Unknown (checked 2026-10-20) BAA availability is not stated: Cisco's public pages do not say on which plans a business associate agreement is available, and Business Texting is excluded from HIPAA support. Until Cisco confirms a BAA in writing for your plan and services, treat Webex as unapproved for PHI.
Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc., which is listed below as one vendor among others. Verdicts and ordering do not depend on payment or on Chanty's interest.
Short answer
Cisco publishes a HIPAA Security Rule self-assessment and a third-party attestation for the Webex Suite (Meetings, Calling, App, Control Hub) and for Contact Center. The public pages checked do not state whether Cisco signs a customer BAA, or on which plans. Business Texting is excluded, and Cisco's technical paper tells covered entities to consult their own legal counsel. For other tools checked the same way, see All vendors: is it HIPAA compliant?
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Webex offering (no plan named in Cisco's public pages) | Not published by the vendor | Not published by the vendor | Not published by the vendor |
Cisco's pricing page lists Webex Meet at $12/user/month ($144/user/year) but ties no BAA to any plan. Price alone tells you nothing about PHI eligibility.
What the BAA covers and what it excludes
Services in scope of Cisco's HIPAA whitepaper:
- Webex Meetings
- Webex Calling
- Webex App
- Webex Control Hub
- Webex for Developers (APIs)
- Webex Contact Center
This is the scope of Cisco's HIPAA document. It is not confirmed BAA terms. A service being described in the whitepaper does not mean a signed BAA covers it.
Excluded:
- Business Texting. Cisco's help article states: "Business Texting doesn't support HIPAA compliance for Healthcare Customers."
A clinic that uses Webex Calling for its front desk must therefore keep appointment reminders and patient texts that contain PHI out of Business Texting.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Encryption in this table means encryption in transit and at rest. None of these entries should be read as end-to-end encryption. Controls listed as "Yes" describe what Cisco states, not what this site has audited.
How to use Webex with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product. Terms such as BAA and PHI are defined in the HIPAA glossary: BAA, PHI. A working checklist:
- Get written BAA confirmation from Cisco for the exact plan and services you will use, before any PHI enters Webex.
- Keep PHI out of Business Texting.
- Have your legal counsel review the use, as Cisco's technical paper advises.
- Configure Control Hub settings and SSO deliberately rather than leaving defaults in place.
- Restrict access by role and offboard departed staff promptly. A departed locum should not still be able to join your telehealth rooms.
- Set staff policies and train staff on what may be said, shared or recorded in meetings.
- Record the decision, the BAA evidence and the date in your vendor inventory.
Alternatives with a BAA
Verdicts below are as recorded in each vendor entry. The list is not a ranking.
- Chanty (conditional): BAA available from the Business plan, not on Free. It is internal team chat for staff, not telehealth or patient messaging.
- Doxy.me (yes): BAA available from the Free plan.
- Google Chat (conditional)
- Is Google Meet HIPAA compliant? (conditional): paid Workspace editions.
- Google Workspace BAA by plan (conditional)
- Is Zoom HIPAA compliant?: a comparable meeting tool; see its check page for the verdict and sources.
Compare more options in HIPAA-compliant video conferencing tools and HIPAA-compliant team chat tools.
Sources
- Cisco Webex HIPAA Compliance: Webex Suite and Contact Center — Trust center, checked 2026-10-20. "The following are in scope for this Cisco Webex HIPAA document: 1. Webex Suite includes Webex Meetings (including what was formerly known as Webex Support and Webex Training and features and functionality included as of September 30, 2021), Webex Events (classic) (formerly known as Webex Events), Webex Calling, Webex App, Webex for Developers (APIs), and Webex Control Hub"
- Webex Suite Meetings Security technical paper — Help article, checked 2026-10-20. "A HIPAA-covered entity would need to consult with its own legal counsel to determine whether Webex's functionality"
- Enable Business Texting — Help article, checked 2026-10-20. "Business Texting doesn't support HIPAA compliance for Healthcare Customers."
- Webex Meetings | Powerful video conferencing experience — Pricing page, checked 2026-10-20. "Webex Meet $144 /user/year $12 /user/mo"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Webex HIPAA compliant?
Unknown. Cisco publishes a HIPAA Security Rule self-assessment and third-party attestation, but this site found no public statement that a BAA is available or on which plans. Compliance depends on a signed BAA, configuration and policies, not on the product alone.
Does Cisco sign a BAA for Webex, and on which plan?
The public pages checked do not state it. Ask Cisco for written confirmation naming the plan and the services covered, and file that confirmation before PHI is used.
Can I use Webex Business Texting with PHI?
No. Cisco's help article states: "Business Texting doesn't support HIPAA compliance for Healthcare Customers."
Which Webex services are in scope of Cisco's HIPAA document?
Webex Meetings, Webex Calling, Webex App, Webex Control Hub, Webex for Developers (APIs) and Webex Contact Center. This is the scope of the document, not confirmed BAA terms. The technical paper advises covered entities to consult their own legal counsel.