Is Doximity HIPAA compliant?
Yes, Doximity builds its business associate agreement into the terms of service, effective the moment a clinician registers, which makes the free Dialer one of the rare covered tools a solo clinician can adopt in an afternoon.
Applies to Doximity Dialer. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Register as a Doximity member: the agreement 'shall be effective as of the date that Provider agrees to the Doximity Terms of Service by electronically registering as a Doximity member'. There is no separate signing step for an individual clinician.
- For an organization, get the institutional version: Doximity states 'Enterprise BAAs are available to health system clients' through dialerenterprise@doximity.com, an individual member's automatic agreement covers that member, not the practice.
- Keep patient communication inside the tools Doximity identifies as appropriately secure for the purpose; the agreement is scoped to those, not to every feature.
- Handle consent yourself when using the AI features: Doximity's terms leave HIPAA authorizations with the clinician.
Does Doximity sign a business associate agreement?
Yes. Doximity offers one. None: the individual agreement is automatic on free registration; the institutional version comes with Dialer Enterprise. Individual: none needed, it executes at registration and the text is published at doximity.com/baa. Organization: email dialerenterprise@doximity.com.
What this means in practice
Doximity's Dialer solves a specific and very common problem: a clinician returning patient calls from a personal phone while showing the practice number instead. The agreement mechanics are the easiest in this catalogue: it is incorporated into the terms of service and takes effect when the clinician registers, so an individual physician, NP, PA or pharmacist is covered from day one on the free tier, with the agreement text published openly on Doximity's site.
The subtlety is who that covers. The automatic agreement runs between Doximity and the registering clinician. A practice whose clinicians each registered individually does not itself hold an agreement: organizations get the institutional version through Dialer Enterprise, which is a separate document and a sales conversation. Small practices routinely stop at the individual layer and never notice the difference until a payer questionnaire asks.
Read the de-identification clause before assuming the data story is simple: data meeting the de-identification standard falls outside the agreement and may be used, disclosed and commercialized, expressly including for training AI models. And the agreement covers the tools Doximity identifies as appropriately secure, not every feature the app ships, so new features deserve the scope question before patient use.
How organizations get this wrong
- Treating clinicians' individual registrations as organizational coverage, when the practice needs the separate Enterprise agreement.
- Assuming every Doximity feature is covered, when the agreement is scoped to the tools Doximity identifies as appropriately secure.
- Using the AI features without handling patient consent, which Doximity's terms leave with the clinician.
- Missing that de-identified data, expressly including for AI training, sits outside the agreement and may be commercialized.
What the agreement does not cover
- De-identified data: Doximity's agreement states data meeting the de-identification standard 'is not subject to this BA Agreement, and may be used, disclosed, and commercialized', including for training AI models.
- Features Doximity does not identify as secure for patient communication.
- The organization, when only its clinicians' individual registrations exist: the enterprise agreement is a separate document.
Alternatives
The equivalent free-with-agreement option built around a visit room rather than a call from the clinician's phone
Where the practice needs a shared team inbox and patient messaging, not just the clinician's outbound call
Keep a record of your Doximity agreement
Sources
- Doximity Business Associate Agreement: Doximity. Read August 30, 2026.
- Doximity Terms of Service: Doximity. Published July 20, 2026. Read August 30, 2026.
- Is Doximity HIPAA/HITECH Compliant?: Doximity. Read August 30, 2026.
- Our Commitment to Security: Doximity. Read August 30, 2026.
Doximity can change these terms at any time. If something here no longer matches what Doximity tells you, tell us.