All tools / Video and messaging
Is Zoom HIPAA compliant?
Checked 6 Nov 2026 from 5 vendor sources
Zoom signs a BAA with US customers on paid plans such as Pro, Business, Business Plus and Enterprise, but its free Basic plan has no BAA option. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Basic (free) | Not covered |
| Pro | Covered |
| Business | Covered |
| Business Plus | Covered |
| Enterprise | Covered |
| Other paid plans listed on Zoom’s Plans and Pricing page | Covered |
What the BAA leaves out
- Zoom says AI features are available to customers with BAAs in place, but warns some may be unavailable, so confirm the ones you plan to use
- PHI must be kept out of technical support requests
How to get the BAA
Pro customers can accept it online. Existing healthcare plan holders can have an admin enable it under Plans and Billing. Business, Business Plus and Enterprise customers can also contact Zoom Sales.
What the vendor says to do
- Pro: on the healthcare pricing page, buy the plan, choose the United States BAA at checkout and accept it
- Existing plan: as an admin, open Plans and Billing, then Plan Management, then View more products, then enable the Business Associate Agreement (US only) and proceed
- Zoom’s guide also describes optional controls such as two-factor authentication, waiting rooms, passcodes and end-to-end encryption
Proof from the vendor
- HIPAA Business Associate Agreement (BAA), Zoom Support KB0067751Eligible plans, steps to sign, US-only option, AI feature caveat
- Answering Your Top 10 Questions About Zoom for HealthcareFree Basic plan has no BAA option (post dated May 27, 2021)
- Zoom BAA templatePHI barred from support requests; breach notice timelines
- Compliance with HIPAA, Zoom trust centerZoom executes BAAs and offers a SOC 2 + HITRUST report
- Zoom HIPAA Compliance GuideAdmin controls relevant to HIPAA; customer responsibility
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.