HIPAA-Compliant Video Conferencing Tools: 8 Options Compared (2026)

Healthcare organizations searching for HIPAA-compliant video conferencing tools need to verify more than encryption or the presence of a Business Associate Agreement.

A video platform does not make a healthcare organization HIPAA compliant by itself.

HIPAA compliance depends on the complete workflow:

The U.S. Department of Health and Human Services requires regulated organizations to protect electronic protected health information, or ePHI, through appropriate administrative, physical, and technical safeguards. HHS also treats risk analysis as a foundational part of Security Rule compliance.

This means the better purchasing question is not:

It is:

• There is no HHS-approved certification that automatically makes a software product or customer deployment “HIPAA compliant.” Microsoft explicitly notes that no HHS-approved HIPAA certification standard exists and that customers remain responsible for their own compliance program.

• A BAA is important when a video vendor acts as a Business Associate, but having a BAA does not remove the healthcare organization’s own compliance responsibilities.

• The scope of the BAA matters as much as its availability. Buyers should confirm that the exact services they plan to use are covered.

• PHI can appear outside the live video stream, including chat, recordings, transcripts, files, meeting names, participant information, and AI-generated notes.

• Recording or transcribing a meeting can create a different data flow from the live call itself.

• General collaboration platforms such as Zoom, Microsoft Teams, Cisco Webex, and TrueConf solve a different healthcare problem from purpose-built telehealth systems such as Doxy.me, VSee, SimplePractice, and Healthie.

• Patient experience matters. Browser joining, waiting rooms, mobile access, and the number of steps required before an appointment can affect whether a platform works in clinical practice.

• Customer-hosted infrastructure can reduce reliance on a conferencing vendor’s cloud, but self-hosting does not remove the healthcare organization’s responsibility for HIPAA safeguards, risk analysis, access control, backups, and administration.

HIPAA does not contain a list of approved video conferencing products.

Instead, the Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI using appropriate safeguards. HHS specifically identifies areas such as access management, authentication, audit controls, integrity, and transmission security.

For video conferencing, this means organizations need to evaluate both the software and the way it will be used.

A platform may provide suitable technical controls while the organization still exposes PHI through:

• incorrect guest permissions;

• inappropriate recording settings;

• weak account management;

• unmanaged devices;

• third-party applications;

• inappropriate retention;

• accidental screen sharing;

• unnecessary AI processing.

Conversely, the absence of a particular marketing label does not by itself determine whether a deployment can satisfy HIPAA requirements.

The most useful first step is to identify where ePHI can appear.

Do not limit the analysis to the camera and microphone.

HHS risk-analysis guidance requires organizations to identify all ePHI they create, receive, maintain, or transmit and to consider external sources and vendors that interact with it.

This makes a PHI map more useful than starting with:

Those features only make sense after the organization understands which data is moving where.

For a typical cloud video platform processing PHI on behalf of a healthcare organization, the provider may act as a Business Associate.

In that case, a BAA is generally required.

HHS notes, however, that a BAA is required when the vendor is acting as a Business Associate, not simply because any telecommunications provider carries data. Its guidance describes a narrow conduit situation where a provider has only transient access and does not create, receive, or maintain PHI on behalf of the covered entity.

This distinction matters most when comparing:

• SaaS video services;

• customer-hosted systems;

• telecommunications providers;

• recording services;

• transcription tools;

• AI assistants.

“Vendor offers a BAA” is not precise enough.

Check:

• the exact product;

• your subscription;

• video meetings;

• messaging;

• cloud recordings;

• transcription;

• AI;

• storage;

• APIs;

• integrations.

Microsoft, for example, publishes an explicit list of cloud services that fall within the scope of its HIPAA BAA. Microsoft Teams is currently listed among the in-scope Office 365 services.

Zoom likewise provides current documentation describing how healthcare customers and customers on other eligible paid plans can enter into a BAA.

Contracts do not configure accounts.

Healthcare organizations still need to determine appropriate settings for:

• identity;

• meeting access;

• guest admission;

• recordings;

• transcripts;

• chat;

• file sharing;

• retention;

• administrator privileges;

• third-party applications.

HHS specifically requires regulated entities to evaluate risks and implement safeguards appropriate to their environment rather than following one universal technical configuration.

The live meeting may be only the beginning of the PHI lifecycle.

Consider:

Each arrow can introduce:

• another service;

• another storage location;

• another user;

• another retention period;

• another vendor relationship.

A checkbox saying BAA available hides too much information.

Use a scope checklist instead.

Zoom provides a useful example of why this distinction matters.

Its current BAA documentation not only describes BAA availability but also has a separate section for AI Feature Availability Under BAA. Zoom states that AI functionality is available to customers with BAAs, while noting that some AI features may not currently be available to healthcare and higher-education customers with BAAs.

A healthcare organization may approve a platform for live consultations but apply different rules to recordings or AI.

Consider four workflows.

Data primarily consists of:

• audio;

• video;

• screen content;

• participant identity.

Now the organization has created stored ePHI.

Questions change to:

• Where is the recording stored?

• Who can download it?

• How long is it retained?

• Is it backed up?

• Can it be shared externally?

The system creates a searchable written representation of the consultation.

This can make PHI easier to:

• search;

• copy;

• export;

• integrate.

The retention and access model therefore matters.

AI may process:

• transcript;

• audio;

• chat;

• screen content;

• attachments.

The products commonly described as HIPAA-compliant video conferencing tools actually represent several different architectures.

Examples:

• Zoom;

• Microsoft Teams;

• Cisco Webex.

These are useful when the healthcare organization needs more than telemedicine.

Typical workflows include:

• staff meetings;

• patient consultations;

• multidisciplinary care;

• training;

• administration;

• messaging.

Examples:

• Doxy.me;

• VSee;

• SimplePractice;

• Healthie.

Their workflows start closer to the clinical process.

Depending on the platform, this can include:

• patient scheduling;

• waiting rooms;

• client portals;

• intake;

• billing;

• clinical records;

• telehealth appointments.

These platforms can reduce the amount of healthcare-specific workflow that has to be assembled separately.

TrueConf represents a different procurement path.

Instead of sending all core conferencing workloads to a general SaaS service, the healthcare organization can operate TrueConf Server in its own infrastructure, including LAN/VPN environments without an Internet connection. TrueConf also publishes healthcare-specific use cases such as telemedicine integration and medical content sharing.

This can change the PHI data flow significantly.

Best for: Healthcare organizations that want to operate video conferencing and related communication infrastructure themselves.

TrueConf Server can be deployed on infrastructure controlled by the healthcare organization and can work in LAN or VPN environments without requiring Internet connectivity for core operation. TrueConf also provides APIs that can be used to integrate video communication into external applications and telemedicine systems.

Its healthcare materials describe use cases involving:

• telemedicine;

• medical content sharing;

• integration into telehealth applications;

• communication from desktop, mobile, and browser clients.

The primary advantage is infrastructure control.

A healthcare organization can design the communication environment around its own:

• network;

• identity;

• server;

• access;

• retention;

• integration policies.

This differs from purchasing a SaaS video account where core conferencing services are operated by the vendor.

Do not assume that self-hosting automatically answers every HIPAA question.

Determine:

• whether TrueConf or a partner will have administrative or support access to PHI;

• whether external integrations process PHI;

• where backups are stored;

• how recordings and messages are retained;

• who administers the servers.

The BAA analysis should follow the actual vendor relationship and data flow.

Do not choose it when: The practice wants a turnkey patient scheduling, billing, intake, and telehealth environment with minimal infrastructure administration.

Best for: Healthcare organizations that want a general-purpose cloud communication platform for patient and staff video workflows.

Zoom currently allows healthcare customers to use Zoom Workplace under a BAA arrangement. Its current documentation states that Pro, Business, Business Plus, and Enterprise plans are offered to customers in healthcare and that Zoom also enters into BAAs with customers subscribed to other eligible paid plans.

This is important because the older assumption that only one special “Zoom for Healthcare” subscription can ever be covered by a BAA is no longer accurate.

Zoom can support several communication classes:

• patient video visits;

• internal meetings;

• multidisciplinary discussions;

• staff training;

• messaging.

It also provides administrative controls for managing healthcare deployments.

Zoom’s current BAA documentation specifically addresses AI.

AI features are available to customers with BAAs, although Zoom notes that individual AI functions may have different availability for healthcare customers. Administrators also have controls for managing those capabilities.

Do not choose it when: A hard requirement says core communications must operate independently inside the healthcare organization’s own network.

Best for: Hospitals and healthcare organizations already centered on Microsoft 365.

Microsoft Teams is currently listed as an in-scope Office 365 service under Microsoft’s HIPAA/HITECH offering. Microsoft makes its HIPAA BAA available to covered entities and business associates for in-scope services.

Microsoft also makes one point especially clear:

Customers remain responsible for determining that their use of Microsoft services is consistent with their HIPAA obligations.

Teams can connect video communication with:

• organizational identity;

• employee messaging;

• files;

• calendars;

• Microsoft 365 collaboration.

This can make it a practical choice when clinicians and administrative staff already work inside Microsoft 365.

Pay particular attention to the services connected to Teams.

A workflow can involve:

• Teams;

• SharePoint;

• OneDrive;

• Microsoft 365 Copilot;

• Power Automate;

• external applications.

Microsoft publishes the services in scope for its BAA, which makes it possible to verify the architecture more precisely.

Do not choose it when: A small practice only wants simple browser-based patient visits and does not otherwise use Microsoft 365.

Best for: Larger healthcare organizations that want enterprise collaboration and video communication across employees, rooms, and care teams.

Cisco’s current Webex Trust Center has a dedicated healthcare section describing Webex as supporting HIPAA use and providing a path for customers that need a BAA.

Cisco also publishes Webex controls covering areas such as:

• identity and access;

• encryption;

• retention;

• data-loss protection;

• compliance tooling.

Webex is more than a patient telemedicine interface.

It can fit healthcare organizations where communication needs include:

• clinical teams;

• administrative meetings;

• conference rooms;

• external consultations;

• organization-wide collaboration.

The breadth of the enterprise environment can be unnecessary for an independent clinician whose primary workflow is simply:

Do not choose it when: The practice primarily needs lightweight telehealth rather than an enterprise communications system.

Best for: Clinicians and practices that prioritize a simple telehealth-specific patient experience.

Doxy.me was built around telemedicine rather than general enterprise collaboration.

Its current support documentation states that Doxy.me operates a HIPAA compliance program and provides BAAs. Its BAA guidance says individual providers can obtain a BAA through Free and Professional accounts, while organizations with multiple providers should use the appropriate Clinic BAA arrangement.

The patient workflow is intentionally simple.

Instead of introducing patients into a workplace collaboration environment, the interaction centers on a telehealth visit and waiting room.

This makes Doxy.me especially relevant when patient adoption is more important than broad internal collaboration.

Doxy.me also reports undergoing a SOC 2 Type 2 audit that included HIPAA Security Rule controls.

Its documentation describes BAAs with relevant vendors used in the service as part of its HIPAA program.

Do not choose it when: The objective is one communication platform for a large healthcare organization’s patient, employee, room, and administrative workflows.

Best for: Telehealth programs requiring more healthcare-specific workflows than a general meeting application provides.

VSee combines video communication with a clinical telehealth environment.

VSee’s current support documentation states that it offers a BAA and describes its video communication as supporting HIPAA use when the appropriate agreement and safeguards are in place.

The product is organized around remote healthcare rather than office collaboration.

VSee Clinic includes patient-facing workflows and waiting-room functionality, and its account setup allows providers to request a BAA when needed.

VSee’s technical documentation describes encrypted audio/video communication and includes recording and screen-sharing functionality.

Recording creates a separate ePHI lifecycle, so organizations should determine whether they will use local or cloud recording and apply suitable retention and access policies.

Do not choose it when: The primary objective is general employee collaboration rather than patient-centered telehealth.

Best for: Private practices that want telehealth inside a broader EHR and practice-management workflow.

SimplePractice is substantially different from Zoom, Teams, and Webex.

Video is not the entire product.

Telehealth sits alongside:

• appointments;

• client records;

• reminders;

• portal access;

• billing and practice management.

SimplePractice states that its BAA applies to its customers and that telehealth is covered within that agreement.

The video session can begin from the same environment that manages the rest of the practice.

Its current telehealth features include:

• appointment links;

• client portal workflows;

• virtual waiting rooms;

• secure chat;

• screen sharing;

• whiteboard functionality.

This can reduce the number of separate healthcare systems a smaller practice needs to connect.

SimplePractice now also provides AI functionality associated with clinical workflows.

Its documentation includes separate terms and guidance covering AI products, transcripts, and third-party vendors.

Do not choose it when: The organization only needs an enterprise video communication layer to integrate into infrastructure it already operates.

Best for: Health and wellness practices that want telehealth combined with broader patient and practice workflows.

Healthie provides a healthcare-specific platform rather than a standalone meeting application.

Its current FAQ states that Healthie signs BAAs with providers and describes the platform as operating under HIPAA requirements for protecting health information.

The platform is designed around ongoing provider-client relationships rather than isolated video calls.

This makes it more relevant when a healthcare organization needs video as part of a broader workflow that may also involve:

• patient engagement;

• scheduling;

• records;

• integrations;

• ongoing care management.

Do not choose it when: The organization only needs a standalone communication layer or customer-operated conferencing infrastructure.

One of the most useful purchasing decisions is to determine whether healthcare itself should be the center of the product.

Neither model is inherently more compliant.

A solo therapist and a 20,000-person hospital should not necessarily begin with the same shortlist.

HIPAA is not the only requirement.

A technically appropriate platform can still fail operationally if patients cannot use it.

Test whether the patient must:

• create an account;

• install an application;

• remember a password;

• navigate several screens.

Clinical workflows often benefit from a virtual waiting state where the provider controls when the patient enters the consultation.

Test actual patient devices, not only organization-managed laptops.

Consider patients who may require:

• captions;

• assistive technology;

• language assistance;

• larger interface elements.

HHS notes that telehealth identity-verification and communication processes still need to account for obligations to provide effective communication to people with disabilities and meaningful access for people with limited English proficiency.

Test rural and mobile connections where relevant.

Patient experience should be evaluated under the networks patients actually use.

HIPAA does not prescribe one universal list of video-product features.

HHS instead requires appropriate safeguards based on risk.

For a video environment, evaluate at least the following.

Check:

• unique employee identities;

• administrator roles;

• MFA;

• SSO;

• guest controls;

• waiting rooms.

HHS requires procedures to verify that persons seeking access to ePHI are who they claim to be and limits access to authorized users.

Determine what activities can be logged and reviewed.

HHS requires mechanisms to record and examine activity in systems that contain or use ePHI.

Evaluate the protection of ePHI transmitted over electronic networks.

Do not reduce this to:

HHS requires appropriate transmission-security measures and treats encryption decisions within the broader risk-management framework.

Organizations need controls that protect ePHI against improper alteration or destruction.

For video workflows, this may affect:

• recordings;

• transcripts;

• shared files;

• exported records.

Decide what actually needs to be retained.

More stored data is not automatically better.

Avoid creating unnecessary copies of:

• recordings;

• chat histories;

• transcripts;

• AI notes.

A pilot should test the PHI workflow, not merely whether the camera works.

Ask a test participant with no existing account to join from:

• laptop;

• smartphone;

• weaker network.

Document every step.

Attempt to join:

• before admission;

• with the wrong account;

• through an expired invitation where applicable.

Simulate a clinician with several records open.

Verify that staff understand how to avoid disclosing information belonging to another patient.

Create a recording and document:

• where it goes;

• who gains access;

• how it is downloaded;

• when it is deleted.

Turn on the exact functions the organization plans to use.

Document:

Then verify that each part of that workflow is approved.

Remove a staff account.

Confirm:

• login access;

• active sessions;

• recordings;

• chats;

• file permissions.

Ask a compliance or security administrator to reconstruct the test activity from available logs.

The organization still needs to evaluate its exact service configuration, contracts, and PHI lifecycle.

There is no HHS-approved certification standard that automatically establishes HIPAA compliance for a video conferencing product. Microsoft explicitly warns against interpreting its compliance offering this way.

The BAA addresses responsibilities between parties.

It does not:

• configure the meeting;

• train staff;

• set retention;

• control guests;

• perform the organization’s risk analysis.

Ask what it covers.

A BAA that covers meetings but not a separate external AI or integration workflow may not answer the organization’s actual question.

HIPAA security requirements are risk-based and broader than one encryption architecture.

Access management, auditability, integrity, transmission security, policies, and administrative controls all matter.

A patient may type medical information into meeting chat.

That chat is part of the PHI analysis.

Meeting titles such as:

can themselves reveal health-related information.

A recording creates stored ePHI that did not need to exist before recording began.

Only record when the clinical or organizational workflow requires it and appropriate policies are in place.

Do not approve “AI Companion”, “Copilot”, or another AI category generically.

Approve the exact feature and understand:

• input;

• processor;

• output;

• storage;

• retention.

Self-hosting changes infrastructure responsibility.

It does not remove:

• risk analysis;

• access requirements;

• workforce policies;

• audit controls;

• backup obligations;

• physical safeguards.

A tool should provide capabilities that allow a covered entity or Business Associate to protect ePHI appropriately, while the surrounding vendor relationship, contracts, configuration, and operational processes must also meet the organization’s HIPAA obligations.

The Security Rule focuses on administrative, physical, and technical safeguards rather than a single product label.

HIPAA does not establish a universal requirement that every video conference use a specific end-to-end encryption architecture.

Organizations must protect ePHI during transmission and determine reasonable and appropriate safeguards through their risk-analysis and risk-management process.

Usually when the provider is acting as a Business Associate by creating, receiving, maintaining, or transmitting PHI on behalf of the covered entity.

Not every carrier of data automatically becomes a Business Associate. HHS describes a limited conduit exception where a telecommunications provider has only transient access and does not create, receive, or maintain PHI on behalf of the organization.

For conventional cloud video platforms used to handle PHI, verify the Business Associate relationship and BAA requirements before deployment.

Zoom provides a BAA path for eligible paid healthcare customers and customers on other eligible paid plans. Its current documentation also addresses the availability of AI features for accounts operating under a BAA.

The healthcare organization remains responsible for determining that its use and configuration satisfy its HIPAA obligations.

Microsoft currently lists Teams as an in-scope service under its Office 365 HIPAA/HITECH offering. Microsoft’s BAA is available to covered entities and Business Associates using in-scope services.

Microsoft explicitly states that having its BAA does not itself make the customer’s organization HIPAA compliant.

Doxy.me states that it operates according to HIPAA requirements and provides BAAs. Individual-provider and clinic BAA arrangements differ, so organizations should use the agreement appropriate to their structure.

Use a general collaboration platform when the organization needs video as part of a broader employee and enterprise communication environment.

Consider purpose-built telehealth software when the workflow primarily revolves around:

• patients;

• waiting rooms;

• scheduling;

• clinical documentation;

• practice management.

Not necessarily.

A BAA is required when another organization qualifies as a Business Associate under the actual relationship and PHI processing involved.

With customer-operated software, the healthcare organization should map which vendors, support providers, hosting companies, integrations, and other parties can create, receive, maintain, or transmit PHI.

Potentially, but the exact AI service must be evaluated.

For example, Zoom currently documents AI availability for customers with BAAs and notes that some features may have healthcare-specific availability restrictions.

Healthcare organizations should determine:

• what data the AI receives;

• whether the service is within the relevant contractual scope;

• where output is stored;

• who can access it;

• how long it remains available.

Before approving a video platform for workflows involving PHI, confirm:

1. Where PHI can appear.

2. Which organizations create, receive, maintain, or transmit it.

3. Which vendors are acting as Business Associates.

4. Whether the required BAA is in place.

5. Whether the exact services are covered by that BAA.

6. How live media is protected.

7. Where recordings, chats, files, and transcripts are stored.

8. What AI functions process.

9. How users and guests are authenticated and authorized.

10. What audit information is available.

11. How employees are onboarded and removed.

12. What retention and deletion rules apply.

13. Whether integrations create additional PHI flows.

14. Whether the configuration has been included in the organization’s HIPAA risk analysis.

HHS describes risk analysis as the first step in identifying and implementing appropriate Security Rule safeguards and requires the process to cover all ePHI an organization creates, receives, maintains, or transmits.

There is no useful universal HIPAA compliant: Yes / No checkbox for video conferencing.

A healthcare organization needs to evaluate the complete workflow:

For general cloud collaboration, Zoom, Microsoft Teams, and Cisco Webex provide healthcare organizations with established HIPAA and BAA paths under applicable services and agreements.

For patient-centered telehealth, Doxy.me and VSee begin closer to the clinical consultation workflow, while SimplePractice and Healthie combine telehealth with broader practice-management functions.

TrueConf represents a different architecture: the healthcare organization can operate its own video communication infrastructure and integrate it into existing telemedicine systems.

The deciding question should therefore not be:

It should be: