Is Zoom HIPAA Compliant? A Therapist's Setup Checklist

Is Zoom HIPAA compliant? Zoom can be used in a HIPAA-compliant way, but not on every account and not without work on your side. Zoom signs a Business Associate Agreement (BAA) with healthcare customers on its paid plans, and a therapist buying a Pro plan can accept it online at checkout. A Zoom account without that agreement is not one a therapist who is a HIPAA covered entity should use for client sessions. And the BAA is only the start. Zoom's own HIPAA Compliance Guide says "Zoom's customers are responsible for ensuring their use of Zoom's services aligns with their obligations under HIPAA," and its security FAQ notes that "there is currently no regulatory-backed certification available for HIPAA compliance."

Below you'll find what Zoom's own pages say (we read them on October 25, 2026), how a practice gets and checks Zoom's BAA, what is different about an account covered by one, what Zoom's encryption does by default, the 2020 and 2021 security history with dates, the settings that most often catch therapists out, and a checklist with a setup record you can copy into your compliance file.

What Zoom says about HIPAA today

Zoom signs a BAA on paid plans

Zoom's support article on its HIPAA Business Associate Agreement says "Zoom enters into business associate agreements (BAAs) with customers, including those in the higher education and healthcare industries, to facilitate their compliance with HIPAA." On plans, it says: "Zoom offers Pro, Business, Business Plus, and Enterprise plans to customers in the healthcare space. Zoom also enters into BAAs with customers who are subscribed to other paid plans listed on Zoom's Plans & Pricing page."

Three details matter for a small practice:

"Zoom for Healthcare" is a set of plans, not a separate app

Many therapists search for "Zoom for Healthcare" expecting a different app. Zoom's support article describes it this way: "Zoom for Healthcare allows you to leverage Zoom Workplace while still enabling your privacy, security, and compliance goals." Zoom's page for healthcare clinics calls it "a bundle solution from Zoom designed for healthcare clinics that typically includes Zoom Workplace, Zoom Phone, and the Zoom Phone Customer Engagement Pack."

So the meeting runs in the same Zoom Workplace app you already know. What makes an account suitable for client work is the BAA on the account and how the account is set up. HHS used the same name in its 2020 telehealth notice, where "Zoom for Healthcare" appeared on a list of vendors that said they would sign a BAA.

How a therapist gets Zoom's BAA

Zoom's support article gives two paths. If you're buying a Business, Business Plus or Enterprise plan, it says to "contact Sales to sign a BAA with Zoom." If you're buying a Pro plan, you can accept the BAA yourself at checkout:

If you already pay for a Zoom plan, Zoom's steps are:

To check the agreement later, open Plans and Billing, find the tile for your BAA and click Manage. Zoom says you can "view the effective date for your BAA, review your BAA, or disable your BAA." Do this once as soon as you've accepted it: note the effective date, save a copy of the agreement, take a screenshot of the tile, and keep all three with your practice records. If the option doesn't appear on your account, Zoom's article points you to its Sales team.

Two notes on what you may read elsewhere:

What changes on a Zoom account with a BAA

Here is how a regular paid Zoom account and one with the BAA in place compare, using Zoom's own pages:

Is Zoom end-to-end encrypted?

Not by default. Every Zoom meeting is encrypted; the difference between the two types is who holds the keys.

E2EE has trade-offs, and Zoom lists them:

What this means for a therapy session: if your client joins from the Zoom app and you don't need cloud recording, transcription or a phone dial-in, E2EE means Zoom's servers don't hold the keys to the session. If a client often joins by phone or from a browser, E2EE won't work for that session. When everyone is on app version 6.0.10 or higher (Zoom Rooms 6.1.0), Zoom says it uses post-quantum end-to-end encryption automatically.

HIPAA doesn't name an encryption method. Your risk analysis decides what is reasonable and appropriate for your practice. Either way you still need the BAA: HHS's cloud computing guidance says a cloud service that handles ePHI for you is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data."

To check a session while it's running, click the shield icon at the top of the meeting window. Zoom says a green shield with a padlock means end-to-end encryption, a green shield with a check mark means enhanced encryption, and an orange shield with an exclamation point means partial encryption, because one or more endpoints in the meeting don't support encryption.

Zoom's 2020 and 2021 security history, with dates

Many search results still describe Zoom as it was in 2020. Here is what happened, taken from the original documents:

The FTC's statements describe allegations resolved by a settlement. For a therapist choosing a tool now, what matters is Zoom's current documentation, covered above.

What HIPAA asks of a therapist on Zoom

First, are you a covered entity?

HHS says health care providers are covered entities "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as billing health insurance electronically (HHS, Covered Entities and Business Associates). Our guide to who HIPAA applies to sorts the common therapist situations, including private pay.

A BAA with your video vendor

Telehealth.HHS.gov is direct: "Covered health care providers and health plans must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (HIPAA Rules for telehealth technology).

You may read that some vendors are "conduits" that need no BAA. HHS's audio-only telehealth guidance limits that to a vendor with "only transient access" to the PHI it carries, and says a covered entity "must enter into a BAA with a vendor that is more than a mere conduit for PHI," giving recordings and transcripts as examples of stored PHI. Zoom can store recordings, chat and meeting summaries for you, and calls itself a business associate. Put the BAA in place rather than lean on the conduit idea.

A risk analysis and everyday safeguards

The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" (45 CFR 164.308). For a solo practice it can be short. HHS and ONC publish a Security Risk Assessment Tool for small and medium providers. Our article on HIPAA violation examples includes HHS cases against small mental health practices where the missing piece was the risk analysis.

The COVID-era flexibility ended in 2023

The 2020 notice said covered providers "may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype," without risk of a penalty for good-faith telehealth during the emergency. It listed "Zoom for Healthcare" among vendors that said they would sign a BAA, adding that "OCR has not reviewed the BAAs offered by these vendors" (Notification of Enforcement Discretion for Telehealth).

That notice expired at 11:59 pm on May 11, 2023. OCR gave a 90-day transition period that ended at 11:59 p.m. on August 9, 2023 (HHS, HIPAA and Telehealth). Since then, telehealth on Zoom falls under the ordinary HIPAA Rules: BAA, safeguards and all. If you started seeing clients on Zoom in 2020 and never accepted the BAA, accept it now, and ask a healthcare attorney what, if anything, you need to do about sessions held without it.

Licensure follows the client

Video makes it easy to forget where a client is sitting. HHS says "Health professionals must meet the licensure requirements of the state where they are located and be licensed or legally permitted to practice in the state where the patient is located" (Licensure for behavioral health). Our guide to counseling compact states covers practicing across state lines.

Zoom settings that catch therapists out

These are easy mistakes in a small practice. Each one is about how Zoom is set up and used, not a flaw in Zoom, and most come straight from Zoom's own pages.

A Zoom checklist for therapists

Work through this once when you set up Zoom, then again whenever you change plans or Zoom adds a feature you use.

A setup record you can copy

Paste this into your compliance file and fill it in. One field per line, so it reads on a phone.

How video sessions work in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. If you'd rather have video sessions come with the rest of your practice than manage a separate meeting account, here is how the same jobs are handled.

The sessions section of practice.tranqbay.health shows a session from the booking to the video call to the note, if you want to see how the pieces fit before you set anything up. One more point: TranqBay's BAA covers TranqBay. If you keep using Zoom for any client work, keep Zoom's BAA in place for it too. For a wider look at the options, see our guide to HIPAA compliant telehealth platforms, and if your practice runs on Google, our guide to whether Google Meet is HIPAA compliant.

If you are weighing other video tools, we answer the same question for FaceTime and Microsoft Teams, and compare the main options in our guide to HIPAA compliant telehealth platforms.

Frequently asked questions about Zoom and HIPAA

Before your next session

Open Plans and Billing and confirm your BAA tile shows an effective date, save the agreement, set the waiting room to Everyone and lock it, stop using your Personal Meeting ID for clients, and fill in the setup record above. With Zoom, most of the risk sits in those few settings and in what gets recorded or shared after the call, not in the video itself.

If you'd like booking, video sessions and notes connected in one place, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources