Zoom can be used in a HIPAA-compliant manner, but only with the correct plan and configuration. Zoom offers a Business Associate Agreement (BAA) for customers on its Zoom for Healthcare plan or Zoom Workplace Business+ and higher tiers. Without the BAA and proper security settings, using Zoom to discuss protected health information (PHI) violates HIPAA.
PoliWriter generates all the policies, mappings, and audit-ready artifacts referenced in this guide — customized to your AWS / GitHub / Okta stack. 60+ integrations, continuous monitoring, evidence collection — at a fraction of Vanta's price.
Monthly billing · cancel anytime · 30-day money-back guarantee
Zoom is HIPAA compliant only when you sign a BAA with Zoom and enable required security settings. The free and Pro plans do not qualify. You must use Zoom for Healthcare or a Business+ plan with the BAA executed.
Zoom provides AES-256 GCM encryption in transit and supports end-to-end encryption (E2EE) for meetings.
BAA is available on Zoom for Healthcare and Business+ plans. You must request and sign it before transmitting PHI.
Supports SSO, role-based access, waiting rooms, meeting passwords, and host controls to restrict unauthorized access.
Admin dashboard provides detailed activity logs including meeting access, recording access, and user management events.
Cloud recordings can contain PHI. You must disable cloud recording or ensure recordings are stored in a BAA-covered environment.
Zoom allows selecting data center regions but does not guarantee all data processing stays within chosen regions.
In-meeting chat and file transfer can contain PHI. Configure retention policies and disable persistent chat if needed.
Marketplace integrations may not be HIPAA compliant. Each integration must be individually assessed and covered by its own BAA.
AI transcription features should be disabled unless the transcription service is covered under the BAA.
Zoom maintains redundant infrastructure with disaster recovery capabilities as outlined in their BAA.
Zoom offers a BAA for Zoom for Healthcare, Zoom Workplace Business+, and Enterprise plans. The BAA covers Zoom Meetings, Zoom Phone, Zoom Team Chat, and Zoom Rooms when properly configured. You must contact Zoom sales or enable it through the admin portal to execute the BAA.
Sign a Business Associate Agreement (BAA) with Zoom through your admin portal or sales representative.
Disable cloud recording or restrict recording access to authorized personnel only.
Enable waiting rooms and meeting passwords for all meetings involving PHI.
Disable AI Companion features including auto-transcription and meeting summaries.
Configure SSO integration and enforce multi-factor authentication for all users.
Restrict file sharing and persistent chat features in meetings discussing PHI.
Yes, conditionally. Zoom is HIPAA compliant when you use a qualifying plan (Zoom for Healthcare, Business+, or Enterprise), sign a BAA with Zoom, and enable the required security settings such as meeting passwords and waiting rooms.
Yes. Zoom provides a Business Associate Agreement for customers on Zoom for Healthcare, Business+, and Enterprise plans. The BAA covers Meetings, Phone, Team Chat, and Rooms.
No. The free version of Zoom does not include a BAA and cannot be used to transmit or discuss protected health information (PHI). You need at minimum a Business+ plan with a signed BAA.
Zoom offers optional end-to-end encryption (E2EE) for meetings. By default, Zoom uses AES-256 GCM encryption in transit. E2EE can be enabled but disables some features like cloud recording and phone dial-in.
You should disable cloud recording (or restrict access), AI Companion features, automatic transcription, and persistent chat. Enable waiting rooms, meeting passwords, and SSO with MFA.
Zoom for Healthcare is a specialized SKU that includes the BAA by default, pre-configured HIPAA settings, and integration with EHR systems. Regular Zoom Business+ plans can also get a BAA but require manual configuration.
Yes, therapists can use Zoom for telehealth sessions provided they use a BAA-eligible plan, sign the BAA, and configure settings properly. Many therapists use Zoom for Healthcare or Zoom Business+ for this purpose.
PoliWriter generates all the policies, mappings, and audit-ready artifacts referenced in this guide — customized to your AWS / GitHub / Okta stack. 60+ integrations, continuous monitoring, evidence collection — at a fraction of Vanta's price.
PoliWriter creates all the HIPAA policies you need, customized to tools like Zoom and your specific configuration. AI-powered, audit-ready, hours not months.
Get Started Free