CompyMax
Sign inStart free trial

HIPAA compliant telehealth platforms

Purpose-built virtual visit software. Because these are sold to healthcare specifically, the question shifts from whether an agreement exists to which plan tier includes it and what sits outside it.

Because these products are sold to healthcare specifically, the question shifts. It is rarely whether an agreement exists — it usually does, sometimes free and self-serve on every tier — and almost always which document you are covered by and what sits outside it.

The distinction that catches practices is who the agreement names. Several vendors issue a version written for a single provider, which does not cover an organization where two or more clinicians use the product. Getting the right document usually means asking for a clinic or organization version rather than generating the individual one, and on some platforms only an account administrator can do it. Where a vendor sells both a consumer messaging app and a clinical product under one brand, the consumer app is generally the excluded one.

Also work out what the platform deliberately does not keep. Some are built so sessions are never recorded and shared files are deleted within minutes, which is good for exposure but means anything you need for the record has to be written into your own chart at the time. Newer AI features — note takers, transcription, summaries — frequently sit under a separate addendum rather than the main agreement, and recording brings state consent law into play whatever the vendor's terms say.

Can be used with patient information

Each of these requires a signed agreement and, usually, specific settings. Open an entry for the exact conditions.

Doxy.me

Conditional

Yes — doxy.me gives every user a free agreement you generate yourself in account settings, but the version on individual accounts names one provider, so a practice with two or more clinicians needs the clinic version instead.

SimplePractice

Yes

Yes — you agreed to SimplePractice's business associate agreement when you started your trial, it covers every feature including telehealth on all plans, and you never sign it again.

VSee

Conditional

Yes for VSee Clinic once you email their compliance address and get the agreement signed — but the free VSee Messenger app is excluded, and VSee's own pages disagree about whether the free Clinic tier needs a paid subscription first.

What to check before you adopt one

  • Check who the agreement names. An individual-provider document does not cover a multi-clinician organization, and the fix is a clinic or organization version rather than a second individual one.
  • Confirm which product in the vendor's range you are buying, since a consumer messaging app and a clinical telehealth product often share a brand while only the clinical one is in scope.
  • Resolve any contradiction in the vendor's own material in writing before you build on a free tier. Pricing pages and dedicated compliance pages sometimes attach different plan conditions to the same agreement.
  • Ask whether AI note-taking, transcription and summary features fall under the main agreement or a separate AI addendum, and what the default is for retaining transcripts to improve those features.
  • Establish what the platform retains and for how long. Where sessions are never stored and shared files expire, your own charting has to capture anything you need to keep.
  • Check that recording, if you intend to use it, is supported — then handle consent separately, because a number of states require all-party consent and no vendor checks your state's law for you.
  • Find out whether patient intake, forms or scheduling add-ons are covered by the same document, as these are commonly separate products with their own process.
  • Ask how to update the agreement when your practice name, address or entity changes, since some platforms require deleting the old document and generating a replacement.

The expensive mistake

A second clinician joining and nobody re-reading the agreement. The practice generated an individual-provider document when it was one person, added colleagues as the service grew, and never moved to the clinic version — so the visits everyone has been running were outside the document on file. The other recurring error is turning on an AI note taker because it appears inside a covered product, when it runs under a separate addendum whose default is to retain transcripts unless you change the setting.

Tracking which of these your organization uses?

The vendor and BAA register keeps every tool that touches patient information, its agreement status and its renewal date in one place — seeded from this research. See pricing.

Information, not certification and not legal advice. Each entry reflects that vendor’s published documentation as read on the date shown on its page. Vendors change terms without notice — confirm anything you rely on directly with them.