Menu

Is FaceTime HIPAA Compliant? What Therapists Should Know

No. Apple offers no BAA for FaceTime, and its terms bar covered entities from using it for PHI. What its encryption covers and how to move clients off it.

Updated 10 min read
In this guideTemplate to copy9 questions answered

Is FaceTime HIPAA compliant? No. If you're a therapist who is a HIPAA covered entity, FaceTime isn't a tool you can use for client sessions in a HIPAA-compliant way, and no setting changes that. Apple doesn't offer a Business Associate Agreement (BAA) for FaceTime, and Apple's own software license says a HIPAA covered entity "will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit" protected health information (PHI). FaceTime calls are end-to-end encrypted, which is real protection, but encryption was never the missing piece. The COVID-era allowance that let providers use FaceTime anyway ended at 11:59 p.m. on August 9, 2023.

Below you'll find what Apple's own pages say (we read them on October 25, 2026), what FaceTime's encryption protects and what it leaves out, the HHS notice that allowed FaceTime and how it ended, what "HIPAA compliant" can mean for any video tool, the risks that are specific to running therapy over FaceTime, and how to move your clients to something else, with a message you can copy.

The short answer for your situation

  • You bill insurance electronically, or someone does it for you.You're very likely a covered entity: HIPAA applies to health care providers "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (HHS, Covered Entities and Business Associates). HHS's telehealth rules and Apple's terms both point away from FaceTime for sessions, and the same Apple terms cover FaceTime Audio and iMessage.
  • You see only private-pay clients and nobody bills insurance for you.You may not be a covered entity, and Apple's HIPAA clause is written for covered entities and business associates. That still doesn't make FaceTime a good choice. State privacy laws, your licensing board and your professional code apply either way; the ACA Code of Ethics, for example, says counselors "take reasonable precautions to ensure the confidentiality of information transmitted through any electronic means" (standard H.2.d). Our guide to whether HIPAA applies to therapists walks through the test. Many therapists follow HIPAA anyway, and you may bill insurance later.
  • You used FaceTime for sessions between 2020 and 2023.HHS allowed it during the COVID-19 public health emergency. When that allowance ended, OCR said it would keep exercising enforcement discretion "for violations of the HIPAA Rules that occurred during the period that each Notification was in effect" (Federal Register, April 13, 2023). The allowance covered telehealth provided in good faith.
  • You're still using FaceTime now.Switch before your next session (the steps are below), and ask a healthcare attorney whether anything since August 9, 2023 needs to be assessed. Our HIPAA violation examples show how OCR has handled cases like this.
  • A client asks for FaceTime.Their preference, or a signed waiver, doesn't create a BAA and doesn't change Apple's terms. You can explain why you use a different platform and walk them through joining it.

What Apple's own pages say about FaceTime and HIPAA

Apple doesn't offer a BAA for FaceTime

A covered entity may let a vendor "create, receive, maintain, or transmit electronic protected health information" on its behalf only with "satisfactory assurances," in a business associate agreement, that the vendor will safeguard it (45 CFR 164.308(b); see also 164.502(e)). Apple doesn't publish a BAA for FaceTime, iMessage or iCloud, and its terms, quoted below, point the other way.

"Apple never signs a BAA" isn't quite right, though. The one HIPAA BAA Apple's support pages describe is narrow: healthcare organizations that take part in Apple's Health Records program and offer the Health app's Share with Provider feature "must also accept the Health app data Share with Provider HIPAA Business Associate Agreement" (Apple, Share with Provider FAQ). For Health Records itself, Apple says it "does not execute BAAs," because it isn't receiving PHI from those organizations (Apple, Health Records FAQ). Neither has anything to do with FaceTime or with a therapist's video sessions.

Apple's terms tell covered entities not to use it for PHI

The clearest answer is in the license you accept when you set up an iPhone or iPad. Section 10(b) of the iOS and iPadOS 27 Software License Agreement says:

"If you are a HIPAA covered entity or business associate, you will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information, or use the Apple Software or Apple Services in any manner that would make Apple (or any Apple Subsidiary) your or any third party's business associate."

The macOS license has the same paragraph, and FaceTime is built into that software. Apple's iCloud Terms of Service (last revised September 14, 2026), which govern your Apple Account and iCloud, say the same thing in section I.C: a covered entity agrees not to use "any component, function or other facility of the Service" for PHI, or in any way "that would make Apple (or any Apple Subsidiary) your or any third party's business associate."

In plain terms, Apple isn't refusing a form it signs for other people. Its terms say it isn't your business associate and that you won't use its software and services in a way that would make it one. There is nothing to configure around that.

What FaceTime's end-to-end encryption covers, and what it doesn't

Apple's security documentation is clear about the call itself: "The audio/video contents of FaceTime calls are protected by end-to-end encryption, so no one but the sender and receiver can access them. Apple can't decrypt the data" (Apple Platform Security, FaceTime security). The media is encrypted with SRTP using AES-256, and the call runs peer to peer when it can. Apple's FaceTime privacy page adds: "We never store the content of FaceTime calls."

That protects what is said and seen during the call. It doesn't reach the rest of what a session over FaceTime leaves behind:

  • Call information Apple keeps.Per the same privacy page, "Apple may record and store information about FaceTime calls, such as who was invited to a call, and your device's network configurations, and store this information for up to 30 days." Apple says it doesn't log whether a call was answered.
  • Who you are to the client."The phone number or email address you use is shown to the people you contact." You pick which one under Caller ID in Settings, then Apps, then FaceTime (Set up FaceTime), but one of them goes to every client you call.
  • Call history on both phones.FaceTime keeps each call in your call history until you delete it, and the client's phone keeps yours. A missed video call can leave a video message, with a thumbnail in the call history (Receive FaceTime calls).
  • Contacts in iCloud.To call a client, you usually save them as a contact, and if your contacts sync to iCloud, Apple's iCloud data security overview lists them as encrypted in transit and on the server with keys Apple holds, even with Advanced Data Protection turned on, because contacts are built on standards that "do not provide built-in support for end-to-end encryption."
  • Anything the call saves.A Live Photo taken during a FaceTime call "is saved in your Photos app," with a notice to both people (Take a Live Photo during a FaceTime call). In some countries and regions, a one-to-one FaceTime Audio call can be recorded, with the transcript in Notes (Make FaceTime calls). Local Capture records a video call to the Files app (Improve audio and record video calls). Photos and Notes in iCloud are end-to-end encrypted only if you turn on Advanced Data Protection.
  • The agreement.Encryption is one safeguard. The Security Rule's transmission security standard asks you to "guard against unauthorized access" to ePHI sent over a network, and encryption is an addressable specification under it (45 CFR 164.312(e)). The BAA is a separate requirement, and strong encryption doesn't stand in for it.

That last point answers "why is FaceTime not HIPAA compliant if it's encrypted?" HIPAA asks for both, and FaceTime can only offer one.

The COVID-era FaceTime allowance and when it ended

What HHS allowed in 2020

On March 17, 2020, HHS's Office for Civil Rights (OCR) issued its Notification of Enforcement Discretion for Telehealth. It said some remote communication technologies "may not fully comply with the requirements of the HIPAA Rules," and that OCR would not impose penalties for good-faith telehealth using "any non-public facing remote communication product." FaceTime was named:

"Under this Notice, covered health care providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency."

The same notice said "providers are encouraged to notify patients that these third-party applications potentially introduce privacy risks," and pointed providers who wanted more protection to vendors that "will enter into HIPAA business associate agreements." Apple wasn't on that vendor list. The notice was published in the Federal Register on April 21, 2020 (85 FR 22024).

The point that matters now: FaceTime was allowed because HHS chose not to penalize providers during an emergency, not because HHS found that FaceTime met the rules.

When it ended

In April 2023, OCR announced that the notice would expire with the public health emergency (HHS press release, April 11, 2023; Federal Register notice, 88 FR 22380). The dates, from HHS's HIPAA and Telehealth page:

  • The notice expired at 11:59 pm on May 11, 2023.
  • A 90-calendar-day transition period began on May 12, 2023, for providers to come into compliance.
  • The transition period ended at 11:59 p.m. on August 9, 2023.

Some articles from 2023 say enforcement resumed on May 11; the transition period ran until August 9. Since then the ordinary rules apply. HHS's telehealth site says so directly: "Covered health care providers and health plans must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (Telehealth.HHS.gov, HIPAA Rules for telehealth technology).

What about the "conduit" exception?

You may read that FaceTime is "just a conduit," like a phone company, so no BAA is needed. HHS's audio-only telehealth guidance does say a covered entity doesn't need a BAA with a telecommunication service provider "that has only transient access to the PHI it transmits, because the vendor is acting merely as a conduit for the PHI." It also says "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI," and it lists "communication applications (apps) on a smartphone or another computing device" among the technologies the Security Rule applies to.

HHS has never said FaceTime is a conduit; it named FaceTime as an app that needed the emergency allowance. Apple keeps call information for up to 30 days. And Apple's license says covered entities won't use its software for PHI at all, which a conduit argument doesn't change. If someone tells you the conduit exception covers FaceTime, ask for that advice in writing and check it with a healthcare attorney.

What "HIPAA compliant" can and can't mean for a video tool

No tool is HIPAA compliant on its own, and there's no official badge. HHS says no standard requires a covered entity to "certify" compliance, and that "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule" (HHS FAQ 2003). Compliance is something your practice does.

When a vendor calls its video "HIPAA compliant," the useful reading is narrower: the vendor will sign a BAA with you, it has the safeguards the Security Rule expects, and it gives you the controls you need to use it well. Your part is the rest: a risk analysis, written policies, the right settings and everyday habits.

FaceTime fails the first test, so the rest never starts. Compare Google Meet: Google offers a BAA for Google Workspace accounts, and the work is in the setup, as our guide to whether Google Meet is HIPAA compliant explains. Whatever you consider, check it against these points:

  • The vendor signs a BAA with you, or its BAA applies when you accept its terms, and you can read it before you start.
  • Each session has its own access, so one client can't walk into another client's call.
  • Clients join without your personal phone number or account.
  • You know what the platform stores (recordings, chat, notes) and who can open it.
  • It fits your risk analysis, and your telehealth consent form can name it accurately.

Our guide to HIPAA compliant telehealth platforms goes through each of these in more detail.

FaceTime risks that are specific to therapy

Even setting the BAA aside, FaceTime was built for calling friends and family. Several of its features cut against how therapy is done.

  • Your personal number or Apple Account goes to every client.Once a client has it, they can FaceTime or text you at any hour, and it stays in their phone after therapy ends. That's a boundary problem as much as a privacy one.
  • Your name sits in the client's call history.For most clients that's harmless. For a client whose partner or parent checks their phone, a call log with your name on it can reveal that they're in therapy. HHS's audio-only guidance notes that a covered entity "is not responsible for the privacy or security of individuals' health information once it has been received by the individual's phone or other device," but the clinical risk is still yours to weigh.
  • Your clients sit in your phone.Each client becomes a contact (in iCloud, with keys Apple holds, if your contacts sync there) and a line in your call history. Anyone who picks up your unlocked phone can see who you've been talking to.
  • Shared devices.FaceTime lets you move a call "to another device where you're signed in to the same Apple Account," including an iPad, a Mac or an Apple TV (Hand off a FaceTime call). If a family iPad or the living room Apple TV is signed in to your Apple Account, it's part of your therapy setup whether you meant it or not.
  • Links anyone can open.A FaceTime link can go to anyone, and people without an Apple device join from a browser; Apple says "no login is necessary" (Create a link to a FaceTime call). A web user only has to "provide a name to identify themselves." Apple's Mac guide adds that a caller "using an Apple device" who has "been in the call for at least 30 seconds" can also let people in, and a link keeps working until you delete it (Start or join a call from a FaceTime link). The ACA Code asks counselors using distance counseling to "take steps to verify the client's identity at the beginning and throughout the therapeutic process" (standard H.3). A typed name doesn't do that.
  • Features made for personal use.Live Photos, video messages and audio call recording all create files outside any clinical record. Apple's license also limits Live Captions, "whether generated during a FaceTime call or otherwise," to "your personal, non-commercial use" (section 2(f)).

What to use instead of FaceTime

Use a video platform whose vendor signs a BAA with you, and have it set up before the next session. In practice there are two routes:

  • A general video tool with a BAA, such as Google Meet on a Google Workspace account with Google's BAA accepted. You accept the agreement and manage the settings, the calendar invites and the meeting links yourself.
  • Practice software with video built in, where booking, the session, consent forms and notes sit with one vendor under one agreement, so there are fewer tools to set up and fewer agreements to keep.

Either way, make sure your telehealth consent names the platform you actually use. Our telehealth consent form template has a section for it.

How to move clients off FaceTime

  1. Choose the platform and put the BAA in place first. Read the agreement, note the date you accepted or signed it, and keep a copy with your compliance records.
  2. Update your telehealth consent. Name the new platform, say how clients join, and say what happens if the video drops. Send it to each client before their next session.
  3. Tell clients before the next session, not during it. Use the message below. Keep it short and leave out anything clinical, since it will travel by text or email.
  4. Give clients a way to book and join that isn't your phone number. A booking page link or the platform's session link replaces "I'll FaceTime you at 3."
  5. Open the first session on the new platform with three checks. Confirm the client's identity, where they are (HHS says clinicians must "be licensed or legally permitted to practice in the state where the patient is located," per Licensure for behavioral health), and that they're somewhere private. Note all three.
  6. Decide what you'll do if a client FaceTimes you anyway. Don't hold the session on FaceTime; reply with the link and reschedule if you need to. Put that in your written policies.
  7. Clean up your Apple devices, carefully. Delete FaceTime links you made for clients, remove client calls from your FaceTime call history, turn off FaceTime Live Photos in Settings, then Apps, then FaceTime, and sign out of FaceTime on any shared device. Before you delete a Live Photo, video message or recording from a session, check whether it belongs in the clinical record and how long your state requires you to keep records.
  8. Update your risk analysis. Record the date you stopped using FaceTime and what replaced it.

HHS's resource on educating patients about telehealth privacy suggests two more things worth doing during the switch: give clients "the names of the vendors of any remote communication technologies that you use," and make sure they know "when and how they will be contacted," so a fake link is easier to spot.

A message to clients you can copy

Fill in the brackets and send it a few days before the next session. One line per field, so it reads on a phone.

Wording to copy15 lines · 9 parts to fill in
Subject: How we'll meet for video sessions from now onHi [first name],From [date], our video sessions will move from FaceTimeto [platform name].[Platform name] protects health information under anagreement with my practice. FaceTime doesn't offer one.To book or join your next session, use this link:[booking or session link]You won't need my phone number or Apple Account to join.Before that session, please read and sign the updatedtelehealth consent: [form link]Please don't FaceTime me for sessions after [date].If the video won't connect, call [practice phone].Questions? Reply here and I'll help.[Your name, credentials]

How video sessions work in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and a form library in one place. Here is how it covers the jobs FaceTime was doing.

  • A BAA that applies when you accept the Terms.Video sessions are HIPAA-ready, and TranqBay's Business Associate Agreement applies automatically when a therapist who is a covered entity accepts the Terms of Service; there's no separate document to sign. You can read TranqBay's Business Associate Agreement before you decide anything.
  • End-to-end encrypted video.TranqBay's video sessions are end-to-end encrypted, and the BAA lists "end-to-end encryption of video sessions" among its safeguards.
  • A booking link instead of your phone number.Your practice website has online booking, so you send clients your booking page link and they choose a time there. The opening walkthrough on practice.tranqbay.health ends on the booking confirmation a client gets, which tells them to join with the link in their confirmation email and to open it a few minutes early. Clients don't need your phone number or Apple Account to book or join.
  • Telehealth consent before the first session.The form library has ready-made templates you can send a client for a session, including telehealth consent, consent to treat, intake and release of information. The client fills them in online and the answers wait with the session. Forms aren't scored automatically.
  • The note goes with the session.You write the session note on the session itself, in BIRP, DAP, SOAP, GIRP or a blank note. The structured formats are part of the advanced note templates, which some plans include.

The sessions section of the practice site shows a video session from the therapist's side. One more point: TranqBay's BAA covers TranqBay. If you still text clients from iMessage or email them from a personal account, those need their own answer; our guide to whether Gmail is HIPAA compliant covers email.

If you are weighing other video tools, we answer the same question for Zoom and Microsoft Teams, and compare the main options in our guide to HIPAA compliant telehealth platforms.

Frequently asked questions about FaceTime and HIPAA

Is FaceTime HIPAA compliant for telehealth or telemedicine?

No. For a covered entity, telehealth needs a vendor that will sign a BAA, and Apple doesn't offer one for FaceTime. Apple's software license also says covered entities won't use Apple's software or services to transmit PHI.

Why isn't FaceTime HIPAA compliant if it's end-to-end encrypted?

Because HIPAA asks for more than encryption. Encryption protects the call while it travels. HIPAA also requires a BAA with any vendor that handles PHI for you, plus safeguards for everything the call touches: contacts, call history, and any photos or recordings saved on your devices. FaceTime has the encryption and can't offer the BAA.

Will Apple sign a BAA for FaceTime?

Apple doesn't publish one, and its terms say covered entities won't use Apple software or services in a way that would make Apple a business associate. The one HIPAA BAA Apple's support pages describe is for healthcare organizations that offer the Health app's Share with Provider feature.

Can I use FaceTime if my client asks for it or signs a waiver?

Not as a covered entity. A client's request or consent doesn't create a BAA, and it doesn't change Apple's terms. Tell the client why you use a different platform and help them join it before the first session on it.

Was FaceTime ever allowed for therapy?

Yes, for a while. From March 17, 2020, HHS said it wouldn't penalize good-faith telehealth over apps such as FaceTime during the COVID-19 public health emergency. That allowance expired at 11:59 pm on May 11, 2023, and the transition period ended at 11:59 p.m. on August 9, 2023.

Is a FaceTime Audio call or a regular phone call different?

FaceTime Audio is still FaceTime, so the same Apple terms and the missing BAA apply. A regular phone call is different. HHS's audio-only guidance says no BAA is needed with a phone company that has only transient access to a call, because it is acting as a conduit. If your phone service is internet-based or app-based, the Security Rule applies to it, and a provider that stores anything for you, such as voicemail or recordings, is more than a conduit.

Is iMessage HIPAA compliant?

No, for the same reasons. iMessage is part of the Apple Software and Apple Services covered by the license clause, and Apple doesn't publish a BAA for it. Keep anything clinical on a platform whose vendor signs a BAA, and ask a healthcare attorney how HIPAA and your state treat simple appointment texts.

Can I still use my iPhone for telehealth on another platform?

Many telehealth platforms run on an iPhone, in a browser or an app, and the vendor signs the BAA for its own service. Apple's license clause is broadly worded, and Apple doesn't explain how it applies to other companies' apps running on its devices; if that matters for your risk analysis, ask a healthcare attorney. Either way, use a passcode, keep the device updated and don't share it.

I only see private-pay clients. Can I use FaceTime?

HIPAA may not apply to you if you never send standard electronic transactions and nobody does it for you, and Apple's HIPAA clause is written for covered entities and business associates. State law, your board and your ethics code still apply, and the therapy-specific risks above don't depend on HIPAA at all. Ask a healthcare attorney before you decide you're outside HIPAA.

Before your next session

Check three things today: whether you're a covered entity, whether every client has a way to reach their sessions that isn't FaceTime, and whether your telehealth consent names the platform you'll actually use. If you're switching, send the message above a few days before the next session so nobody is left waiting for a FaceTime call that isn't coming.

If you'd like booking and video sessions in one place, with a BAA that applies when you accept the Terms, see how TranqBay works for private practice: you can look at a practice website template and the booking confirmation your clients would get. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

31 sources

apple.com 4support.apple.com 12HHS 9Regulations 5Associations 1

Updated October 25, 2026. Found it useful? Send it to a colleague.

Run your practice in one place.

Your own website, online booking and video sessions.

  • Your own website
  • Online booking
  • Video sessions
See how it workspractice.tranqbay.health

More guides for therapists

All guides
HIPAA and telehealth8 min

Is Google Workspace HIPAA Compliant? BAA, Apps and Settings

Checklist
Running a practice13 min

Clinical Supervision Topics: 57 Questions and 10 Activities

57 questions
Running a practice7 min

Therapist Email Signature: 10 Examples and What to Include

Examples

In crisis? Don't use this site. Get immediate help or call emergency services.