HIPAA · Video conferencing
Is Zoom HIPAA compliant?
Conditional
Zoom will execute a BAA, but not on the free tier: you need at least one paid licence. Small practices can accept the BAA online for up to nine licences; larger deployments go through sales.
- Which plans the BAA covers
- Requires a paid licence (Pro or above). Zoom Basic includes no option to execute a BAA. The online BAA covers up to nine US licences; beyond that, contact Zoom sales.
Scope
What the BAA does and does not cover.
Covered
- Zoom for Healthcare covers Zoom Meetings, Zoom Phone and Zoom Team Chat under Zoom's BAA
- Cloud recording for clinical applications is available to Zoom for Healthcare licences
Not covered
- Zoom Basic — no BAA is available on the free tier
- Any product surface outside what the executed BAA names
Your side of the agreement
A signed BAA is not a configured system.
Signing shifts liability; it does not change a setting. These are the steps that remain yours once Zoom is in scope.
- 1Upgrade off Basic and execute the BAA before hosting any clinical session
- 2Turn on waiting rooms and passcodes so sessions are not joinable by unintended parties
- 3Decide deliberately whether cloud recording is on, and where recordings are retained
- 4Restrict who may host PHI-bearing sessions, and review that list
Evidence
What an auditor will actually ask for.
Every item below is evidence someone has to produce, date and re-produce at the next audit. Screenata's agent collects these on a schedule instead.
- The executed BAA and licence tier confirmation
- Meeting security settings (waiting room, passcode, encryption) exported from the admin console
- Cloud recording retention configuration and the list of users permitted to record
- Access reviews for accounts holding healthcare licences
See how Screenata handles this on HIPAA programs, or read what healthcare SaaS needs beyond SOC 2.
Sources
Verified against vendor documentation on 2026-08-08. BAA terms change — re-check before relying on this.