HIPAA-Compliant Video Conferencing & Messaging

HIPAA-compliant video conferencing and HIPAA-compliant messaging apps are synchronous and asynchronous telecommunication platforms covered by a written Business Associate Agreement (BAA) under 45 CFR § 164.308(b)(1) and configured to meet the HIPAA Technical Safeguards (45 CFR § 164.312) for access control, audit logging, and cryptographic transmission security when conducting telehealth visits or decentralized clinical trial (DCT) encounters.

Overview: What Makes Video Conferencing HIPAA Compliant for Telehealth?

During the COVID-19 public health emergency, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) exercised temporary enforcement discretion allowing clinicians to use everyday non-public-facing video tools without a Business Associate Agreement. That enforcement discretion expired permanently at 11:59 p.m. on August 9, 2023. Under current federal enforcement, any covered entity (hospital, clinic, physician practice, or covered academic medical center) or business associate transmitting electronic Protected Health Information (ePHI) over synchronous audio-video or asynchronous messaging must satisfy three regulatory pillars:

Executed HIPAA Business Associate Agreement (45 CFR § 164.308(b)(1) & § 164.504(e)): While HIPAA’s narrow “conduit exception” applies to pure transmission-only telecommunications carriers (such as internet service providers or the public switched telephone network) that have only transient access and store no copies, cloud video conferencing and clinical messaging platforms manage user accounts, meeting metadata, chat logs, and optional cloud recordings. Consequently, HHS OCR classifies cloud telehealth vendors as Business Associates that require a signed BAA.
Technical Safeguards (45 CFR § 164.312): The platform must enforce unique user identification (§ 164.312(a)(2)(i)), automatic logoff (§ 164.312(a)(2)(iii)), encryption and decryption at rest (§ 164.312(a)(2)(iv)), hardware/software audit controls (§ 164.312(b)), and transmission security encryption in transit (§ 164.312(e)(2)(ii)) aligned with NIST SP 800-52 Rev. 2 (TLS 1.2/1.3 for signaling and AES-128/256 SRTP for real-time audio/video streams).
Customer-Side Administrative Configuration: As emphasized in CASRAI’s comparison of HIPAA-aware vs. HIPAA-compliant vendor claims, signing a BAA does not make a platform compliant by default. Every enterprise BAA (including Zoom, Microsoft, Google, and Cisco) includes “Customer Responsibilities” clauses requiring the healthcare organization to disable non-covered third-party apps, restrict cloud recording or in-meeting chat exports, and enforce waiting rooms.

Platform Comparison: Are Zoom, Microsoft Teams, Google Meet, and Webex HIPAA Compliant?

Health IT architects and clinical research coordinators select between general-purpose enterprise unified communications platforms (configured under a healthcare BAA) and purpose-built clinical telehealth/messaging platforms:

Platform / Category	What It Is & Required Subscription Tier	HIPAA BAA & Encryption Architecture	Best For	Key Operational Limits & Required Hardening
Zoom for Healthcare (Zoom Workplace for Healthcare)	Healthcare-configured tier of Zoom Video Communications	Signed Zoom HIPAA BAA; AES-256 GCM transport encryption by default, plus optional End-to-End Encryption (E2EE)	Outpatient telehealth, multi-site tele-consent, Epic/Cerner embedded video visits	Free/Basic Zoom has no BAA; enabling strict E2EE disables cloud recording, live closed captioning, and PSTN dial-in
Microsoft Teams (Microsoft 365 / Cloud for Healthcare)	Enterprise collaboration, video, and Teams EHR Connector platform	Microsoft HIPAA BAA included automatically in Microsoft Products and Services Data Protection Addendum (DPA) for qualifying commercial/enterprise plans	Health systems standardized on Azure / Microsoft 365 and Epic-Teams embedded telehealth	Personal/free Teams is excluded; admins must configure Microsoft Purview DLP policies to prevent ePHI leakage in open channels or external guest chats
Google Meet (Google Workspace)	Browser-native video conferencing within Google Workspace	Google Workspace HIPAA BAA executed by org admin in Google Admin Console for paid Business/Enterprise tiers	Browser-based telehealth and research interviews requiring zero patient app downloads	Consumer Gmail (`@gmail.com`) has no BAA; admins must restrict Companion Mode, live streaming to YouTube, and unapproved Workspace Marketplace add-ons
Cisco Webex (Webex for Healthcare / Instant Connect)	Enterprise video conferencing and browser-based Webex Instant Connect	Cisco Webex HIPAA BAA via enterprise agreement; TLS 1.2/1.3 signaling + AES-256 media encryption + optional zero-trust E2EE	Hospital virtual rounding, tele-ICU consults, and EHR-launched browser visits	Requires administrative suppression of meeting titles/PHI in email calendar invites and restriction of local desktop recordings
Dedicated Clinical Telehealth & Messaging (Teladoc Solo, Spruce Health, TigerConnect)	Purpose-built clinical communication, virtual care, and secure texting platforms	Standard healthcare BAA; built-in secure clinical messaging, SMS-to-secure-portal bridges, and EHR HL7/FHIR integration	Inpatient acute tele-stroke/tele-ICU, outpatient care coordination, and HIPAA-compliant patient/staff messaging	Higher per-provider licensing cost than bundled productivity suites; requires dedicated EHR interface provisioning

How to Choose and Configure by Clinical and Research Setting

Different healthcare and clinical trial workflows place distinct demands on video and messaging architecture:

Outpatient Ambulatory Telehealth and Medicare Billing: Synchronous interactive audio-video visits billed with CPT Modifier 95 (telehealth audio-video) require real-time two-way audio and video communication. Launching the video session directly from the EHR patient portal (via SMART on FHIR or native Epic/Cerner telehealth connectors) eliminates the risk of emailing unencrypted meeting links containing patient names or medical record numbers.
Zoom Standard Encryption vs. Zoom End-to-End Encryption (E2EE): Clinicians and IRB reviewers frequently ask about Zoom encryption HIPAA vs. Zoom end-to-end encryption HIPAA. Under HIPAA 45 CFR § 164.312(e)(2)(ii), standard Zoom for Healthcare encryption (TLS 1.2/1.3 signaling with 256-bit AES-GCM media encryption where keys are managed by Zoom’s cloud servers under a signed BAA) already satisfies the HIPAA Security Rule transmission security standard. Enabling optional End-to-End Encryption (E2EE) generates cryptographic keys strictly on participant devices so Zoom’s servers cannot decrypt the stream—which maximizes privacy for sensitive psychiatric interviews, but disables server-side features including cloud recording, automated live transcription, phone bridge (PSTN) dial-in, and EHR browser-embedded clients that do not support the E2EE key exchange.
HIPAA-Compliant Messaging Apps (Clinician-to-Clinician and Clinician-to-Patient): Standard SMS text messaging and consumer messaging apps are not HIPAA compliant for clinician-to-clinician care coordination because SMS travels unencrypted across carrier networks, persists on personal device backups, and lacks audit controls. What encryption and BAA settings are required for telehealth messaging? A compliant clinical messaging platform (such as TigerConnect for inpatient clinical teams or Spruce Health for outpatient patient communication) must enforce TLS/AES-256 encryption, PIN/biometric app lock, remote device wipe, configurable message auto-deletion/archiving, and push-notification masking (displaying only “You have a new secure message” on the mobile lock screen rather than showing the patient’s name and clinical message body).
Decentralized Clinical Trials (DCTs) and eConsent Video Visits: When investigators conduct remote informed consent or adverse-event assessments over video, the IRB protocol and institutional security review must specify whether sessions are recorded. If a trial protocol prohibits video recording, cloud and local recording must be disabled at the tenant group level in the video platform’s admin console.

What to Check on the Vendor BAA and Admin Security Checklist

Before deploying a video conferencing or messaging platform for telehealth cybersecurity compliance, privacy officers and research IT administrators should verify six configuration controls:

Included Functionality Scope in the BAA: Both Google’s HIPAA Included Functionality guide and Microsoft’s compliance documentation specify exactly which core services are covered by the BAA. Third-party marketplace bots, plugins, or consumer AI note-takers (see HIPAA-compliant AI medical scribes) added by individual users are outside the platform vendor’s BAA unless a separate BAA is executed with the third-party developer.
Waiting Room / Lobby Enforcement: Require host admission from a virtual waiting room or lobby for every external participant to prevent “meeting bombing” or an earlier patient overlapping with the next scheduled patient in a recurring virtual exam room.
In-Meeting Chat and File Transfer Disabling: Disable automatic saving of in-meeting text chats to local clinician hard drives, and block unauthenticated file transfers if the EHR patient portal is the designated channel for sharing clinical documents.
Cloud Recording and Transcript Governance: Disable cloud recording by default unless required by a specific clinical or research protocol; when enabled, route recordings to an encrypted, access-controlled repository with defined retention schedules.
Calendar Invitation PHI Stripping: Configure scheduling integrations so external email or SMS reminders sent to patients contain only the generic clinic name, appointment time, and portal login link—never the patient’s diagnosis, procedure type, or full name paired with a specialty clinic identifier in plaintext email headers.
Audit Log Retention (45 CFR § 164.312(b) & § 164.316(b)(2)): Export or retain session connection logs, user authentication timestamps, and administrative configuration changes for the mandatory 6-year HIPAA retention period.

Ongoing Maintenance and Access Revocation

Telehealth compliance requires continuous lifecycle maintenance beyond initial deployment: provision clinician accounts through centralized Single Sign-On (SSO / SAML 2.0) and SCIM directory sync so departing staff or rotating residents lose access to video and messaging tenants immediately upon termination; enforce mandatory client version minimums so endpoints receive cryptographic and WebRTC security patches; and re-verify vendor BAA addenda whenever enabling new platform capabilities such as built-in generative AI meeting summaries.

Frequently Asked Questions

What makes video conferencing HIPAA compliant for telehealth?

For a video conferencing platform to be HIPAA compliant in telehealth or clinical research, two requirements must be met simultaneously: (1) the vendor must sign a written HIPAA Business Associate Agreement (BAA) under 45 CFR § 164.308(b)(1) covering the specific subscription tier, and (2) the covered entity must configure the platform to satisfy the HIPAA Security Rule technical safeguards (45 CFR § 164.312), including TLS/AES encryption in transit, authenticated access/waiting rooms, audit logging, and restricted cloud recording or chat retention.

Are Zoom, Microsoft Teams, and Google Meet HIPAA compliant?

None of these platforms are HIPAA compliant on consumer or free accounts because no Business Associate Agreement (BAA) is in place. However, Zoom (via Zoom for Healthcare or eligible enterprise plans with a signed Zoom HIPAA BAA), Microsoft Teams (via qualifying Microsoft 365 commercial/enterprise plans covered by Microsoft’s Products and Services Data Protection Addendum BAA), Google Meet (via paid Google Workspace plans with an executed Google Workspace BAA), and Cisco Webex (via enterprise plans with a Webex BAA) can be configured for HIPAA-compliant telehealth.

What encryption and BAA settings are required for telehealth messaging?

A HIPAA-compliant messaging app must operate under an executed BAA, encrypt messages and attachments both in transit (TLS 1.2/1.3) and at rest (AES-256), enforce unique clinician and patient authentication (with automatic session logoff and remote wipe for mobile apps), log message access for 6-year HIPAA audit trails, and suppress Protected Health Information (PHI) from appearing in unencrypted SMS or mobile lock-screen push notifications.

Sources

U.S. Department of Health and Human Services, Office for Civil Rights (OCR) — Guidance on HIPAA and Telehealth Remote Communications (https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html).
U.S. Department of Health and Human Services / Code of Federal Regulations — 45 CFR § 164.308(b)(1) (Business Associate Contracts) and 45 CFR § 164.312 (HIPAA Security Rule: Technical Safeguards) (https://www.law.cornell.edu/cfr/text/45/164.312).
National Institute of Standards and Technology (NIST) — NIST Special Publication 800-52 Revision 2: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations (https://csrc.nist.gov/pubs/sp/800/52/r2/final).