HIPAA-compliant video conferencing: vendors with a BAA compared

Doxy.me is the only video tool in this comparison whose BAA is available on the Free plan. Microsoft Teams, Google Meet, Google Workspace, GoTo Meeting and Zoom each offer a BAA only on specific plans or services, so their verdict is conditional. FaceTime and Webex are unknown because no vendor BAA document supports a verdict.

Short answer: which video tools will sign a BAA

Each verdict describes BAA availability by plan and covered services. It is not a claim that a product is "HIPAA compliant" or "certified." For what the phrase means for a tool, read what 'HIPAA compliant' means for a tool.

Verdict	Vendors
Yes	Doxy.me (BAA from the Free plan, self-serve)
Conditional	Microsoft Teams, Google Meet, Google Workspace, GoTo Meeting, Zoom
No	None in this table
Unknown	FaceTime, Webex

"Conditional" means a BAA exists, but only on certain plans or services, and an administrator step or a purchase route stands between you and PHI use. "Unknown" means no dated vendor document supports a verdict, so none is given.

Changes to any verdict are logged under recent changes in vendor HIPAA status. This directory is published by Chanty, Inc., which also makes a team chat product. Table order never depends on payment or on Chanty's interest. Browse other tool types under HIPAA-compliant software by category.

Comparison table: BAA by plan, how to get it, pricing from

Every vendor entry sits in the Is it HIPAA compliant? All vendors directory. Where a vendor does not publish a value, the cell says so. Nothing is inferred.

Vendor	Verdict	BAA from plan	How the BAA is obtained	Pricing from
Doxy.me	Yes	Free	Self-serve: Profile > Settings > BAA tab, enter your information, click Generate BAA, download. Clinic BAA is generated by Clinic account admins.	$0 (Free); Premium €25 per user/month billed annually
Microsoft Teams	Conditional	Microsoft Teams Essentials	Included by default in the Microsoft Products and Services Data Protection Addendum for covered entities and business associates. No separate signature.	$4.00/user/month (Teams Essentials, paid yearly)
Google Meet	Conditional	Google Workspace (paid editions)	A super administrator accepts the Business Associate Addendum in the Admin console before any PHI is used.	€6.80/user/month (Business Starter, annual commitment)
Google Workspace	Conditional	Paid editions administered in the Admin console (Business Starter, Standard, Plus, Enterprise, Essentials, Frontline, Education, Nonprofits)	Electronic acceptance by a super administrator, with three questions confirming covered-entity status.	€6.80/user/month (Business Starter, annual commitment)
GoTo Meeting	Conditional	GoTo Meeting for Healthcare	Business Associate Addendum incorporated into GoTo's Terms of Service via the DPA; available to U.S. healthcare customers.	$12/organizer/month (Professional, billed annually); Healthcare plan not priced publicly
Zoom	Conditional	Pro	Pro: accept the United States BAA on the healthcare Plans & Pricing page. Business and above: contact Sales.	$14.16/user/month (Pro, billed annually)
FaceTime	Unknown	No vendor source	No vendor source	Not published by the vendor
Webex	Unknown	No vendor source	No vendor source	Not published by the vendor

Prices are a snapshot in the currency each vendor's pricing page uses. Google shows EUR for this region and no US dollar price, and Doxy.me's Premium price is in EUR. Teams, GoTo and Zoom show USD.

Vendor	Encryption at rest	SOC 2	SSO	Data residency
Doxy.me	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Microsoft Teams	Yes	Yes	Not published by the vendor	Resides in the geographic region associated with the Microsoft 365 or Office 365 organization
Google Meet	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Google Workspace	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
GoTo Meeting	Not published by the vendor	Not published by the vendor	Yes	North America only (GoTo Meeting for Healthcare)
Zoom	Not published by the vendor	Yes	Not published by the vendor	Not published by the vendor
FaceTime	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Webex	Yes	Yes	Yes	Not published by the vendor

None of the eight vendors publishes audit log availability.

What counts as PHI in a video call

A video call with a patient, or about a patient, carries PHI in transit. If the call is recorded, the recording holds PHI at rest. 45 CFR § 164.312(e)(1)–(2) covers transmission security, including integrity controls and encryption, both addressable. § 164.312(a)(2)(iv) covers encryption of ePHI at rest, also addressable rather than mandatory.

For a video tool to be usable for PHI:

• The vendor must sign a BAA that applies to your plan.
• Recording, transcription and AI features must fall inside the BAA's scope.
• Consumer apps are out.

The typical exclusions are free plans, consumer apps, AI companions and recordings. A clinic can be on a paid plan with a signed BAA and still be outside coverage if staff switch on an AI note-taker the BAA does not name. Read what a business associate agreement covers before you file one.

How each vendor's BAA works, and what to check

Self-serve acceptance. Doxy.me generates the BAA from the account: Profile > Settings > BAA tab, then Generate BAA and download. Clinic account admins generate the Clinic BAA. For Google Meet and Google Workspace, a super administrator reviews and electronically accepts the amendment in the Admin console under Account settings > Legal and compliance, before any PHI is used. Staff without super admin rights cannot do this for you.

Contract-embedded. Microsoft includes the BAA by default in the Products and Services Data Protection Addendum. Teams is listed among the Office 365 commercial and GCC in-scope services, and no separate signature is required. The check is whether your tenant and plan fall under that addendum. GoTo's Business Associate Addendum forms part of the customer's agreement with GoTo and is available to U.S. healthcare customers on GoTo Meeting for Healthcare. It applies only to GoTo's processing of PHI the customer provides under that agreement. GoTo's page does not name products or features such as recording or AI.

Purchase or sales route. On Zoom Pro, you click Buy Now on the healthcare Plans & Pricing page, select the United States Agreement (BAA) in the country dropdown, click Read Agreement, then I accept. Business, Business Plus and Enterprise go through Sales. An existing healthcare plan enables it from the web portal: Plans and Billing > Plan Management > view more products > the Business Associate Agreement (US only) tile > Enable > Proceed. Canadian billing addresses may see a PHIA option instead. Zoom also signs BAAs for other paid plans listed on Plans & Pricing.

Unknown entries. FaceTime and Webex stay unknown because neither vendor publishes a document stating that it signs a customer BAA. Apple's FaceTime privacy page and Cisco's Webex HIPAA whitepaper describe encryption and controls only. Their verdicts change only when a dated vendor BAA document is added. The Webex flags in the table (encryption at rest, SSO, SOC 2) do not change that.

Signing the BAA is the customer's step, and it comes before anyone handles PHI.

Recording, transcription and AI: audio and screen recording questions

People searching for a HIPAA-compliant voice recorder, AI voice recorder or screen recording tool are asking one question: does the vendor's BAA cover this feature and the place it stores data? A recorder with no signed BAA covering that feature should not touch PHI, however good its security page looks.

This table covers video conferencing vendors only. It does not rank standalone voice recorders, AI note-takers or screen recorders, and none is verified here. For call recording on voice lines, see HIPAA-compliant phone systems and VoIP.

Check each tool on this list before turning on a recording:

• Is recording named in the BAA scope?
• Where are recordings stored, and in which region?
• Who can access, download or share them?
• Are transcripts and AI summaries covered, or excluded as an AI companion?
• Is the retention setting under your control?

For message archival, confirm the archive sits inside the same BAA as the conversations it stores.

Video APIs, embeds, hosting and webinars

APIs and embeds. If you embed video visits in a branded patient portal, the video API or SDK vendor handles PHI and needs a BAA with you. Claims of "no separate BAA" need a vendor source. No video API or SDK vendors are in this table yet. They are on the research list with no verdicts, and none is ranked or named here.

Hosting and embeds. Hosting recorded visits or patient education video needs a BAA covering both storage and delivery. See HIPAA-compliant hosting and HIPAA-compliant storage.

Webinars. A BAA on a meeting product does not automatically extend to webinar products or registration data. Registrants' names and health-related answers can be PHI.

Choosing a tool: questions for your vendor inventory

Put these in the vendor inventory entry for any video tool:

1. Which plan are we on, and does the BAA apply to it?
2. Which features are excluded: recording, transcription, AI companion, chat, file sharing?
3. Who accepts or signs the BAA, and where is it filed?
4. Who owns access controls, device security, offboarding and staff training? Those stay with your organization.

This is reference information. It is not legal advice and not an audit of any vendor.

Internal team calls and where team chat fits

Patient-facing video visits are telehealth. This page does not cover telehealth platforms. Staff calls about scheduling, handoffs or supply orders are a different job.

Chanty is internal team communication for staff, with audio and video calls. A HIPAA BAA is available from the Business plan and not on Free; Enterprise adds a negotiated MSA alongside the BAA. Connections use TLS 1.2+ in transit, and file storage is encrypted. Chanty is not for patient messaging or telehealth. The lead-topic page, published by Chanty, Inc., is at chanty.health video calls. Chanty is not in the table above. For shared documents, see HIPAA-compliant file sharing, or browse every HIPAA-compliant software category.

FAQ

Is Zoom HIPAA compliant?

Does Microsoft Teams sign a BAA, and do I need to sign anything separately?

Verdict: conditional. The BAA is included by default in the Microsoft Products and Services Data Protection Addendum. It applies to Microsoft Online Services licensed under agreements that include the Product Terms and the DPA, with Teams among the in-scope services. No separate signature is needed. Microsoft does not name a minimum plan, so confirm that your plan is licensed under those terms.

Does the free plan of any video tool include a BAA?

Doxy.me does: its BAA is available from the Free plan. Zoom starts at Pro, Teams at Essentials, and Google at paid Workspace editions. GoTo requires GoTo Meeting for Healthcare. FaceTime and Webex are unknown.

Is FaceTime allowed for patient calls?

Verdict: unknown. Apple does not publish a vendor BAA for FaceTime, so this directory calls it neither compliant nor non-compliant.

Are recordings and AI meeting summaries covered by the BAA?

Not automatically. Recording, transcription and AI features must be named in the BAA scope for your plan.

Can I embed video visits in a patient portal without a separate BAA?

The video API or SDK vendor handles PHI, so a BAA with that vendor is the baseline. No video API vendors are verified here. Any "no separate BAA" claim needs a vendor source.

What is the difference between HIPAA compliant and HIPAA certified?

HIPAA has no official certification for software products. This directory states "BAA available on plan X for services Y" instead, and does not call any vendor "HIPAA certified."

Sources and last verified