Video Chat Providers With a BAA Compared

Five of the six video services below say they will sign a BAA on at least one plan: Doxy.me, Microsoft Teams, Zoom, Google Meet and GoTo Meeting. Cisco Webex publishes a HIPAA self-assessment but does not say on its public pages whether or on which plans it signs a customer BAA. No service is compliant on its own, so the useful question is which provider will sign a BAA for the plan and features you plan to use.

Short answer: which video chat services offer a BAA

Every verdict on this page uses one format: BAA available on <plans> for <services>. It describes what the vendor documents, not a property of the product. Whether a call meets HIPAA depends on a signed BAA, how the account is configured and the clinic's own policies. No vendor on this page is "HIPAA certified," and none should be treated as safe for PHI by default.

The table below gives each provider's BAA, plans, services, exclusions, listed price and source. For vendor-by-vendor verdicts beyond video, see hipaacompliant.wiki https://hipaacompliant.wiki/is/ (the "All vendors" index; link text "hipaacompliant.wiki", no anchor exists for verdicts beyond video) (hipaacompliant.wiki). For the overview of this section, see HIPAA-compliant video chat. If you need text chat rather than video, start with which kind of chat you need under HIPAA.

Comparison table: BAA, plan, covered services, price

Rows are sorted by verdict (BAA stated, then BAA conditional on plan, then BAA not stated). Within a verdict, rows run from the lowest listed starting price in USD. Rows priced in another currency or not priced publicly follow. The order is not a ranking.

Provider	BAA available	Plans covered	Services covered	Excluded or limited	Listed price	Source
Doxy.me	Yes, free, self-serve	Free, Professional, Premium, Clinic. The Free and Professional BAA covers an individual provider only; multi-provider practices need a Clinic BAA	Doxy.me telehealth video	None listed by the vendor	Free plan $0; Premium €25 per user/month, billed annually (EUR as shown on the pricing page)	BAA: how do I get a BAA with doxy.me?
Microsoft Teams	Yes, through the Microsoft Online Services Data Protection Addendum; no separate signature; no extra cost stated	Teams Essentials; Microsoft 365 Business Basic; Business Standard (with Copilot); Business Premium (with Copilot); Microsoft 365 / Office 365 enterprise suites; Office 365 U.S. Government (GCC). Not covered: Teams (free) and Teams with a personal Microsoft account	Teams chat, calling and meetings (commercial and GCC); meeting recordings and transcripts stored in OneDrive/SharePoint; Teams Phone	Chat between work and personal accounts; third-party apps integrated into Teams; Copilot in Teams web search queries sent to Bing	$4.00/user/month (Teams Essentials, paid yearly)	Microsoft HIPAA & HITECH compliance
Zoom	Yes, on paid plans. Pro via online checkout; Business, Business Plus and Enterprise via Sales	Pro, Business, Business Plus, Enterprise and other paid plans on the Plans & Pricing page. Not covered: Basic (free)	Zoom Workplace (Meetings, Phone, Chat, Docs, Whiteboard); AI Companion / ZoomMate features for customers with a BAA in place	Certain AI features are not yet available to healthcare customers with a BAA	$14.16/user/month (Pro, billed annually)	HIPAA Business Associate Agreement (BAA)
Google Meet	Yes, accepted by a super administrator in the Admin console; no extra cost	Google Workspace (paid editions) and Cloud Identity. Not covered: consumer Google accounts and the legacy free edition of Google Workspace	Google Meet	Third-party applications and add-ons; Gemini in Chrome	€6.80 per user/month (Business Starter, annual commitment; EUR as shown on the pricing page)	HIPAA Compliance with Google Workspace and Cloud Identity
GoTo Meeting	Yes, for U.S. healthcare customers; the Business Associate Addendum is incorporated into GoTo's Terms of Service via the DPA	GoTo Meeting for Healthcare	GoTo Meeting for Healthcare	Recording the meeting; in-session chat; chat with Business Messaging	Healthcare plan not priced publicly; Professional is $12/organizer/month, billed annually	Business Associate Addendum
Webex (Cisco)	Not stated on public pages	Not stated	Cisco's HIPAA document scopes Webex Meetings, Webex Events (classic), Webex Calling, Webex App, Webex for Developers (APIs), Control Hub and Contact Center	Business Texting does not support HIPAA compliance	Webex Meet $12/user/month ($144/user/year)	Cisco Webex HIPAA Compliance whitepaper

Two price notes. Google Meet's and Doxy.me's Premium prices are in euros, as shown on their pricing pages. GoTo's Professional price is for the standard plan, not the healthcare plan.

Controls the vendors publish

• Microsoft Teams: encryption in transit and at rest; SOC 2; HITRUST CSF and ISO/IEC 27001 audits for services covered under the BAA. Teams data resides in the geographic region of the Microsoft 365 or Office 365 organization.
• Zoom: a SOC 2 Type 2 bridge letter on its Trust Center. Zoom says it aligns its controls to the HITRUST CSF. Encryption details are not published in the sources used here.
• Webex: encryption in transit and at rest, SSO, SOC 2 and ISO 27001.
• GoTo Meeting: encryption in transit and SSO. Data residency for the healthcare plan is North America only.
• Google Meet: access controls. Meet lets you control whether external guests may join each meeting.
• Doxy.me: Not published by the vendor.

Audit-log detail is not published by the vendor for any of the six.

What a BAA does and does not cover on a video call

A BAA covers named services on named plans. Zoom's covers Zoom Workplace on paid plans and excludes Basic. Google's covers Meet as HIPAA Included Functionality and not third-party add-ons. Teams' covers the commercial and GCC service and not the consumer side. A feature outside the named list is outside the agreement, and the exclusions column above shows the pattern: AI add-ons, in-meeting chat, texting and third-party apps.

Check these as separate items, because each one stores or processes PHI differently:

• Recordings. GoTo's healthcare plan excludes recording. Teams recordings and transcripts are covered when stored in OneDrive/SharePoint.
• Transcripts and AI summaries. Zoom says AI features, including ZoomMate, are available to customers with a BAA in place, and also says certain AI features may not be available to healthcare customers. Teams lists Microsoft Copilot and Copilot Chat among in-scope services but excludes Copilot web search queries sent to Bing. Google excludes Gemini in Chrome. For the wider question of AI tools and PHI, see AI chat and PHI.
• Chat inside the meeting. GoTo's healthcare plan excludes in-session chat. Zoom's covered list includes Chat. Teams excludes chat between work and personal accounts.
• Cloud storage. A recording that leaves the video service and lands in a shared drive or inbox is now a file in another system. That system needs its own coverage.

A signed BAA does not stop a front-desk employee from pasting a meeting link and a patient name into a group email, or from saving a recording to a personal laptop. The agreement covers the vendor's handling of data. It does not cover the clinic's handling.

Settings and policies the clinic still owns

Admin settings differ by vendor and plan : Google Meet uses knock-to-join meeting access types (Open, Trusted and Restricted, with the last two not available to consumer accounts), Microsoft Teams uses a lobby governed by the organiser's "Who can bypass the lobby" policy, and Zoom advertises waiting rooms and passcode protection (support.google.com). The clinic still has to decide and document each of these:

• Access to the call. Use a waiting room or equivalent so staff admit each patient by name. Use unique links per visit, not a standing room link. Restrict who can start meetings and who can record. Use SSO and two-factor authentication on staff accounts where the plan offers them. Webex and GoTo list SSO.
• Retention and deletion. Decide whether visits are recorded at all. If so, set who can record, where files go and when they are deleted. The same applies to transcripts and AI summaries.
• Staff conduct. Train staff on minimum necessary, on confirming patient identity at the start of a visit (for example, name plus date of birth), and on what is said when others are in the room or on the call.
• Risk analysis. Add the video channel to the clinic's documented security risk analysis, including which plan, which settings and which integrations are in use.

How to choose between providers

Match the use case.

• One-to-one patient visits at a solo practice: Doxy.me's individual-provider BAA is free. Multi-provider practices need the Clinic BAA.
• Group sessions: check participant limits on the plan. GoTo's Professional plan lists 150 participants, but the healthcare plan is not priced publicly.
• Clinical team calls: Teams, Zoom and Google Meet sit inside suites the clinic may already pay for.
• Embedded video in a patient portal: see the next section.

Check that the BAA tier fits budget and headcount. Zoom's Pro BAA is accepted at online checkout, while Business, Business Plus and Enterprise go through Sales. Teams' BAA is included by default in the Data Protection Addendum. Google's is accepted by a super administrator before any PHI is used. Doxy.me generates the BAA from Profile > Settings > BAA.

Check integrations. Google and Microsoft both exclude third-party apps and add-ons from the BAA, so an EHR or scheduling add-in inside a meeting needs its own agreement.

Check patient experience. Google lets the host control whether external guests join. Whether patients can join from a browser without an account, or must install an app, is not stated for the other vendors in the sources used here , with one exception: Microsoft documents that guests can join a Teams meeting without a Teams account if the admin has turned on "Anonymous meeting join", though whether that works in a browser or needs the app was not confirmed (support.microsoft.com). Test the join flow on a phone before choosing.

When a ready-made service is not enough: embedded video

A clinic or product team that needs video inside its own app, such as a patient portal with a "start visit" button, is no longer choosing a meeting service. It is choosing a video API and building the surrounding system. That changes the decision: the BAA must cover the API and its media and recording features, and the team owns authentication, session links and logging.

Architecture and PHI handling are covered in building HIPAA-compliant video chat. Teams comparing SDKs and APIs can start from HIPAA-compliant chat APIs for developers.

Red flags in vendor claims

• "HIPAA compliant" or "HIPAA certified" with no BAA page. Look for the qualifier. GoTo's plan page says the healthcare plan, "in conjunction with a Business Associate Agreement (BAA), is HIPAA compatible." The BAA is the condition.
• BAA only on an enterprise contract when the clinic is on a free or basic plan. Zoom's BAA excludes Basic, and Teams' excludes the free tier.
• Free consumer tiers used for patient calls. Google's consumer accounts and legacy free edition cannot accept the BAA, and Teams with a personal Microsoft account is not under the Data Protection Addendum.
• A BAA scoped to one person. Doxy.me's Free and Professional BAA covers an individual provider only.
• No named list of covered services. If the vendor cannot say which products and features the BAA covers, treat the answer as "none."
• Public silence. Webex's public pages do not state whether it signs a BAA. Its own technical paper tells covered entities to consult their legal counsel about whether Webex's functionality meets their obligations.

FAQ

Is Zoom HIPAA compliant?

Zoom does not use that framing for the product. The accurate statement is: BAA available on Pro (online checkout), Business, Business Plus, Enterprise and other paid plans for Zoom Workplace (Meetings, Phone, Chat, Docs, Whiteboard), including AI Companion / ZoomMate features for customers with a BAA in place. The free Basic plan is excluded, and certain AI features are not yet available to healthcare customers with a BAA. Compliance still depends on configuration and the clinic's policies.

Is FaceTime or Skype OK for patient calls?

Neither appears in the table because no BAA source for them is included here no vendor BAA source was found for either, and the HHS enforcement-discretion notice for COVID-19 telehealth gives no BAA basis for FaceTime or consumer Skype (hhs.gov). Without a signed BAA covering the service, do not use it for PHI.

Does a free video chat tool ever come with a BAA?

Yes. Doxy.me offers a BAA free on all plans, including Free, for Doxy.me telehealth video. The Free and Professional BAA covers an individual provider only. Free tiers of Zoom (Basic) and Teams are excluded from those vendors' BAAs.

Do I need a BAA if the call has no recording?

Recording is only one way PHI reaches a vendor. Live audio and video, in-call chat, participant names and meeting details also pass through the service. The usual default is a BAA before any patient visit. If you believe a specific setup falls outside that, get a written opinion from counsel HHS telehealth guidance says providers must use technology vendors that will enter into HIPAA business associate agreements for their video communication products, with no exception for unrecorded calls; HHS describes the no-BAA "conduit" exception only for audio-only phone service that does not create, receive or keep PHI. (telehealth.hhs.gov).

Does the BAA cover transcripts and AI meeting summaries?

Only if the vendor names them. Zoom says AI features are available to customers with BAAs but that certain ones may not be available. Teams covers transcripts stored in OneDrive/SharePoint but excludes Copilot web search queries sent to Bing. Google excludes Gemini in Chrome. Read each feature against the vendor's list.

Can patients join without an account?

It depends on the vendor and plan. Google Meet lets the host control whether external guests join. For the others, see the open item in the selection section above , except Microsoft Teams, which documents joining without a Teams account when the admin has turned on "Anonymous meeting join" (support.microsoft.com).

Who is responsible if a patient shares the meeting link?

A BAA binds the vendor and the clinic. It does not govern what a patient does with a link. The clinic controls how links are issued and who is admitted. Unique links, a waiting room and admitting each patient by name limit the damage, and the clinic's policy should say what happens if an unexpected person joins.

Sources and last verified