HIPAA-Compliant Video Conferencing: A Telehealth Security Guide
HIPAA-compliant video conferencing is not a product you buy — it is a setup you verify. A platform qualifies only when it encrypts sessions in transit, enforces unique user access, keeps audit logs, limits stored data, and — the non-negotiable part — comes with a signed Business Associate Agreement (BAA). No BAA, no compliance.
That last sentence trips up more practices than any technical control. Telehealth is now routine care: the American Medical Association's Policy Research Perspectives report published in December 2025 found that 71.4% of physicians used telehealth weekly, up from 25.1% in 2018. Meanwhile, healthcare breach reporting hit a record 772 large breaches in 2025, exposing roughly 138.5 million records. Regulators are paying attention, and so are patients.
This guide covers what the rules actually demand from a video platform, how to verify each requirement, what happens when you get it wrong, and one compliance obligation — language access — that most telehealth teams overlook entirely.
Table of Contents
- What HIPAA Actually Requires From a Video Platform
- The Five Requirements, and How to Verify Each
- Why the BAA Is the Dividing Line
- Where Consumer Video Apps Fall Short
- What Changed Since 2023 and What Is Coming Next
- The Language Access Rule Telehealth Teams Miss
- A 10-Question Vendor Evaluation Checklist
- Where Meeyra Fits and Where It Does Not
- Frequently Asked Questions
What HIPAA Actually Requires From a Video Platform
No government agency certifies software as "HIPAA compliant." There is no seal, no registry, no approval list. Any vendor claiming official certification is describing a private audit, not a federal endorsement.
What HIPAA does define is a set of safeguards in the Security Rule that apply whenever a covered entity or its vendor touches electronic protected health information (ePHI). A video call between a clinician and a patient carries ePHI in three forms at once: the audio and video stream, the metadata around it, and anything typed into chat or captured in a recording.
Compliance is therefore a shared responsibility. The platform provides technical capability. Your practice configures it correctly, trains staff, documents a risk analysis, and signs the paperwork. A perfectly secure product used carelessly still produces a violation.
The Five Requirements, and How to Verify Each
Five requirements separate a clinical-grade platform from a consumer one. Ask for evidence on each, in writing, before your first patient session.
| Requirement | What it means in practice | How to verify it |
|---|---|---|
| Business Associate Agreement | The vendor accepts legal liability for ePHI it processes | Request the executed BAA — availability on a website is not execution |
| Encryption in transit | Audio, video and chat travel over TLS 1.2 or higher, ideally end-to-end | Ask for the cipher suites and whether media is encrypted, not just signalling |
| Access controls | Unique logins per user, MFA, waiting rooms, host-controlled admission | Test it: can a stranger with the link walk into a session? |
| Audit logging | Who joined, when, from where, and what changed — retained and reviewable | Ask to see a sample export of the audit log |
| Data minimisation and retention | No recordings or transcripts stored beyond a documented purpose | Get the retention schedule and deletion guarantees in the contract |
Two of these deserve extra scrutiny. Encryption claims often cover only the connection to the server, which still leaves the provider technically able to read the stream. And audit logging is the control practices most often discover they lack — usually during a breach investigation, which is the worst possible moment.
Why the BAA Is the Dividing Line
A Business Associate Agreement is the contract that extends HIPAA obligations from your practice to your vendor. It defines permitted uses of ePHI, requires safeguards, sets breach notification duties, and establishes what happens to data when the relationship ends.
Without one, the vendor has no legal obligation to protect the health information flowing through its servers — and your practice carries the entire exposure. This is why a technically excellent platform with strong encryption can still be non-compliant for clinical use. The engineering is not the issue; the contract is.
Three practical points matter here. First, a BAA usually applies only to specific paid tiers, not to free or standard consumer accounts of the same product. Second, many vendors require you to enable a distinct compliance mode after signing; the default configuration is not the compliant one. Third, keep the signed copy where your compliance officer can produce it within a day, because that is roughly the timeline regulators expect during an inquiry.
Where Consumer Video Apps Fall Short
Clinicians reach for familiar tools, especially in a rush. The table below reflects publicly documented vendor positions as of September 2026 — verify current terms with each provider, since eligibility tiers change.
| Tool | BAA available? | Practical position for clinical use |
|---|---|---|
| Zoom (free / Pro) | No | Not eligible; only Workplace for Healthcare and eligible Business, Business Plus and Enterprise plans support a BAA |
| Microsoft Teams (free) | No | Paid Microsoft 365 tiers can fall under a BAA; the free consumer version does not |
| Google Meet (personal account) | No | Google Workspace with a covered agreement is a different product from a personal account |
| FaceTime | No | Apple does not offer a BAA for FaceTime under any configuration |
| No | No BAA, no audit logging, no administrative controls over retention |
The pattern is consistent: the consumer edition and the healthcare edition may share a brand and an interface, but only one of them sits inside a BAA. Staff cannot be expected to know the difference, which is why the safest policy names one approved platform and blocks improvisation.
For a broader look at how platforms compare on encryption and data handling generally, our ranking of the most secure video conferencing platforms applies the same evidence-based scrutiny outside the healthcare context.
What Changed Since 2023 and What Is Coming Next
During the COVID-19 public health emergency, the HHS Office for Civil Rights exercised enforcement discretion and allowed clinicians to use non-public-facing consumer apps for telehealth. That flexibility ended. OCR published a notice of expiration in April 2023, the emergency lapsed on 11 May 2023, and a 90-day transition period for telehealth closed on 9 August 2023. Since then, ordinary Security Rule expectations apply to every virtual visit.
A larger change is still pending. HHS published a Notice of Proposed Rulemaking on the Security Rule in the Federal Register on 6 January 2025, with the comment period closing on 7 March 2025. The proposal would make encryption of ePHI mandatory at rest and in transit — removing the long-standing "addressable" designation — and would require multi-factor authentication, asset inventories and stricter documentation of exceptions. As of September 2026 these remain proposals, not law; the regulatory agenda points to final action in 2027, and the content could still shift.
Enforcement, meanwhile, has a clear direction. OCR's risk analysis initiative continues into 2026 with an expanded focus on risk management, meaning investigators want proof that identified risks were actually reduced, not just catalogued. Penalty amounts adjusted for inflation on 28 January 2026 and now range from $145 to $2,190,294 per violation, with tiered annual caps up to the same maximum. The OCR telehealth guidance pages remain the authoritative starting point.
The Language Access Rule Telehealth Teams Miss
HIPAA is not the only federal rule that follows a patient into a video visit. Section 1557 of the Affordable Care Act prohibits national origin discrimination and requires covered entities to provide meaningful language access to patients with limited English proficiency — at no cost to the patient, and through qualified interpreters.
The scale is significant. More than 60 million people in the United States speak a language other than English at home, and roughly 42% of them report speaking English less than "very well," according to Census Bureau American Community Survey data. Section 1557 treats a telehealth encounter exactly like an in-person one: the same interpretation obligation applies, and covered entities choose whether to meet it with an in-person, telephone or video interpreter. HHS publishes sample language access procedures that outline what a written plan should contain.
What the rule does not do is solve scheduling. Booking a qualified interpreter for a 15-minute follow-up often costs more in coordination than the visit itself, so practices improvise — a bilingual family member, a staff member who "speaks some Spanish," or a phone line the patient cannot hear well. Each shortcut creates clinical risk and, under Section 1557, legal risk too.
Live machine translation does not replace a qualified medical interpreter for consent discussions, diagnoses or anything with legal weight. It does work well for the surrounding layer: intake, scheduling, medication reminders, wayfinding, post-visit instructions and triage calls where waiting three days for an interpreter slot is the real barrier to care. Our guide to hosting a multilingual meeting covers how to structure those sessions so nothing gets lost.
A 10-Question Vendor Evaluation Checklist
Send these questions to any vendor before a clinical rollout. Vague answers are answers.
- Will you execute a BAA for the specific plan we intend to buy?
- Which plan tiers are covered, and what happens if we downgrade?
- Is media encrypted end-to-end, or only between each client and your servers?
- Where are servers and backups physically located?
- What audit events do you log, how long do you retain them, and can we export them?
- Do you store recordings or transcripts by default, and can we disable that globally?
- How do you support unique user identification and multi-factor authentication?
- What is your breach notification timeline to us, in hours?
- Which independent audits have you completed, and will you share the current report?
- What is your documented process for returning or destroying data at contract termination?
Where Meeyra Fits and Where It Does Not
Honesty serves you better than a sales pitch here. Meeyra is a browser-based video platform with end-to-end encrypted transmission, no permanent storage of meeting audio, SOC 2 Type II certified data centres and GDPR-aligned data handling, described in detail on our security page. We do not market a HIPAA BAA product, and we will not tell you otherwise to win a deal.
That makes Meeyra a poor fit for ePHI workloads that require an executed BAA, and a strong fit for the multilingual layer around care: international second opinions, private-pay consultations outside HIPAA's scope, medical tourism coordination, cross-border research calls and patient-facing conversations where the language gap is the actual obstacle. Live translation covers 42+ languages in the browser, with no installation for the patient — which matters when the person on the other end is on an older phone in a different country. You can see how the translation works on our live translation page.
Apply the same standard to every vendor you evaluate, including this one. Ask what the platform does, ask what contract backs it, and treat any gap between the two as the real answer.
Frequently Asked Questions
Is any video platform officially certified as HIPAA compliant?
No. HHS does not certify software, and no federal registry of approved telehealth platforms exists. Vendors can demonstrate compliance readiness through independent audits and a signed BAA, but "HIPAA certified" is a marketing phrase rather than a regulatory status.
Does HIPAA require end-to-end encryption for video calls?
Not currently. The Security Rule classifies encryption as "addressable," meaning you must implement it or document why an equivalent alternative is reasonable. The 2025 proposed rule would make encryption mandatory in transit and at rest, but as of September 2026 it has not been finalised.
Can I use a free video app if the patient asks me to?
No. Patient preference does not waive a covered entity's obligations, and the pandemic-era enforcement discretion ended on 9 August 2023. If the platform has no BAA, the visit creates exposure regardless of who suggested it.
What are the penalties for a telehealth HIPAA violation in 2026?
Civil monetary penalties adjusted on 28 January 2026 range from $145 to $2,190,294 per violation, based on culpability tier. Annual caps apply per tier, and OCR also imposes corrective action plans that often cost more to implement than the fine itself.
Do I need an interpreter for a telehealth visit with a patient who speaks limited English?
Section 1557 requires covered entities to provide qualified interpretation at no cost to the patient, and a telehealth visit carries the same obligation as an in-person one. You may meet it through in-person, telephone or video interpreting, but not by relying on family members as a matter of routine.
Can I record a telehealth session?
Yes, if you have a lawful basis, patient consent where state law requires it, and a documented retention and deletion schedule. Recordings are ePHI, so they inherit every storage, access-control and audit requirement that applies to a medical record.
What is the single most common telehealth compliance mistake?
Using a platform without an executed BAA, usually because staff assumed the paid plan they already had covered clinical use. The second most common is enabling recordings by default and never defining when those files get deleted.
Choosing a telehealth platform is a documentation exercise as much as a technical one. Get the BAA signed, verify encryption and audit logging with evidence rather than marketing copy, write down how you evaluated the decision, and revisit it when the Security Rule updates land. The practices that handle an OCR inquiry calmly are the ones that can produce that file on request.
If language is the barrier in your patient conversations rather than the contract, that is a problem Meeyra solves directly. Create a free account and run a multilingual call in your browser in under two minutes, or compare plans on our pricing page.