query parameters before tag firing.

Meta's Conversions API with server-side filtering allows event transmission without browser-side pixel code, giving the practice control over what data leaves the server before it reaches Meta's infrastructure.

Retargeting on medical conditions is prohibited on both Google and Meta regardless of consent mode. Running condition-specific retargeting segments under a video BAA means addressing one compliance layer while creating exposure in another. Video compliance and ad tracking are handled by different vendors with no shared view of overall risk.

If you need to audit whether your website architecture is creating PHI exposure before scaling paid acquisition, the telehealth website development foundation and site features that intersect with HIPAA compliance requirements cover the technical and design layers to evaluate first. For the analytics side of this problem, Is Google Analytics HIPAA compliant? covers the GA4-specific tracking exposure most practices miss.

Platform comparison at a glance

Prices shown are approximate list rates as of 2026. Verify current tiers directly with each vendor before contracting, since healthcare-tier pricing changes frequently.

10 best HIPAA-compliant video conferencing platforms

The table above is a quick reference. Not all video conferencing hipaa compliant solutions suit every practice type, use case determines the right fit. This section adds platform-specific guidance by practice type. If you know your use case, read only the relevant subsection.

Best for solo therapists and mental health providers

The best hipaa compliant video conferencing platforms for solo providers share three criteria: a BAA available on a free or low-cost tier, no patient app download required, and consent capture built into the waiting room join flow.

Doxy.me is the strongest free option. Patients join from a browser link with no account creation. The BAA is available in writing and explicitly covers the free plan.

SimplePractice Telehealth is the right choice when documentation is the bottleneck. Video is built into the same workflow as notes, scheduling, and billing, removing the copy-paste risk between session and chart. The BAA covers the full platform, so scheduling and intake form integrations stay within the compliance boundary.

TheraNest suits practices that want session workflow management without migrating their entire EHR. For solo providers who need clinical documentation alongside video and prefer not to run a separate EHR, VSee and SecureVideo are worth evaluating. Both offer stronger access controls at a cost of more initial configuration.

Best free HIPAA-compliant video conferencing options

Doxy.me's basic tier is the only platform in this guide with verified no-cost access that includes a BAA. That is the complete list. Every other hipaa compliant video conferencing platform in this guide requires a paid subscription before a BAA is available.

One critical verification step applies before the first patient call. Confirm that the BAA explicitly covers the free tier, not only paid plans. Some vendors provide a BAA document that applies only to a professional or enterprise subscription. Request written confirmation that your specific plan is covered.

A generic BAA document referencing an enterprise account does not protect a practice running on the free tier.

Best for mid-size telehealth companies

Mid-size practices with multiple providers and an existing EHR need different criteria than solo providers. The selection criteria shift to multi-party group visits, patient intake automation, enterprise access controls, and per-user BAA coverage that stays cost-effective as headcount grows.

Mend handles intake automation, appointment reminders, and video within the same compliance boundary. That single-BAA scope reduces the number of separate vendor agreements needed. Webex for Healthcare and RingCentral for Healthcare are built for hipaa compliant video healthcare conferencing at enterprise scale, with access controls and EHR integration that support concurrent provider sessions without per-user costs becoming unmanageable.

Zoom for Healthcare is viable for organizations that already use Zoom broadly and can enforce configuration policy across all provider accounts. The requirement is a centralized admin policy that disables AI features and enforces BAA-covered settings automatically. Relying on individual providers to configure their own sessions correctly is a compliance risk at any size.

How to implement: 5 steps beyond signing the BAA

Selecting hipaa compliant video conferencing technology is the prerequisite. Curogram's implementation guide covers three steps. These five steps target the post-BAA configuration gaps that cause real audit failures.

1. Request the BAA in writing before the first patient visit. Most platforms generate it in-app under account or compliance settings. Some require a direct email to a healthcare compliance team. Do not assume the BAA was issued at account creation.
2. Disable AI-generated transcripts, meeting summaries, and third-party recording integrations. These features are active by default in Zoom, Teams, and Google Meet. Disabling them at the admin level, not just for individual sessions, keeps session data inside the BAA boundary.
3. Set session auto-logout to 15 minutes on inactive sessions. On shared clinical devices, require re-authentication for sessions running longer than 30 minutes. This setting is frequently left at vendor defaults, which are often 60 minutes or longer.
4. Configure a HIPAA-specific waiting room. A standard waiting room prevents early joiners from entering an active session. A HIPAA-configured waiting room also prevents PHI from appearing in the lobby interface before the provider admits the patient. These are distinct settings, and most platforms require both to be configured separately. Check your platform's security documentation for both configurations.
5. Run a dry call with a staff member before going live. Verify that BAA-covered settings are active, recording is off, and session metadata is not stored in a location outside the BAA scope. Fifteen minutes of testing eliminates the most common post-launch compliance gap.

What should therapists look for in a HIPAA video platform?

For mental health providers, three criteria are non-negotiable: no patient app download required, a branded or neutral waiting room, and in-flow consent capture as part of the join process rather than a separate pre-visit email step. These are the baseline for any hipaa compliant video conferencing software used in a therapy context.

The mental health-specific data risk is less visible than the video call itself. Session notes and companion features syncing to third-party apps outside the BAA scope are a recurring compliance failure point. A notes app connected via API is covered by the video BAA only if it is explicitly named in that BAA.

Most third-party note and homework apps are not named in video BAAs. Therapists using such integrations should verify BAA scope for each connected application before using it with patient data.

Platform verdicts for therapists: SimplePractice for practices that need documentation integrated with scheduling and billing; Doxy.me for zero-friction patient access with no app install; TheraNest for session workflow management without a full EHR migration. All three provide a signed BAA and meet the core criteria for hipaa compliant video conferencing for therapists.

When evaluating platforms for therapy use, verify whether the vendor's API integrations route any data outside the BAA scope. The hipaa compliant video conferencing api surface is a consistent oversight in practices using calendar sync, patient reminders, or third-party homework tools alongside their video platform.

Ready to audit your telehealth compliance stack?

Most practices that have a compliant video platform still carry PHI exposure in their ad tracking stack. Video compliance and measurement architecture are handled by separate vendors with no shared view of the overall exposure. That gap is where practices get caught in audits, and no video BAA covers it.

The Webugol 90-day direct-to-patient growth program is built as a compliance-first acquisition system. Video platform selection, tracking setup, and paid acquisition are designed together rather than patched after launch. Month 1 is a tracking and compliance audit covering the full acquisition path from ad click to booked appointment, not just the video call.

Valhalla Vitality, a telehealth client, built their acquisition system on this compliance-first foundation and reached +287% monthly revenue with a 45% reduction in CAC.

If your practice has the video compliance layer in place and needs the rest of the system to match, start your compliance-first acquisition review and see what a fully integrated stack looks like.

FAQ

"What video conferencing is HIPAA compliant?"

Platforms verified as HIPAA compliant for video include Zoom for Healthcare (paid plans with BAA), Microsoft Teams (Business and Enterprise Microsoft 365 plans with the healthcare BAA), Google Meet under a Google Workspace for Healthcare enterprise agreement, and purpose-built solutions such as Doxy.me, VSee, SimplePractice Telehealth, and SecureVideo. Consumer accounts on any of these platforms do not meet the BAA requirement regardless of other security settings in use.

Is Zoom HIPAA-compliant for telehealth?

Zoom is HIPAA-compliant only on paid Business or Healthcare plans that include a signed Business Associate Agreement. Free Zoom accounts do not qualify, and using them for patient video visits is a HIPAA violation regardless of any other security settings enabled on the account.

What is the cheapest HIPAA-compliant video conferencing option?

Doxy.me offers a free tier that includes a BAA, making it the lowest-cost verified option for individual providers. Practices that need EHR integration or multi-party group visits can expect to pay $35 to $99 per month depending on platform and feature requirements.

Can I use Google Meet for patient appointments?

Google Meet qualifies for patient visits only under a Google Workspace for Healthcare and Life Sciences enterprise agreement with a signed BAA. Standard Google Workspace accounts and consumer Gmail accounts do not meet this requirement.

What happens if I use a non-compliant video platform for patient visits?

Using a non-compliant video platform for telehealth is a HIPAA Privacy and Security Rule violation. OCR fines range from $100 to $50,000 per violation based on culpability, and a breach notification to affected patients and to HHS is required within 60 days if PHI was exposed.