Best HIPAA-Compliant Video Conferencing Platforms
A feature-by-feature comparison of six telehealth video platforms that sign a BAA, encrypt PHI in transit, and meet the requirements of 45 CFR §164.312. If your practice is a covered entity or business associate, you need a compliant platform. Updated October 2026.
Best Overall
Zoom for Healthcare
Widest EHR integration, reliable at scale
Best Free Option
VSee
Free plan with a signed BAA and no patient download
Best for Therapists
Ensora Telehealth
Purpose-built for behavioral health (formerly thera-LINK)
FIG · 016 HIPAA-Compliant Video Platforms Compared
Each platform below signs a Business Associate Agreement and provides the encryption standards required under HIPAA. The differences come down to price, features, and specialty fit.
Zoom for Healthcare
Enterprise-grade telehealth with deep EHR integration
Strengths
- AES-256 encryption + TLS 1.2
- Epic, Cerner, and 100+ EHR integrations
- Supports up to 1,000 participants
- Screen sharing, whiteboard, recording (configurable)
Limitations
- Requires paid Healthcare plan for BAA
- Cloud recording must be disabled for compliance
- No built-in scheduling or billing
doxy.me
Browser-based telehealth with a free tier and zero downloads
Strengths
- Free plan covers basic one-on-one video visits
- No app download required for patients
- Customizable waiting room with branding
- BAA included on the paid Premium plan
Limitations
- Free tier limited to 1:1 calls only
- No EHR integration on free plan
- Advanced features and the BAA need Premium ($29/user/mo, billed annually)
VSee
Low-bandwidth telehealth with remote monitoring
Strengths
- Optimized for low-bandwidth connections
- Remote patient monitoring (RPM) built in
- Customizable virtual clinic workflows
- HIPAA, BAA, and SOC 2 compliant
Limitations
- Interface feels dated compared to competitors
- Clinic-scale features cost extra (Plus $29, Premium $49 per provider)
- Smaller integration ecosystem
Ensora Telehealth (formerly thera-LINK)
Built exclusively for therapists and counselors
Strengths
- Virtual waiting room with therapeutic tools
- Session notes and documentation built in
- File sharing during sessions
- HIPAA-compliant messaging between visits
Limitations
- Limited to behavioral health use cases
- Group telehealth tops out at six participants
- Smaller company, fewer enterprise features
Google Meet (Workspace)
Familiar interface with Google Workspace BAA
Strengths
- Included with Google Workspace (no extra cost)
- BAA covers Meet, Drive, Gmail, and Calendar
- Familiar UI reduces patient training
- Strong mobile experience on Android/iOS
Limitations
- No healthcare-specific features
- Requires a paid Google Workspace plan
- No virtual waiting room or EHR integration
Microsoft Teams
Enterprise collaboration with healthcare add-ons
Strengths
- Included with Microsoft 365 Business/Enterprise
- BAA covers Teams, OneDrive, Outlook, SharePoint
- Epic and Cerner integration available
- DLP policies for PHI protection
Limitations
- Requires a Microsoft 365 business or enterprise plan
- Patient-facing experience less intuitive
- Healthcare features require additional setup
Feature-by-Feature Comparison
A side-by-side look at the compliance and clinical features that matter most when choosing a telehealth video platform.
| Feature | Zoom | doxy.me | VSee | Ensora (thera-LINK) | Google Meet | Teams |
|---|---|---|---|---|---|---|
| BAA included | ||||||
| End-to-end encryption | ||||||
| Free tier available | ||||||
| No patient download | ||||||
| Virtual waiting room | ||||||
| EHR integration | ||||||
| Group sessions | ||||||
| Screen sharing | ||||||
| Mobile app | ||||||
| Remote patient monitoring | ||||||
| Session notes | ||||||
| Audit logging |
Legend: ✓ = Yes · – = Partial/Paid only · ✗ = No
Encryption & Security Standards
HIPAA’s Security Rule (45 CFR §164.312(e)) requires encryption of ePHI in transit. While HIPAA does not mandate a specific encryption standard, AES-256 is the widely accepted benchmark. See our HIPAA encryption requirements guide for the full technical breakdown.
Key distinction: End-to-end encryption (E2EE) means only the participants can decrypt the video stream. Without E2EE, the platform provider can technically access the unencrypted data, even if it is encrypted in transit.
| Platform | In Transit | At Rest | E2EE | Certifications |
|---|---|---|---|---|
| Zoom for Healthcare | AES-256 GCM + TLS 1.2 | AES-256 | SOC 2 Type II, HITRUST | |
| doxy.me | AES-256 + DTLS-SRTP | AES-256 | SOC 2 Type II | |
| VSee | AES-256 + TLS 1.2 | AES-256 | SOC 2 Type II, HITRUST | |
| Ensora Telehealth (formerly thera-LINK) | AES-256 + TLS 1.2 | AES-256 | SOC 2 Type II | |
| Google Meet | TLS 1.2+ | AES-256 (Google infra) | No | SOC 2, ISO 27001, FedRAMP |
| Microsoft Teams | TLS 1.2+ | BitLocker (Azure) | No | SOC 2, ISO 27001, HITRUST, FedRAMP |
Pricing Comparison
Telehealth platform costs vary widely. Some charge per provider while others charge per user. Make sure your Business Associate Agreement is in place regardless of the plan you choose.
| Platform | Free Tier | Starting Price | BAA Included | Note |
|---|---|---|---|---|
| Zoom for Healthcare | None | Custom quote | Healthcare plans | Pricing not published; contact sales |
| doxy.me | Basic 1:1 visits | $29/mo/user | Premium plan | Premium billed annually; free plan for basic 1:1 visits |
| VSee | Free plan with signed BAA | $29/mo/user | All plans (incl. free) | Plus $29, Premium $49 per provider |
| Ensora Telehealth (formerly thera-LINK) | None | Request demo | Contact vendor | Rebranded under Ensora Health |
| Google Meet | None with BAA | Workspace plan/user | Paid Workspace plans | Workspace Business Starter+ (annual billing) |
| Microsoft Teams | None with BAA | Microsoft 365 plan/user | Business/Enterprise | Microsoft 365 Business Basic+ (annual billing) |
Last verified: 2026-10-18. Zoom and Ensora do not publish list pricing — request a quote for current rates. Enterprise plans typically offer volume discounts.
Best Platform by Practice Type
There is no single “best” telehealth platform. The right choice depends on your specialty, budget, and existing tech stack. Before you commit, verify the vendor will sign a Business Associate Agreement and run through the HIPAA compliance checklist for your video platform configuration.
Multi-Provider Clinic
Zoom for Healthcare
EHR integration, group sessions, and admin controls for managing multiple providers under one account.
Therapists & Counselors
Ensora Telehealth (formerly thera-LINK)
Built-in session notes, therapeutic waiting room tools, and HIPAA-compliant messaging between visits.
Solo Practice (Budget)
VSee (Free) or doxy.me
VSee's free plan comes with a signed BAA and a one-click patient link; doxy.me's Premium plan adds its BAA for $29/user/mo. Neither needs a patient download.
Rural / Low-Bandwidth
VSee
Optimized for poor internet connections. Includes remote patient monitoring for chronic care management.
Enterprise / Hospital
Microsoft Teams
DLP policies, compliance center, and deep integration with existing Microsoft 365 infrastructure.
Already on Google Workspace
Google Meet
No additional cost if you already pay for Workspace Business+. BAA covers Meet, Drive, Gmail, and Calendar.
What Makes a Video Visit HIPAA Compliant?
Choosing a platform that claims HIPAA compliance is not enough. Video visits add risks a phone call does not have: recordings, shared screens, and links that can be reused. Use our risk assessment template to evaluate your telehealth setup and document compliance per 45 CFR §164.312.
A BAA that names the video product
CriticalCheck that the signed BAA lists the exact product you use for visits, plus cloud recordings and chat. A BAA for a vendor's phone or email product does not automatically cover its video app.
Encrypted streams and stored files
CriticalVideo, audio, chat, and any saved recordings should be encrypted in transit and at rest. HIPAA treats encryption as addressable, but every platform on this page encrypts by default, so confirm the setting has not been turned off.
Waiting room and one link per visit
RequiredTurn on the waiting room so the provider admits each patient, and avoid a single standing meeting link that the next patient could join early. Require MFA on provider accounts.
Recording, transcripts, and AI notes
RequiredDecide whether visits are recorded at all. If they are, know where the files live, how long they are kept, and who can download them. AI summaries and live transcripts copy PHI into new places, so leave them off unless the BAA covers them.
Screen share, chat files, and audit logs
RequiredClose other patients' charts before sharing a screen, and treat files sent in chat as PHI. Make sure the admin console keeps a log of who joined each session and when.
Quick Reference Card
| If You Need | Our Pick | Starting At |
|---|---|---|
| Best overall | Zoom for Healthcare | Custom |
| Best free | VSee | Free |
| Best for therapists | Ensora Telehealth | Custom |
| Best low-bandwidth | VSee | From $0 |
| Best for enterprises | Microsoft Teams | M365 plan |
| Best if on Google | Google Meet | Workspace plan |
Whichever platform you choose, complete a risk assessment documenting your telehealth security controls, and keep a signed BAA on file for every vendor that handles PHI.