Unknown Last verified 2026-10-20. Apple publishes no business associate agreement (BAA) for FaceTime, so no plan includes a BAA and no service is listed as covered. The main exclusion is that no BAA terms exist for any use of FaceTime with PHI, whether for telehealth, telemedicine or routine patient calls.
Short answer
Apple's FaceTime privacy page describes end-to-end encryption but makes no statement about HIPAA or a BAA. On this directory, the status is "no BAA published."
Encryption is one security control. A BAA is the contract that sets out how a vendor may handle PHI. Without a signed BAA, the verdict cannot be "yes" here. It is "unknown" rather than "no" because Apple has not published terms either way.
For vendors that do publish BAA terms, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
FaceTime is a feature of Apple devices. The vendor publishes no plans for it.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| No plan with a BAA is published | No BAA published | Not published by the vendor | Not published by the vendor |
What the BAA covers and what it excludes
Covered services
- None published.
Excluded features
- None published, because there are no BAA terms to take exclusions from.
A missing exclusion list does not mean nothing is excluded. With no terms, there is no defined scope at all. A clinic cannot assume that a video call, a shared screen or a call link falls inside an agreement that does not exist.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Missing audit and access controls matter in practice. A privacy officer who is asked who joined a patient call, or who has to disable a departed clinician's access, has no vendor documentation to point to.
How to use FaceTime with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. This checklist is neutral and is not legal advice.
- Confirm whether Apple will sign a BAA before any PHI is used on FaceTime. Keep the written answer.
- Do not treat encryption as a substitute for a business associate agreement.
- Record the risk decision in your vendor inventory: what the tool is used for, who approved it and when it will be reviewed. The HIPAA guides cover how to keep that inventory.
- Set an internal policy on whether patient calls may use consumer video apps. Say what front-desk staff should do when a patient asks for a FaceTime visit.
- Manage device security and access: passcodes, device lock, loss reporting, and removing a former employee's access on shared or personal devices.
- Train staff on what may and may not be discussed or shown on a call, and where visit notes must be recorded.
Alternatives with a BAA
These video tools offer a BAA under the plans noted. Each verdict is conditional on the plan and settings, so read the linked vendor check. For other categories, see HIPAA-compliant software by category. The list is in no particular order.
- Doxy.me: yes; BAA from the Free plan.
- Google Meet: conditional; Google Workspace paid editions. See Is Google Meet HIPAA compliant?
- Google Workspace: conditional; paid editions administered in the Admin console. See Is Google Workspace HIPAA compliant?
- GoTo Meeting: conditional; GoTo Meeting for Healthcare.
- Microsoft Teams: conditional; Teams Essentials.
Sources
- FaceTime & Privacy — Terms, checked 2026-10-20. "FaceTime is end-to-end encrypted. We never store the content of FaceTime calls. Apple doesn’t log whether your call was answered, and can’t access the content of your calls."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is FaceTime HIPAA compliant for telehealth or telemedicine?
The verdict is unknown. Apple publishes no BAA for FaceTime and no statement about HIPAA, so there is no published basis for using it with PHI in telehealth or telemedicine. Whether Apple would sign a BAA is not stated on the page checked.
Does end-to-end encryption make FaceTime HIPAA compliant?
No. Apple's page describes end-to-end encryption but makes no statement about HIPAA or a BAA. Encryption is one control. It does not replace a signed BAA, and it does not cover configuration, access management or staff policies.
Does Apple store the content of FaceTime calls?
Apple's page says it never stores the content of FaceTime calls and can't access that content. It also says Apple doesn't log whether a call was answered. These are privacy statements, not a BAA or a HIPAA statement.
What can I use instead of FaceTime for patient video visits?
Use a tool that offers a BAA on the plan you buy. Options are Doxy.me (BAA from the Free plan), Google Meet and Google Workspace (paid editions), GoTo Meeting (GoTo Meeting for Healthcare) and Microsoft Teams (Teams Essentials). Sign the BAA before any patient visit takes place on the tool.