HIPAA-compliant video chat: what it requires and how to choose

A video call is acceptable for PHI when three things line up: a signed business associate agreement (BAA) with the video vendor that covers the plan and services you use, a configuration that matches your risk decisions, and your own written policies. No video product holds a "HIPAA certification" that settles this for you. This page gives a checklist you can apply to any vendor, then points you to ready-made providers or a custom build.

Short answer: what makes a video call HIPAA-compliant

Compliance is an arrangement, not a product label. Three points hold for every vendor:

• HHS does not certify software. Phrases like "HIPAA certified video" are marketing, not a status HHS grants. HHS OCR states in its cloud computing FAQ that it "does not endorse, certify, or recommend specific technology or products," and an older OCR page says HHS and OCR do not certify any persons or products as "HIPAA compliant." (hhs.gov)
• A BAA is necessary but not sufficient. Compliance depends on a signed BAA, how the service is configured, and the customer's own policies. A BAA with the wrong plan, or with features switched on that it doesn't cover, doesn't help you.
• Video that carries PHI usually creates a business associate relationship. If a vendor transmits, stores or can access PHI for you, HHS guidance generally treats it as a business associate that must sign a BAA. HHS's test is whether the vendor creates, receives, maintains or transmits ePHI for you, not whether it can view it. A cloud vendor that stores only encrypted ePHI and holds no key is still a business associate. The conduit exception covers transmission-only services with merely temporary storage, and HHS says it generally does not apply to cloud service providers. (hhs.gov)

For vendor-by-vendor BAA availability, see video chat providers with a BAA compared. This page covers the criteria, not the verdicts.

When a video call involves PHI

A call involves PHI when the people on it, or what they say or show, identify a patient and relate to their care, payment or health. Typical clinic cases:

• Telehealth visits. The clinician and patient discuss symptoms, medications or results.
• Clinician consults. A primary care physician shows a specialist a patient's imaging over screen share.
• Patient screen sharing. A patient shares a portal page or a photo of a rash.
• In-call chat. The sidebar chat is text, and patients paste names, dates of birth and medication lists into it.

Some calls carry no PHI: a vendor-contract meeting, a staff holiday-schedule huddle, a marketing sync. The risk is that "internal" calls drift. A billing meeting that opens a patient account on screen is now a PHI call. If your staff can't reliably keep the two apart, treat the whole tool as a PHI tool and hold it to one standard.

Three artifacts need separate thought because they outlive the call:

• Recordings. Video and audio files stored by the vendor or downloaded to a laptop.
• Transcripts. Text of everything said, often generated automatically.
• In-call chat logs. Saved with the meeting or exported afterward.

Each can hold PHI, sit in a different storage location, and fall under different retention and BAA terms.

The checklist: what to confirm before using video with PHI

Work through these items for the specific plan and service you intend to buy, and keep the answers with your records.

Item	What to confirm	Where to find it
BAA	Available for your exact plan and the services you will use; who signs; whether it's a click-through or a negotiated document	The vendor's official BAA page or your account manager [verify per vendor]
Encryption	What is encrypted in transit and at rest; whether an end-to-end option exists and which features it disables	Vendor security documentation [verify per vendor]
Access controls	SSO, multi-factor authentication, host controls, waiting rooms, meeting passcodes, who can admit participants	Admin documentation for your plan
Recording and transcripts	Whether they can be disabled by admin policy, where files are stored, who can download them	Admin settings and BAA scope
AI features	Whether summaries, transcription and assistants are within the BAA, and where their output is stored	Vendor documentation, per feature
Audit logs and retention	What is logged (joins, recordings, setting changes), how long, and whether you can export it	Admin console and documentation
Guest join	Whether patients can join from a link without an account, and what data that collects (name, email, device info, IP address)	Vendor privacy and admin documentation

Some practical notes on reading the table:

• Encryption. HIPAA's Security Rule treats encryption as an addressable implementation specification, which means you assess it and document your decision. It does not require a specific design such as end-to-end encryption. Under 45 CFR 164.312(a)(2)(iv), "Encryption and decryption" is an addressable specification: implement a mechanism to encrypt and decrypt ePHI if, after a risk assessment, it is reasonable and appropriate. If it is not, document why and use an equivalent alternative where reasonable. (ecfr.gov) Vendor claims about encryption should be quoted from their documentation, not paraphrased from a sales page.
• Access controls. Waiting rooms matter in a clinic because a patient who joins early can see the previous patient's session if the room is reused. Use a unique link per visit, or a waiting room with host admission.
• Guest join. The easiest experience for older patients is one tap from a link. Find out what that guest session records and who can see it, then match it to your notice of privacy practices.

Common mistakes

Assuming a free or consumer plan is covered by a BAA. BAAs are usually tied to specific paid plans or services. A clinic that starts on a free tier "just to try it" and then keeps using it for visits has no agreement behind those calls. [verify per vendor: which plans the BAA covers]

Enabling recording or AI features outside BAA scope. An admin turns on automatic transcription or an AI meeting summary because it saves charting time. If that feature is not covered by the agreement, PHI is now flowing through a service with no BAA. Check each feature, not just the product name. The same question applies to AI note-takers that join a call as a participant.

Sending meeting links with patient names by plain email or SMS. A link titled "Maria Gonzalez – diabetes follow-up" discloses a patient relationship in an unprotected channel. Use neutral meeting titles and send the link through a channel your policy allows, such as your patient portal or a secure messaging tool.

Treating a vendor's security page as a signed agreement. A trust center, a SOC report or a "we support HIPAA" statement is not a BAA. The agreement has to be executed and filed.

Ready-made video vs. building your own

There are two routes, and the right one depends on who will run it.

Ready-made conferencing and telehealth platforms are the faster route. You get fixed features, an admin console and a BAA on defined plans. The trade-offs are limited branding, whatever EHR integrations the vendor offers, and a feature set you don't control. Start with the provider comparison to see which services offer a BAA and on which plans.

Video APIs and SDKs let you embed calls inside your own app or patient portal. You control the interface, the join flow and where metadata lives, but you also own more of the architecture and the risk: access control, logging, recording storage, and every integration that touches PHI. A video API with a BAA is a component, not a finished compliant system. If your team is weighing this route, read building HIPAA-compliant video chat, and for the broader question of choosing a messaging or video SDK, see HIPAA-compliant chat APIs for developers.

Decision factors for a clinic or product team:

• Branding and patient experience. Does the call need to live inside your own portal or app?
• EHR integration. Does the visit need to launch from the chart and write back a record?
• Team capacity. Is there an engineer who will maintain this, and handle incident response?
• Volume. Ten visits a day rarely justifies a custom build. A multi-site network or a digital health product may.

Policies and records the clinic still owns

Whatever route you take, these stay with the covered entity or the business associate you operate as:

• Risk analysis covering video. Your security risk analysis should list video tools, recordings and transcripts as assets, with the risks and decisions you made. HHS guidance says the risk analysis must cover risks to all ePHI an organization creates, receives, maintains or transmits, in all forms of electronic media. 45 CFR 164.308(a)(1)(ii)(A) makes it a required step, and HHS telehealth guidance names recording and transcription tools as items to assess. (hhs.gov)
• Workforce rules. Where clinicians may take calls (a private room, not a shared break room or a café), who may record, where recordings may be saved, and which devices are allowed.
• Patient-facing consent and notice language. Wording for telehealth consent, recording notices and technology limitations should be written or approved by counsel.
• Documented BAAs on file. Keep the executed agreement, the plan it covers and the date, so you can show it during an audit or after a vendor change.

Where video sits next to the other chat channels

Video is one of several channels that can touch PHI, and each raises its own questions. HIPAA-compliant live chat for healthcare websites covers the chat widget on your site, AI chat and PHI covers assistants and intake bots, and the chat API section covers developer builds. If you aren't sure which channel you need, start with which kind of chat you need under HIPAA.

Two topics live elsewhere on purpose. Internal staff messaging is covered at chanty.health, and vendor-by-vendor "is X HIPAA compliant" verdicts are at hipaacompliant.wiki.

FAQ

Is Zoom, Microsoft Teams or Google Meet HIPAA compliant?

Compliance isn't a property of the product. What you can check is whether the vendor offers a BAA, on which plans, and for which services, and whether you've signed it and configured the service accordingly. The provider comparison lists BAA availability by plan. [verify per vendor: BAA page, plan names, covered services]

Do I need a BAA for video calls with patients?

If the video vendor transmits or stores PHI on your behalf, HHS guidance generally treats it as a business associate, and a BAA is required. HHS says a vendor that creates, receives, maintains or transmits ePHI on your behalf is a business associate, and failing to have a BAA is a violation (45 CFR 164.308(b)(1) and 164.502(e)). The conduit exception is limited to transmission-only services with transient access. (hhs.gov) A pure peer-to-peer design where the vendor never has access to PHI is a more technical question, so get your counsel or compliance lead to sign off on it.

Is FaceTime or WhatsApp video allowed for PHI?

HIPAA doesn't name approved or banned apps. The questions are whether a BAA is available, whether the service meets your risk analysis, and what your policy says. The vendor's published BAA position for each app should be quoted from its own documentation. Neither Apple nor WhatsApp publishes a BAA position that we could find. Apple's FaceTime security documentation says calls are end-to-end encrypted and that "Apple can't decrypt the data," but it says nothing about a BAA. WhatsApp's Business Policy tells businesses not to use WhatsApp for telemedicine or to send health-related information where applicable regulations require systems that meet heightened requirements. HHS says OCR "does not endorse, certify, or recommend specific technology or products." The 2020 COVID-19 telehealth enforcement-discretion notice that named FaceTime expired on May 11, 2023, and its transition period ended on August 9, 2023. (support.apple.com)

Is end-to-end encryption required by HIPAA?

No. The Security Rule makes encryption an addressable specification: you assess it, implement it where reasonable, and document your decision. Under 45 CFR 164.312(a)(2)(iv), encryption is addressable. If it is not reasonable and appropriate after your assessment, you document why and use an equivalent alternative where reasonable. (ecfr.gov) End-to-end encryption can be a useful control, but it may disable features such as cloud recording and transcripts, so check what you give up.

Can I record telehealth video calls?

HIPAA does not prohibit recording, but a recording of a visit is PHI and has to be stored, retained and accessed under your policies and your BAA. State recording-consent laws and your own notice language also apply. Decide up front who may record, where files go and when they are deleted.

Does a patient need to sign anything to join a video visit?

HIPAA does not require a signature to join a call as such. Informed consent for telehealth, recording notices and acknowledgment of technology risks may be required by state law, payers or your own policy. Many clinics collect consent in the portal at scheduling, so the join link itself stays simple.

Is a video API like Twilio or Vonage enough on its own?

No. An API is a building block. Even with a BAA covering the service, you still need to design the join flow, access control, logging, recording storage and integrations, and to cover them in your risk analysis. [verify per vendor: BAA coverage of video services] See building HIPAA-compliant video chat for the architecture questions.

Sources and last verified