Zoom is a leading video conferencing platform that provides tools for virtual meetings, webinars, and collaboration.

With Zoom, organizations can host video conferences, share screens, and collaborate in real-time. This helps enhance communication, improve team collaboration, and conduct meetings efficiently from anywhere.

Is Zoom HIPAA compliant? Yes, based on our research, Zoom can be HIPAA compliant.

 

What changed this year?

As of April 2026, our review did not identify any publicly disclosed changes to Zoom's HIPAA-related policies or BAA terms. Certain Zoom AI Companion features may not be available to healthcare customers operating under a BAA, a restriction that remains in effect and should be factored in by healthcare organizations asessing Zoom's AI-assisted tools.

 

Will Zoom sign a business associate agreement (BAA)?

Yes, Zoom will sign a business associate agreement, which can be requested through Zoom's Trust Center or through an account representative. Free Zoom accounts cannot be used for telehealth sessions involving PHI. HIPAA compliance requires Zoom for Healthcare or an eligible Business or Enterprise plan with HIPAA mode enabled. Covered entities should also note that Zoom has a standard BAA for all covered entities covered entities cannot use their own BAA.

 

What does the Zoom BAA cover?

The Zoom BAA covers the use and disclosure of protected health information (PHI). Zoom helps customers enable HIPAA compliant programs by executing a BAA and safeguarding PHI, and aligns its controls to the HITRUST Common Security Framework (HITRUST CSF). Their HIPAA support page states, "Zoom's HIPAA offering allows you to leverage the Zoom platform, while still maintaining privacy, security, and compliance."

Core services covered under the Zoom BAA include:

  • Zoom Meetings
  • Zoom Video Webinars
  • Zoom Phone
  • Zoom Rooms
  • Zoom Chat

 

What does the Zoom BAA exclude?

Zoom operates under a shared responsibility model. While Zoom provides the technical safeguards required to support HIPAA, customers remain responsible for how the platform is deployed and governed. Healthcare organizations must configure waiting rooms, enable end-to-end encryption, restrict screen sharing, disable auto-transcription and smart summaries unless covered by the BAA, and manage recording practices in accordance with HIPAA requirements.

 

Conclusion

Zoom signs a BAA and is therefore HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals' health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.