Conditional A BAA is available on GoTo Meeting for Healthcare, and recording and chat are not available on that plan (verified 2026-10-20). A BAA covers only the services it names, so what you do inside a meeting matters as much as which plan you buy.
Short answer
GoTo makes a Business Associate Agreement available to U.S. healthcare customers. It is incorporated into GoTo's standard Terms of Service through the Data Processing Addendum (DPA).
The BAA applies to a dedicated plan, GoTo Meeting for Healthcare, which is limited to North America. Recording and chat are not available on that plan. See Is it HIPAA compliant? All vendors for how other tools compare on the same criteria.
Which plans include a BAA
The sources reviewed name one plan with BAA coverage. They do not describe a BAA for standard GoToMeeting plans.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| GoTo Meeting for Healthcare | Available | Effective when the customer enters an Agreement or signs an Order that incorporates it, or uses the Services after publication | Not published by the vendor |
Minimum seats and any surcharge for the Healthcare plan are also not published by the vendor, and the plan is not priced publicly. The standard Professional plan starts at $12 per organizer per month, billed annually. The sources do not tie that price to the BAA, so do not treat it as the cost of a HIPAA-eligible setup.
For the term itself, see the HIPAA glossary entry on business associate agreements.
What the BAA covers and what it excludes
Covered:
- GoTo Meeting for Healthcare
Excluded:
- Recording the meeting
- In-session chat with others
- Chat with Business Messaging
The exclusions carry the same weight as the coverage. Take a clinic running a follow-up video visit. The visit itself falls within the covered service. Recording it for the chart, or typing a medication list or lab result into the in-session chat, falls outside the BAA. The same applies to a front-desk team using Business Messaging chat to discuss a patient.
The practical rule is to keep PHI in the covered meeting service. Do not move it into features the plan does not offer or any service outside the covered scope.
Security controls the vendor publishes
The table lists only what the sources state.
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | North America only (GoTo Meeting for Healthcare) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the sources reviewed did not state it. It does not mean the control is absent. If your risk assessment needs these, ask GoTo for them in writing.
How to use GoToMeeting with PHI
A BAA is one input to a compliant setup, not the whole of it. Split the work like this:
- Sign or confirm the BAA before any PHI is discussed. Check that your Agreement or Order incorporates it.
- Use the GoTo Meeting for Healthcare plan. Do not run PHI-bearing visits on a standard plan.
- Keep recording and chat out of the PHI workflow. Turn off or avoid recording, in-session chat and Business Messaging chat for patient-related discussion.
- Confirm North America data residency fits your policy. This matters if your contracts or payers restrict where data is processed.
- Configure SSO, user access and offboarding. Remove departed staff and contractors the same day.
- Train staff and set written policies. Spell out what may be said on a call, and what may not be typed or recorded.
- Document the decision in your vendor inventory. Record the plan, the BAA date and the exclusions.
Compliance depends on the signed BAA, your configuration and your organization's own policies.
Alternatives with a BAA
Each verdict below is a summary; the linked pages carry the sources and dates. All verdicts are stated by plan, not as a property of the product.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Doxy.me | Yes | Free |
| Google Meet | Conditional | Google Workspace (paid editions) |
| Google Workspace | Conditional | Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits) |
| Microsoft Teams | Conditional | Microsoft Teams Essentials |
| Zoom | Conditional | Pro |
Pages for Doxy.me and Microsoft Teams are not yet linked here. For other tool types, see HIPAA-compliant software by category.
Sources
- Business Associate Addendum | GoTo — BAA page, checked 2026-10-20. "This BAA is effective when Customer (a) enters into an Agreement or signs an Order that has incorporated this BAA"
- Legal — Terms, checked 2026-10-20. "Available to our U.S. healthcare industry customers, our BAA is designed to support customer HIPAA compliance obligations"
- Plan Overview: GoTo Meeting for Healthcare — Help article, checked 2026-10-20. "GoTo Meeting for Healthcare, in conjunction with a Business Associate Agreement (BAA), is HIPAA compatible and tailored for our customers in the healthcare industry, including but not limited to, hospitals, assisted living, general medicine, and more."
- GoTo Meeting Plans & Pricing | Online Meetings Solution | GoTo — Pricing page, checked 2026-10-20. "Professional $14 $12 /organizer /month, billed annually Included: 150 Participants"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does GoTo sign a BAA for GoToMeeting?
GoTo makes a BAA available to U.S. healthcare customers. It is incorporated into the standard Terms of Service through the DPA. It becomes effective when the customer enters an Agreement or signs an Order that incorporates it, or uses the Services after publication.
Which GoToMeeting plan is covered by the BAA?
GoTo Meeting for Healthcare, a dedicated plan limited to North America. The sources reviewed list no other GoToMeeting plan as covered. Price and minimum seats are not published by the vendor.
Can I record meetings or use in-session chat on the healthcare plan?
No. The plan's exclusions are recording the meeting, in-session chat with others, and chat with Business Messaging. Do not use these for PHI.
Does the BAA mean GoToMeeting is HIPAA certified?
No. This page does not describe GoToMeeting as certified or as compliant in itself. What the sources support is that a BAA is available on GoTo Meeting for Healthcare for the services listed above. Signing a BAA alone does not make an organization compliant, because configuration and policies remain the customer's responsibility.