Short answer: A yes or no on Zoom does not come from HHS, which does not certify products as “HIPAA compliant”. HHS says covered health care providers and health plans have to use technology vendors that “comply with the HIPAA Rules”. Those vendors, it says, “will enter into HIPAA business associate agreements” for their video communication products. Zoom’s page on its BAA says Zoom enters into business associate agreements (BAAs) with customers on paid plans. It also says customers are responsible for how their use of Zoom lines up with their HIPAA obligations. The rest of this guide shows how a clinic finds out whether HIPAA covers it, what Zoom’s BAA covers and what HHS suggests telling patients before a video visit.
Before you read: This guide is based on HHS’s pages on telehealth technology, covered entities, product claims and patient education. It also uses Zoom’s own article on its BAA, a post on its blog and its pricing page, and Florida’s telehealth statute on Online Sunshine. We read them on November 13, 2026. Whether HIPAA applies to your clinic, and what its video visits need, depends on how it handles health data. HHS’s definition of a covered entity is quoted below. It is general information, not legal advice.
What HHS says about video vendors
HHS’s page on the HIPAA Rules for telehealth technology, last updated on November 6, 2023, says the Rules establish standards to protect patients’ protected health information.
It says all telehealth services provided by covered health care providers and health plans have to comply with the HIPAA Rules.
On vendors, it says covered health care providers and health plans have to use technology vendors that “comply with the HIPAA Rules”. Those vendors, it adds, “will enter into HIPAA business associate agreements” in connection with their video communication products or other remote communication technologies for telehealth.
Another HHS page, on misleading marketing claims, says neither HHS nor its Office for Civil Rights (OCR) certifies a person or a product as “HIPAA compliant”.
In our view, when a video product’s page says “HIPAA compliant”, treat it as a claim to verify and ask which plans the BAA covers.
OCR’s page on HIPAA and telehealth, with content last reviewed on October 18, 2023, covers OCR’s notifications of enforcement discretion during the COVID-19 public health emergency.
OCR’s Notification of Enforcement Discretion for Telehealth announced that OCR would not impose penalties for HIPAA violations against covered providers in connection with their good faith provision of telehealth. That applied to telehealth using “non-public facing remote communication technologies” during the emergency.
The page says OCR announced on April 12, 2023 that the notifications would expire at 11:59 pm on May 11, 2023. OCR gave covered providers a transition period of 90 calendar days, until August 9, 2023.
In our view, if your clinic started video visits during the emergency, read your setup again against the HHS pages cited here.
Zoom’s BAA and its plans
Zoom has a support article on its BAA, updated on October 23, 2026. It says Zoom enters into BAAs with customers, including those in higher education and healthcare.
The article says Zoom offers Pro, Business, Business Plus and Enterprise plans to customers in the healthcare space. It adds that Zoom also enters into BAAs with customers on other paid plans listed on its Plans & Pricing page.
For a Pro plan, the article says the buyer accepts the BAA at checkout. The buyer selects “United States Agreement (BAA)” in the “Select Business Country” menu, clicks “Read Agreement” and then “I accept” if the buyer agrees to the terms.
For Business, Business Plus or Enterprise, it says to contact Sales to sign a BAA with Zoom.
An account that already has a healthcare plan can enable the BAA in the Zoom web portal. The article says an admin with the privileges to edit account settings opens Plans and Billing and clicks “View more products”. The admin then scrolls to “Business Associate Agreement (US only)” and clicks “Enable”.
The article adds that an admin can view the effective date for the BAA, review it or disable it.
On AI features, the article says they are available to customers with BAAs in place, and that Zoom gives account administrators and users controls to manage them. It adds that certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place.
The article also says customers are “responsible for ensuring” that their use of Zoom aligns with “their obligations under HIPAA or other applicable laws”.
Zoom’s blog has a post from March 2, 2021 on small clinics and practices in the U.S. It says they can accept a BAA online and get Zoom Pro with up to 9 licenses.
The post says a practice can sign up for Pro or upgrade a Zoom Basic account to Pro. A practice that needs more licenses can contact the sales team, it adds.
The post adds that the BAA gives access to “other products and features”, and it names cloud recording among them. The support article, updated in 2026, does not mention that limit of 9 licenses.
Zoom’s pricing page, read on November 13, 2026, shows Pro at $14.16 per user per month and Business at $18.33, billed annually. It tells Enterprise buyers to contact Zoom for pricing, and says prices exclude applicable taxes and fees.
The pricing page lists a free Basic plan and no plan called Business Plus, and it does not mention HIPAA or a BAA. The support article on the BAA does not mention the free Basic plan.
In our view, ask Zoom in writing which plan your account is on, and check that your BAA covers it. Start with the support article, which is newer than the blog post.
The terms HHS gives for a business associate contract are in our guide to HIPAA and the clinic website. The same question for a CRM vendor is in our guide to HIPAA and clinic CRMs.
Whether HIPAA covers your clinic
HHS’s page on covered entities and business associates, content last reviewed on August 21, 2024, says the HIPAA Rules apply to covered entities and business associates.
It describes a covered entity as a health care provider, a health plan or a health care clearinghouse. Its list of providers includes doctors, clinics and psychologists, among others.
The page adds “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard”.
If an entity does not meet the definition of a covered entity or business associate, the page says, it does not have to comply with the HIPAA Rules.
When a covered entity engages a business associate for its health care activities and functions, the page says it needs a written business associate contract or other arrangement. The page also says business associates are “directly liable for compliance with certain provisions of the HIPAA Rules”.
HHS links a question and answer decision tool “to find out if an organization or individual is a covered entity”. This guide does not say whether HIPAA covers your clinic.
In our view, run HHS’s decision tool for your clinic before you pick a video platform.
What to tell a patient who books a video consultation
HHS has a resource for health care providers on educating patients about the privacy and security risks of telehealth, last reviewed on October 17, 2023.
It says the HIPAA Rules do not require covered providers to educate patients about those risks. OCR shares it for providers who would like to explain the risks and ways to reduce them.
Before the telehealth session, the resource says, a provider can explain what telehealth is and which remote communication technologies it will use.
It suggests giving the patient the names of the vendors of any remote communication technologies the provider uses, and where to view the vendors’ websites and privacy practices.
It also suggests telling the patient about the privacy and security safeguards the vendor has agreed to use, and whether the telehealth app or website uses online tracking technologies.
Its examples of risks include viruses and other malware, unauthorized access and accidental disclosures. If the patient is not in a private location, the resource says, other persons may hear or see sensitive health information.
It adds that a patient can position the device so others cannot see its screen and, if available, use a headset or headphones.
The resource also suggests making sure the patient knows when and how the provider or the vendor will contact them. That can help the patient avoid “phishing emails or other scams”, it says.
Our guide to HIPAA and patient messages covers the safeguards HHS asks for when a clinic writes to patients by email, text or WhatsApp. Our guide to HIPAA and clinic forms covers what happens to a form a patient fills in before the visit.
HHS’s tips for patients, last reviewed on October 17, 2023, include a private location for the appointment. They also include turning off devices like home security cameras and smart speakers.
The tips add using a personal computer or mobile device if possible, and avoiding public Wi-Fi networks and USB ports at public charging stations.
The educating resource also suggests telling patients that they can file a privacy complaint, and it points to the OCR complaint portal.
In our view, tell each patient who books the vendor’s name and where to read its privacy practices, and share HHS’s tips before the visit.
What Florida’s telehealth statute says
Section 456.47 of the 2026 Florida Statutes, read on Online Sunshine on November 13, 2026, is Florida’s telehealth statute. It defines “telehealth” as the use of “synchronous or asynchronous telecommunications technology” by a telehealth provider to provide health care services.
Its examples of those services include assessment, diagnosis, consultation, treatment and monitoring of a patient.
It defines a telehealth provider by the license, certification or registration an individual holds.
On records, the statute says a telehealth provider “shall document in the patient’s medical record the health care services rendered using telehealth”. The standard, it adds, is “the same standard as used for in-person services”.
It adds that medical records, including video, audio, electronic or other records generated as a result of those services, are confidential under other sections of Florida law.
None of the HHS, Zoom and Florida pages cited here mentions cosmetic treatments, so none of them says where a consultation about one falls.
Web design for med spas at Feedback Studios
Our med spa website design page says we write every page and build the site in WordPress, where your team edits text, photos and sections on its own.
It also says your team decides where the booking button leads: an online booking page, a WhatsApp chat or a phone call.
What to check before a video consultation
In our view, check these points before a video consultation:
- You ran HHS’s decision tool and know whether HIPAA covers your clinic.
- You hold a BAA signed with the video vendor, and you checked that it covers your account’s plan.
- Someone on your team can open the BAA in the vendor’s account and see its effective date.
- You listed the features your team uses, such as recording and AI features, and read what the vendor’s page says about each one with a BAA.
- Each patient who books gets the vendor’s name, where to read its privacy practices, and when and how you will contact them.
- Each patient also gets HHS’s tips: a private location, a personal device if possible and no public Wi-Fi.
RememberHHS does not certify products as “HIPAA compliant”. It says covered providers have to use video vendors that will enter into a BAA. Zoom’s page says it enters into BAAs with customers on paid plans, and that customers are responsible for how their use of Zoom lines up with their HIPAA obligations. HHS has a decision tool to find out if an organization is a covered entity.
Questions about Zoom and HIPAA
Is Zoom HIPAA compliant?
HHS says it does not certify a person or a product as “HIPAA compliant”. Zoom’s article on its BAA says Zoom enters into BAAs with customers on paid plans. It also says customers are “responsible for ensuring” that their use of Zoom aligns with “their obligations under HIPAA or other applicable laws”.
How does a clinic get a BAA from Zoom?
Zoom’s article on its BAA, updated on October 23, 2026, says a customer buying a Pro plan accepts the BAA at checkout. For Business, Business Plus or Enterprise, it says to contact Sales to sign one. The article says an account that already has a healthcare plan can enable the BAA in the web portal.
Does the free Zoom plan come with a BAA?
Zoom’s article on its BAA names Pro, Business, Business Plus and Enterprise as plans it offers to healthcare customers. It says Zoom also enters into BAAs with customers on other paid plans. It does not mention the free Basic plan. A 2021 post on Zoom’s blog says a practice can upgrade a Basic account to Pro to accept a BAA online.
Does OCR’s COVID-19 enforcement discretion for telehealth still apply?
No, HHS says. Its page on HIPAA and telehealth says OCR announced on April 12, 2023 that the notifications of enforcement discretion would expire at 11:59 pm on May 11, 2023. OCR then gave covered providers a transition period of 90 calendar days, until August 9, 2023.
Do the HIPAA Rules require a clinic to tell patients about the risks of video visits?
No, HHS says. Its resource for providers says the HIPAA Rules do not require covered providers to educate patients about those risks. OCR shares it for providers who would like to explain the risks, and suggests naming the vendors and saying where to read their privacy practices.
Sources
All pages were read on November 13, 2026. HHS is the U.S. Department of Health and Human Services, and Online Sunshine carries the Florida Statutes. Where a page shows a date, it is in parentheses.
On video vendors and telehealth: HIPAA Rules for telehealth technology (November 6, 2023) and HIPAA and Telehealth (October 18, 2023). On covered entities and product claims: Covered Entities and Business Associates (August 21, 2024) and What You Should Know About OCR HIPAA Privacy Rule Guidance Materials (July 26, 2013). On patients: the resource on educating patients about telehealth risks (October 17, 2023) and Telehealth Privacy and Security Tips for Patients (October 17, 2023).
From Zoom: the support article HIPAA Business Associate Agreement (BAA) (October 23, 2026) and the pricing page Zoom Workplace Pricing. Also from Zoom, the blog post Small Healthcare Practices Can Now Go Online to Get Zoom Licenses That Enable HIPAA Compliance (March 2, 2021). From Online Sunshine: Use of telehealth to provide services, section 456.47 of the 2026 Florida Statutes.