Is Zoom HIPAA compliant? BAA by plan, covered services and exclusions

Short answer: conditional, with a BAA on paid plans

The accurate wording is: BAA available on paid plans for Zoom Workplace. Zoom is not "HIPAA certified," and it is not HIPAA compliant on every plan.

Zoom's help article, HIPAA Business Associate Agreement (BAA), lists the eligible plans as "Pro, Business, Business Plus, and Enterprise plans" (checked 2026-10-19). Zoom's healthcare pricing page says: "To enable HIPAA compliance, select a paid plan and establish a BAA agreement." (checked 2026-10-19).

Two limits apply:

• A signed BAA does not make a practice compliant on its own. Risk analysis, access management, staff policies and training stay with the customer.
• Not every Zoom feature is available once a BAA is in place. The AI section below covers this.

For other tools checked the same way, see Is it HIPAA compliant? All vendors.

Which Zoom plans can sign a BAA

Plan	BAA	How it is obtained
Basic (free)	No, excluded	Not available
Pro	Yes	Online checkout on the healthcare Plans & Pricing page
Business	Yes	Contact Sales
Business Plus	Yes	Contact Sales
Enterprise	Yes	Contact Sales
Other paid plans listed on the Plans & Pricing page	Yes	Per Zoom's Plans & Pricing page

Source: Zoom, HIPAA Business Associate Agreement (BAA), checked 2026-10-19.

The long-tail questions, answered directly:

• Is free Zoom HIPAA compliant? No. Basic (free) is excluded from the BAA, so PHI should not go through it.
• Is Zoom Pro HIPAA compliant? A BAA is available on Pro through online checkout. Pro with a signed BAA, used for covered services, is the minimum setup. It is not compliance by itself.
• Which Zoom is HIPAA compliant? No plan is compliant as a product property. Paid plans can have a BAA. Of the named plans, Pro is the only one with a self-serve route.
• Is Zoom Workplace HIPAA compliant? Zoom Workplace is the product the BAA covers, on paid plans, with the AI limits described below.

Canadian billing addresses may see a PHIA (Personal Health Information Act agreement) instead of the US BAA, according to Zoom's help article. Practices outside the US should confirm which agreement applies to them.

What a Zoom HIPAA setup costs

Per Zoom's healthcare pricing page, Pro starts at $14.16 billed annually, per user per month (checked 2026-10-19). Prices change, so confirm on the page before budgeting.

• Extra cost for the BAA itself: Not published by the vendor on the pages checked.
• Minimum seat count: Not published by the vendor on the pages checked.
• Business, Business Plus and Enterprise: these are obtained through Sales.

A plan price is not a compliance cost estimate. Configuration, training, policy writing, device security and the time to review the BAA are the customer's costs on top of the license. A five-clinician practice on Pro pays a license fee, and then still has to decide who may record sessions and who offboards departing staff.

How to enable the BAA

Steps below come from Zoom's help article (checked 2026-10-19). Read the business associate agreement (BAA) in the glossary first if the term is new to your team.

Pro (self-serve)

1. On the healthcare Plans & Pricing page, click Buy Now.
2. In the country dropdown, select United States Agreement (BAA).
3. Click Read Agreement.
4. Click I accept.

Business, Business Plus, Enterprise

• Contact Zoom Sales.

Existing healthcare plan

1. In the web portal, go to Plans and Billing.
2. Open Plan Management.
3. Select view more products.
4. On the Business Associate Agreement (US only) tile, click Enable.
5. Click Proceed.

Sign before any PHI goes through Zoom. Keep a copy of the accepted agreement, with the date and the account it applies to, in the vendor inventory. A practice that started using a free account months ago has a gap to document and close, not just a form to sign.

What the BAA covers and what it excludes

Covered, per Zoom:

• Zoom Workplace: Meetings, Phone, Chat, Docs and Whiteboard, as named on Zoom for Healthcare (checked 2026-10-19).
• AI Companion / ZoomMate AI features for customers with a BAA in place. The help article says: "AI features, including ZoomMate features, are available to customers with BAAs in place." (checked 2026-10-19).

Excluded or limited:

• The free Basic plan.
• Some AI features. The help article says: "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place." (checked 2026-10-19). Zoom does not publish a list of which AI features are unavailable. The free Basic plan is not covered either, but that comes from the pricing page, which says to select a paid plan and establish a BAA agreement, not from this help article.

Do not assume every AI summary or assistant feature you see in a Zoom account is usable with PHI. Check the list before turning one on for clinical conversations.

Zoom Phone: Zoom's healthcare page lists Phone as part of Zoom Workplace. Zoom's HIPAA Compliance Guide (August 2024) also lists Phone as part of Zoom Workplace, but Zoom's public BAA documentation does not say which services or add-ons the BAA covers, so confirm in writing with Zoom that Phone, call recording, voicemail and transcription are covered before they handle PHI.

Third-party apps and Marketplace integrations: Zoom's public HIPAA documentation does not say that Marketplace apps are covered by Zoom's BAA. Do not assume they are. A scheduling or transcription app connected to Zoom may need its own BAA with its own vendor.

Security controls Zoom publishes

Control	Status on pages checked (2026-10-19)
Encryption in transit	Not published by the vendor
Encryption at rest	Not published by the vendor
Audit log	Not published by the vendor
Access controls	Not published by the vendor
SSO	Not published by the vendor
Data residency	Not published by the vendor
SOC 2	Yes. Zoom's FAQ points to a SOC 2 Type 2 bridge letter
ISO 27001	Not published by the vendor
HITRUST certification	Not published by the vendor (see below)

"Not published by the vendor" means we did not find the control on the pages we checked. It does not mean Zoom lacks it. Ask Zoom Sales or your account contact if a control matters to your risk analysis.

SOC 2 Type 2: the Zoom Security and Compliance FAQ says: "The SOC 2 Type 2 bridge letter can be accessed on Zoom's Trust Center via the SOC 2 Type 2 page." (checked 2026-10-19). The SOC 2 Type 2 report covers October 2024 to October 2025. It covers the security, availability, confidentiality and privacy criteria for the Zoom Unified Communications platform, including Meetings, Chat, Phone, Mail and Calendar, Scheduler, Whiteboard, Zoom AI Companion, AI Notetaker, Healthcare Clinical Notes and Zoom APIs & SDKs. The Zoom Marketplace is not listed. The bridge letter covers the period after the report ends.

HITRUST: the same FAQ says: "Zoom aligns its controls to the Healthcare Industry Trust Alliance Common Security Framework (HITRUST CSF)." This is alignment, not a HITRUST certification, and we do not present it as one.

The FAQ also states: "Yes, Zoom has a standard BAA that can be entered into when required by our customers." (checked 2026-10-19).

Zoom for telehealth and therapy: how to use it with PHI

Is Zoom HIPAA compliant for telehealth or therapy? Conditional. It works when all of these hold: a paid plan, a signed BAA, and use limited to covered services. A therapist on the free Basic plan has no BAA, whatever else they configure.

The customer's responsibilities, per our directory's shared-responsibility approach:

• Configure meeting settings and access for your clinic.
• Decide whether sessions are recorded, and whether AI summaries are used with PHI.
• Manage users and offboard staff who leave.
• Secure the devices clinicians and front-desk staff use.
• Train staff on what may and may not be shared in chat, files and meetings.

Practical checklist:

1. Confirm every account that carries patient sessions is on a paid plan.
2. Sign the BAA and file a copy.
3. Review which AI features are available under the BAA, and switch off the rest for clinical use.
4. Check any connected third-party apps for their own BAA.
5. Record the decision, the date and the reviewer in the vendor inventory.

For risk-analysis and policy basics, see HIPAA guides. This page is a reference, not legal advice.

Alternatives and when to check others

Starting plans for a BAA, as listed in our directory (verdicts as of the same check cycle):

Vendor	Verdict	BAA from
Google Workspace	Conditional	Paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits)
Microsoft Teams	Conditional	Microsoft Teams Essentials
Slack	Conditional	Enterprise (Enterprise Grid / Enterprise+)
GoTo Meeting	Conditional	GoTo Meeting for Healthcare
Doxy.me	Yes	Free
Zoom (this page)	Conditional	Pro and above

Order follows the facts in each entry, not payment. Read the Google Workspace HIPAA status for the full conditions, and Is Google Meet HIPAA compliant? if video is the only thing you need from it.

To compare more options, see the video-conferencing and team-chat tables in HIPAA-compliant software by category.

Sources, last verified and next check

FAQ

Is Zoom HIPAA compliant?

Conditional. Zoom offers a BAA on paid Zoom Workplace plans. Compliance depends on the plan, the signed BAA, the services used and your own configuration, and no plan is "HIPAA certified."

Is free Zoom HIPAA compliant?

No. The free Basic plan is excluded from the BAA, so it should not be used with PHI.

Is Zoom Pro HIPAA compliant?

A BAA is available on Pro through online checkout. Pro with a signed BAA, used only for covered services, is the entry point. The BAA alone does not make your practice compliant.

Which Zoom plan is HIPAA compliant?

Zoom lists Pro, Business, Business Plus, Enterprise and other paid plans on its Plans & Pricing page as eligible for a BAA. Basic (free) is not.

How much does HIPAA compliant Zoom cost?

Pro starts at $14.16 per user per month, billed annually, on Zoom's healthcare pricing page (checked 2026-10-19). Any extra cost for the BAA and any minimum seat count are not published by the vendor on the pages checked. Business, Business Plus and Enterprise are via Sales.

How do I make Zoom HIPAA compliant?

Move to a paid plan, accept the BAA (Pro: Buy Now, select United States Agreement (BAA), Read Agreement, I accept; other plans: Sales; existing healthcare plan: Plans and Billing > Plan Management > Enable on the BAA tile). Then configure access, decide on recording and AI, train staff and document it. See the steps above.

Is Zoom Workplace HIPAA compliant?

Zoom Workplace (Meetings, Phone, Chat, Docs, Whiteboard) is the set of services the BAA covers on paid plans, per Zoom's healthcare page. Certain AI features may not be available under a BAA.

Is Zoom Phone HIPAA compliant?

Zoom lists Phone as part of Zoom Workplace on its healthcare page. Zoom's HIPAA Compliance Guide (August 2024) also lists Phone as part of Zoom Workplace, but Zoom's public BAA documentation does not say which services or add-ons the BAA covers, so confirm in writing with Zoom that Phone, call recording, voicemail and transcription are covered before they handle PHI.

Is Zoom HIPAA compliant for telehealth and therapy?

Conditional: a paid plan, a signed BAA and covered services only. Free-plan accounts used for therapy sessions have no BAA.

Are Zoom AI Companion features covered by the BAA?

Zoom says AI features, including ZoomMate features, are available to customers with BAAs in place. It also says certain AI features may not be available for healthcare customers with a BAA at this time. Zoom does not publish which features.