Best HIPAA compliant telehealth platforms
6 tools compared. Checked 6 Nov 2026.
A telehealth tool holds the visit itself and sometimes the notes around it, so check the BAA before you see a patient on it.
Where to start
Start with Doxy.me, since every user can get a BAA, including on Free. If you already run your practice on SimplePractice, its customers accept a BAA at trial signup, so check there first.
| Tool | Result | Where the BAA applies |
|---|---|---|
| DDoxy.me | BAA available | All users, including Free |
| SSimplePractice | BAA available | Accepted at trial signup |
| GGoogle Meet | On some plans | Google Workspace with the BAA accepted |
| MMicrosoft Teams | On some plans | Office 365 Commercial and GCC |
| ZZoom | On some plans | Paid plans, not free Basic |
| WWebex | Not clear | BAA form exists; coverage not stated |
Doxy.me
BAA availableDoxy.me says all users can get a free BAA. Free plans get an Individual BAA covering one user, and paid plans get a Clinic-level BAA covering all users, managed by an Owner or Admin.
Covered: Free (Individual BAA, one user); Paid plans (Clinic-level BAA, all users).
Left out: An Individual BAA covers one user only, and more.
See the full Doxy.me result and proofSimplePractice
BAA availableSimplePractice says customers agree to its BAA by ticking a box when creating a trial account, with no new signature needed on upgrading to a paid account.
See the full SimplePractice result and proofGoogle Meet
On some plansGoogle Meet is listed under Google’s BAA for Google Workspace customers, and an administrator must review and accept the BAA in the Admin console before any PHI is used.
Covered: Google Workspace accounts with the BAA accepted; Google’s pages do not list qualifying editions.
Left out: Third-party applications and add-ons, and more.
See the full Google Meet result and proofMicrosoft Teams
On some plansMicrosoft includes its HIPAA BAA by default through its Data Protection Addendum for covered entity and business associate customers, and lists Teams as in scope for Office 365 Commercial and GCC.
Covered: Microsoft Teams under Office 365 Commercial; Microsoft Teams under Office 365 GCC.
Left out: Copilot web search queries are outside the DPA and BAA.
See the full Microsoft Teams result and proofZoom
On some plansZoom signs a BAA with US customers on paid plans such as Pro, Business, Business Plus and Enterprise, but its free Basic plan has no BAA option.
Covered: Pro; Business; Business Plus; Enterprise; Other paid plans listed on Zoom’s Plans and Pricing page.
Left out: Zoom says AI features are available to customers with BAAs in place, but warns some may be unavailable, so confirm the ones you plan to use, and more.
See the full Zoom result and proofWebex
Not clearCisco’s Webex pages link to a DocuSign form to start a BAA, but they do not say which plans or products it covers.
See the full Webex result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.