Yes A BAA is available on the Free, Professional, Premium and Clinic plans for Doxy.me telehealth video. The main limit is that the Free and Professional BAA is for individual providers only. Last verified 2026-10-20.
Short answer
Doxy.me offers a BAA on every plan, including Free, at no extra cost. The covered service is Doxy.me telehealth video. A practice with more than one provider needs a Clinic BAA, which Clinic account admins generate. Signing the Business Associate Agreement is necessary but not sufficient. Account configuration, device security and written policies remain the practice's job.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Available; individual provider only | Self-serve: Profile > Settings > BAA tab, enter information, Generate BAA, download | None |
| Professional | Available; individual provider only | Same self-serve path | None |
| Premium | Available; scope details Not published by the vendor | Same self-serve path | None |
| Clinic | Available; multi-provider practices | Generated by Clinic account admins | None |
Pricing context from the pricing page: Free is $0, and Premium is €25 per user/month billed annually. Professional and Clinic prices are Not published by the vendor in the sources used here. The BAA itself carries no separate charge.
The Free and Professional BAA names one provider. A group practice where several clinicians each run their own Free account cannot rely on those individual BAAs for the practice. The Clinic BAA is the one that fits a multi-provider setup.
What the BAA covers and what it excludes
Covered:
- Doxy.me telehealth video
Excluded:
- No excluded features are published by the vendor.
The individual-provider scope is a limit on who is covered, not a feature exclusion. Anything outside Doxy.me telehealth video is not stated as covered. If your workflow adds tools around the video visit, such as scheduling, intake forms, or chat among staff, check each one for its own BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence from the checked pages is not evidence that a control does not exist. Ask the vendor in writing and keep the answer in your vendor file.
How to use Doxy.me with PHI
- Generate and sign the correct BAA before any session that involves PHI. Download and file the signed copy.
- Use a Clinic BAA if more than one provider sees patients through Doxy.me.
- Limit PHI use to the covered service, Doxy.me telehealth video.
- Manage user accounts: remove access when a clinician or staff member leaves.
- Secure the devices and networks that run video visits, such as exam-room tablets and home-office laptops.
- Put written policies in place and train staff, for example on where a visit may take place and what may be shared on screen.
- Request unpublished control details, such as encryption, audit logging and SOC 2 reports, in writing.
Compliance depends on the signed BAA, your configuration and your policies, not on the vendor alone.
Alternatives with a BAA
Each of these is conditional on plan and service:
- Google Meet: conditional, Google Workspace paid editions.
- Google Workspace: conditional. See the Google Workspace BAA check for scope.
- GoTo Meeting: conditional, GoTo Meeting for Healthcare.
- Microsoft Teams: conditional, Teams Essentials.
- Zoom: conditional, Pro plan. See Is Zoom HIPAA compliant?.
Compare more options in HIPAA-compliant video conferencing tools and HIPAA-compliant telehealth software.
Sources
- BAA: how do I get a BAA with doxy.me? — Help article, checked 2026-10-20. "All doxy.me users get a free Business Associate Agreement (BAA)."
- BAA: how do I get a BAA with doxy.me? — Help article, checked 2026-10-20. "The BAA found on our Free and Professional accounts is meant for individual providers only."
- Doxy.me is HIPAA-compliant and Optum-approved for telehealth visits — Help article, checked 2026-10-20. "Doxy.me is one of the few HIPAA-compliant telehealth platforms in the world that offers a free BAA to all users."
- Doxy.me Pricing | Telehealth Plans for Providers and Clinics — Pricing page, checked 2026-10-20. "Premium Plan Built for care, not just calls €25 per user / month, billed annually"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.