Written and maintained by CASRAI Editorial Board
Last updated
Yes, Doxy.me is HIPAA compliant across all account tiers—including its Free edition—when configured and operated in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) and backed by a signed Business Associate Agreement (BAA). Built specifically for healthcare workflows rather than adapted from consumer video chat, the Doxy.me application enforces browser-based WebRTC cryptographic transport, zero persistent storage of clinical video/audio streams by default, and independent SOC 2 Type 2 security controls.
For healthcare compliance officers, privacy directors, and independent clinicians evaluating HIPAA-compliant telemedicine platform architectures alongside enterprise alternatives such as Zoom for Healthcare, this guide examines Doxy.me’s Business Associate Agreement structure across Free and paid tiers, its DTLS-SRTP and AES-256 encryption pipeline, and organizational security safeguards.
Is Doxy.me HIPAA Compliant and Is Free Doxy.me HIPAA Compliant?
Under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act Omnibus Rule (45 CFR §§ 164.502(e) and 164.504(e)), a covered entity (physician practice, behavioral health clinic, or hospital) may only transmit electronic Protected Health Information (ePHI) through a telehealth vendor if two conditions are satisfied:
- The platform implements the administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, and 164.312); and
- The vendor executes a written Business Associate Agreement (BAA) assuming legal liability for safeguarding ePHI.
Unlike general-purpose videoconferencing platforms that restrict HIPAA BAAs to paid enterprise licenses, the free version of Doxy.me is HIPAA compliant and includes a free, pre-signed Business Associate Agreement immediately inside the provider’s account dashboard. However, compliance officers must match the BAA tier to their organizational structure:
| Compliance Dimension | Doxy.me Free Edition | Doxy.me Professional Edition | Doxy.me Clinic & Enterprise Editions |
|---|---|---|---|
| HIPAA Security Rule Controls | Full WebRTC DTLS-SRTP / AES-256 encryption & zero persistent PHI storage | Full WebRTC DTLS-SRTP / AES-256 encryption & zero persistent PHI storage | Full WebRTC DTLS-SRTP / AES-256 encryption, SSO/SAML, and centralized audit controls |
| BAA Type Included | Individual BAA (covers a single solo practitioner account) | Individual BAA (covers an individual clinician with HD video, audio-only, and screen share) | Clinic / Organizational BAA (covers multiple providers, administrative staff, and shared rooms under one corporate entity) |
| International Privacy Frameworks | GDPR, PHIPA/PIPEDA (Canada), and HITECH aligned | GDPR, PHIPA/PIPEDA (Canada), and HITECH aligned | GDPR, PHIPA/PIPEDA (Canada), HITECH, and custom enterprise security addenda |
Compliance note for multi-provider groups: While a solo therapist or physician can legally satisfy HIPAA with the Free tier’s Individual BAA, a multi-provider group practice or hospital department requires a Clinic BAA so that the legal entity (rather than individual employees) is the counterparty to the Business Associate Agreement and administrators can enforce clinic-wide access controls and audit logs.
Is Doxy.me Safe? Encryption Architecture and Zero-PHI Storage
When patients and health IT teams ask “is Doxy.me legit” or “is Doxy.me safe”, the technical evaluation centers on how audio, video, and signaling traffic are encrypted and whether patient data is retained on cloud servers.
1. Doxy.me End-to-End Encryption (WebRTC, DTLS, SRTP, and AES-256)
Doxy.me is built on the World Wide Web Consortium (W3C) and Internet Engineering Task Force (IETF) WebRTC (Web Real-Time Communication) standard (RFC 8827), allowing patients to check into the Doxy.me waiting room directly from Chrome, Safari, Edge, or Firefox without downloading executable software:
- Signaling Channel Encryption (TLS 1.2 / 1.3): All web page loading, room check-in, and session signaling traverse HTTPS and Secure WebSockets (
WSS) encrypted with TLS 1.2/1.3 using 256-bit AES cipher suites. - Media Key Exchange (DTLS 1.2+): Audio and video streams negotiate ephemeral cryptographic keys directly between endpoints using Datagram Transport Layer Security (DTLS) handshake protocols with Perfect Forward Secrecy (ECDHE).
- Audio and Video Stream Encryption (SRTP with AES): Live voice and video packets are encrypted using the Secure Real-time Transport Protocol (SRTP, RFC 3711 / RFC 7714) with Advanced Encryption Standard (AES) encryption. In 1-to-1 peer-to-peer calls (or STUN-assisted connections), media packets flow directly between the clinician’s browser and the patient’s browser; when network firewalls require a TURN relay or a Selective Forwarding Unit (SFU) for multi-party group calls, packets remain encrypted in transit across HIPAA-compliant cloud infrastructure.
2. Ephemeral “Conduit” Design and No Persistent PHI Storage
A major architectural safeguard that minimizes Doxy.me security issues and data breach exposure is its ephemeral data model:
- No Patient Account Creation: Patients never create a persistent account, username, or password; they click a static room URL (e.g.,
doxy.me/DrSmith) and type a temporary first name to enter the virtual waiting room. - Automatic Purge on Session Termination: Once the clinician or patient disconnects, the temporary patient check-in name and any in-session text chat messages or transferred files are immediately purged from memory. By default, Doxy.me never records or stores video or audio streams of telehealth encounters.
- Optional AI Scribe Governance: If a clinician explicitly enables optional add-on tools (such as Doxy.me’s ambient AI scribe feature), audio is processed transiently to generate the clinical note draft under the executed BAA, with patient consent prompts built into the workflow.
SOC 2 Type II Certification and Provider Configuration Checklist
At the organizational level, Doxy.me maintains an independent SOC 2 Type II attestation (audited against AICPA Trust Services Criteria for Security, Availability, and Confidentiality), verifying role-based access control, vulnerability scanning, penetration testing, and encrypted cloud infrastructure.
Because HIPAA compliance is a shared responsibility between the technology vendor and the covered entity, healthcare organizations deploying Doxy.me must complete four internal governance steps:
- Execute and Archive the BAA: Download, countersign (with the practice’s legal entity name and compliance officer details), and archive the Doxy.me BAA inside the organization’s HIPAA compliance repository prior to conducting any patient visits.
- Enable Multi-Factor Authentication (MFA) and Passcode Lock: Require MFA on all clinician accounts and configure automatic session timeouts so unattended workstations cannot expose active waiting rooms.
- Verify Waiting Room Privacy: Because each provider has a persistent room URL, clinicians must explicitly click to admit the next patient from the queue so two unrelated patients are never bridged into the same session.
- Document Telehealth Consent in the EHR: Since Doxy.me does not permanently store clinical records, clinicians must document verbal or electronic telehealth informed consent, patient location, and encounter notes directly inside their primary electronic health record.
Frequently Asked Questions
Is Doxy.me HIPAA compliant?
Yes. Doxy.me is fully HIPAA and HITECH compliant, providing encrypted browser-based WebRTC video/audio communication (DTLS-SRTP and TLS 1.2/1.3 with AES-256 encryption), zero persistent storage of patient video, audio, or chat history after a call ends, SOC 2 Type II-audited infrastructure, and a signed Business Associate Agreement (BAA).
Is free Doxy.me HIPAA compliant?
Yes, the free version of Doxy.me is HIPAA compliant for solo practitioners and includes a free Individual Business Associate Agreement (BAA) in the account settings. However, multi-provider clinics and hospitals require a Doxy.me Clinic or Enterprise plan to obtain an organizational Clinic BAA that covers multiple clinicians and staff under a single corporate entity.
Is Doxy.me legit and safe for patients?
Yes. Doxy.me is an established healthcare-specific telemedicine platform founded in 2013 and audited under SOC 2 Type II standards. Patients do not need to download apps or create accounts, all video and audio streams are encrypted in transit via WebRTC DTLS-SRTP, and no recordings or chat messages are stored after the visit ends.
