Best HIPAA-Compliant Video Conferencing Platforms
A feature-by-feature comparison of six telehealth video platforms that sign a BAA, encrypt PHI in transit, and meet the requirements of 45 CFR §164.312. If your practice is a covered entity or business associate, you need a compliant platform. Updated August 2026.
Best Overall
Zoom for Healthcare
Widest EHR integration, reliable at scale
Best Free Option
doxy.me
Unlimited free visits, zero setup required
Best for Therapists
Ensora Telehealth
Purpose-built for behavioral health (formerly thera-LINK)
FIG · 016 HIPAA-Compliant Video Platforms Compared
Each platform below signs a Business Associate Agreement and provides the encryption standards required under HIPAA. The differences come down to price, features, and specialty fit.
Zoom for Healthcare
Enterprise-grade telehealth with deep EHR integration
Strengths
- AES-256 encryption + TLS 1.2
- Epic, Cerner, and 100+ EHR integrations
- Supports up to 1,000 participants
- Screen sharing, whiteboard, recording (configurable)
Limitations
- Requires paid Healthcare plan for BAA
- Cloud recording must be disabled for compliance
- No built-in scheduling or billing
doxy.me
Browser-based telehealth with a free tier and zero downloads
Strengths
- Free tier includes unlimited visits
- No app download required for patients
- Customizable waiting room with branding
- BAA included on the paid Premium plan
Limitations
- Free tier limited to 1:1 calls only
- No EHR integration on free plan
- Advanced features require the Premium plan (pricing on request)
VSee
Low-bandwidth telehealth with remote monitoring
Strengths
- Optimized for low-bandwidth connections
- Remote patient monitoring (RPM) built in
- Customizable virtual clinic workflows
- HIPAA, BAA, and SOC 2 compliant
Limitations
- Interface feels dated compared to competitors
- Pricing not transparent (quote-based)
- Smaller integration ecosystem
Ensora Telehealth (formerly thera-LINK)
Built exclusively for therapists and counselors
Strengths
- Virtual waiting room with therapeutic tools
- Session notes and documentation built in
- File sharing during sessions
- HIPAA-compliant messaging between visits
Limitations
- Limited to behavioral health use cases
- No group session support on basic plan
- Smaller company, fewer enterprise features
Google Meet (Workspace)
Familiar interface with Google Workspace BAA
Strengths
- Included with Google Workspace (no extra cost)
- BAA covers Meet, Drive, Gmail, and Calendar
- Familiar UI reduces patient training
- Strong mobile experience on Android/iOS
Limitations
- No healthcare-specific features
- Requires a paid Google Workspace plan ($7+/mo/user)
- No virtual waiting room or EHR integration
Microsoft Teams
Enterprise collaboration with healthcare add-ons
Strengths
- Included with Microsoft 365 Business/Enterprise
- BAA covers Teams, OneDrive, Outlook, SharePoint
- Epic and Cerner integration available
- DLP policies for PHI protection
Limitations
- Requires Microsoft 365 Business ($7+/mo/user)
- Patient-facing experience less intuitive
- Healthcare features require additional setup
Feature-by-Feature Comparison
A side-by-side look at the compliance and clinical features that matter most when choosing a telehealth video platform.
| Feature | Zoom | doxy.me | VSee | Ensora (thera-LINK) | Google Meet | Teams |
|---|---|---|---|---|---|---|
| BAA included | ||||||
| End-to-end encryption | ||||||
| Free tier available | ||||||
| No patient download | ||||||
| Virtual waiting room | ||||||
| EHR integration | ||||||
| Group sessions | ||||||
| Screen sharing | ||||||
| Mobile app | ||||||
| Remote patient monitoring | ||||||
| Session notes | ||||||
| Audit logging |
Legend: ✓ = Yes · – = Partial/Paid only · ✗ = No
Encryption & Security Standards
HIPAA’s Security Rule (45 CFR §164.312(e)) requires encryption of ePHI in transit. While HIPAA does not mandate a specific encryption standard, AES-256 is the widely accepted benchmark. See our HIPAA encryption requirements guide for the full technical breakdown.
Key distinction: End-to-end encryption (E2EE) means only the participants can decrypt the video stream. Without E2EE, the platform provider can technically access the unencrypted data, even if it is encrypted in transit.
| Platform | In Transit | At Rest | E2EE | Certifications |
|---|---|---|---|---|
| Zoom for Healthcare | AES-256 GCM + TLS 1.2 | AES-256 | SOC 2 Type II, HITRUST | |
| doxy.me | AES-256 + DTLS-SRTP | AES-256 | SOC 2 Type II | |
| VSee | AES-256 + TLS 1.2 | AES-256 | SOC 2 Type II, HITRUST | |
| Ensora Telehealth (formerly thera-LINK) | AES-256 + TLS 1.2 | AES-256 | SOC 2 Type II | |
| Google Meet | TLS 1.2+ | AES-256 (Google infra) | No | SOC 2, ISO 27001, FedRAMP |
| Microsoft Teams | TLS 1.2+ | BitLocker (Azure) | No | SOC 2, ISO 27001, HITRUST, FedRAMP |
Pricing Comparison
Telehealth platform costs vary widely. Some charge per provider while others charge per user. Make sure your Business Associate Agreement is in place regardless of the plan you choose.
| Platform | Free Tier | Starting Price | BAA Included | Note |
|---|---|---|---|---|
| Zoom for Healthcare | None | Custom quote | Healthcare plans | Pricing not published; contact sales |
| doxy.me | Unlimited 1:1 visits | Request quote | Premium plan | Free version available; single Premium tier |
| VSee | Basic video calls | Custom quote | All plans (incl. free) | Contact sales for clinic pricing |
| Ensora Telehealth (formerly thera-LINK) | None | Request demo | Contact vendor | Rebranded under Ensora Health |
| Google Meet | None with BAA | $7/mo/user | Paid Workspace plans | Workspace Business Starter+ (annual billing) |
| Microsoft Teams | None with BAA | $7/mo/user | Business/Enterprise | Microsoft 365 Business Basic+ (annual billing) |
Last verified: 2026-08-24. Zoom, doxy.me, VSee, and Ensora do not publish list pricing — request a quote for current rates. Enterprise plans typically offer volume discounts.
Best Platform by Practice Type
There is no single “best” telehealth platform. The right choice depends on your specialty, budget, and existing tech stack. Before you commit, verify the vendor will sign a Business Associate Agreement and run through the HIPAA compliance checklist for your video platform configuration.
Multi-Provider Clinic
Zoom for Healthcare
EHR integration, group sessions, and admin controls for managing multiple providers under one account.
Therapists & Counselors
Ensora Telehealth (formerly thera-LINK)
Built-in session notes, therapeutic waiting room tools, and HIPAA-compliant messaging between visits.
Solo Practice (Budget)
doxy.me (Free)
Unlimited 1:1 visits at no cost, BAA included, no patient download required. Start seeing patients today.
Rural / Low-Bandwidth
VSee
Optimized for poor internet connections. Includes remote patient monitoring for chronic care management.
Enterprise / Hospital
Microsoft Teams
DLP policies, compliance center, and deep integration with existing Microsoft 365 infrastructure.
Already on Google Workspace
Google Meet
No additional cost if you already pay for Workspace Business+. BAA covers Meet, Drive, Gmail, and Calendar.
HIPAA Video Conferencing Requirements
Choosing a platform that claims HIPAA compliance is not enough. You must configure it correctly and maintain documentation. Use our risk assessment template to evaluate your telehealth setup and document compliance per 45 CFR §164.312.
Signed BAA on file
CriticalA Business Associate Agreement must be executed before any PHI is transmitted. No BAA means no HIPAA compliance, regardless of encryption.
End-to-end encryption (AES-256)
CriticalVideo and audio streams must be encrypted in transit and at rest. Look for AES-256 encryption and TLS 1.2+ transport security.
Access controls and authentication
RequiredWaiting rooms, meeting passwords, and host-only controls prevent unauthorized access. Enable MFA for provider accounts.
Disable non-compliant features
RequiredCloud recording, live transcription, and AI features may store PHI on third-party servers. Disable them unless covered by the BAA.
Audit logging enabled
RequiredHIPAA requires logging of access to ePHI. Ensure your platform records session times, participants, and access events.
Quick Reference Card
| If You Need | Our Pick | Starting At |
|---|---|---|
| Best overall | Zoom for Healthcare | Custom |
| Best free | doxy.me | Free |
| Best for therapists | Ensora Telehealth | Custom |
| Best low-bandwidth | VSee | Custom |
| Best for enterprises | Microsoft Teams | $7+/mo/user |
| Best if on Google | Google Meet | $7+/mo/user |
Whichever platform you choose, complete a risk assessment documenting your telehealth security controls, and keep a signed BAA on file for every vendor that handles PHI.
Related Tools & Guides
Is Zoom HIPAA Compliant?
How to configure Zoom for HIPAA-compliant telehealth visits.
Is Microsoft Teams HIPAA Compliant?
Configuration steps for using Teams in healthcare settings.
Best HIPAA-Compliant Email Providers
Side-by-side comparison of Paubox, Virtru, Hushmail, and more.
Best HIPAA-Compliant Messaging Apps
TigerConnect, OhMD, Spruce Health, and Klara compared.
BAA Template Generator
Generate a customized Business Associate Agreement for your vendors.
Best HIPAA Compliant Scheduling Software
SimplePractice, Jane, NexHealth, Weave, and Acuity compared, plus the truth about Calendly.
Best HIPAA Compliant Phone Systems
RingCentral, 8x8, Dialpad, Nextiva, GoTo, Weave, and Google Voice compared.
Is FaceTime HIPAA Compliant?
No Apple BAA and the 2023 end of OCR's telehealth safe harbor. iMessage covered too.
Secure Video Hosting for Medical Training
Recorded training video is a different buy: run the PHI test, then pick BAA or DRM.