Is Doximity HIPAA compliant?
Yes — Doximity builds its business associate agreement into the terms of service, effective the moment a clinician registers, which makes the free Dialer one of the rare covered tools a solo clinician can adopt in an afternoon.
Applies to Doximity Dialer. Last reviewed against Doximity's own documentation. Next review February 26, 2027.
Reviewed by Dr. Anita Desai, MD — Psychiatrist, solo private practice.
What you must do
- Register as a Doximity member — the agreement 'shall be effective as of the date that Provider agrees to the Doximity Terms of Service by electronically registering as a Doximity member'. There is no separate signing step for an individual clinician.
- For an organization, get the institutional version: Doximity states 'Enterprise BAAs are available to health system clients' through dialerenterprise@doximity.com — an individual member's automatic agreement covers that member, not the practice.
- Keep patient communication inside the tools Doximity identifies as appropriately secure for the purpose; the agreement is scoped to those, not to every feature.
- Handle consent yourself when using the AI features — Doximity's terms leave HIPAA authorizations with the clinician.
Does Doximity sign a business associate agreement?
Yes. Doximity offers one. None — the individual agreement is automatic on free registration; the institutional version comes with Dialer Enterprise. Individual: none needed, it executes at registration and the text is published at doximity.com/baa. Organization: email dialerenterprise@doximity.com.
What this means in practice
Doximity's Dialer solves a specific and very common problem: a clinician returning patient calls from a personal phone while showing the practice number instead. The agreement mechanics are the easiest in this catalogue — it is incorporated into the terms of service and takes effect when the clinician registers, so an individual physician, NP, PA or pharmacist is covered from day one on the free tier, with the agreement text published openly on Doximity's site.
The subtlety is who that covers. The automatic agreement runs between Doximity and the registering clinician. A practice whose clinicians each registered individually does not itself hold an agreement — organizations get the institutional version through Dialer Enterprise, which is a separate document and a sales conversation. Small practices routinely stop at the individual layer and never notice the difference until a payer questionnaire asks.
Read the de-identification clause before assuming the data story is simple: data meeting the de-identification standard falls outside the agreement and may be used, disclosed and commercialized — expressly including for training AI models. And the agreement covers the tools Doximity identifies as appropriately secure, not every feature the app ships, so new features deserve the scope question before patient use.
How organizations get this wrong
The specific mistakes we see with Doximity, not generic advice.
- Treating clinicians' individual registrations as organizational coverage, when the practice needs the separate Enterprise agreement.
- Assuming every Doximity feature is covered, when the agreement is scoped to the tools Doximity identifies as appropriately secure.
- Using the AI features without handling patient consent, which Doximity's terms leave with the clinician.
- Missing that de-identified data — expressly including for AI training — sits outside the agreement and may be commercialized.
What the agreement does not cover
- De-identified data: Doximity's agreement states data meeting the de-identification standard 'is not subject to this BA Agreement, and may be used, disclosed, and commercialized' — including for training AI models.
- Features Doximity does not identify as secure for patient communication.
- The organization, when only its clinicians' individual registrations exist — the enterprise agreement is a separate document.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
The equivalent free-with-agreement option built around a visit room rather than a call from the clinician's phone
Where the practice needs a shared team inbox and patient messaging, not just the clinician's outbound call
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Doximity, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Doximity’s own published documentation, read on the date shown.
- Doximity Business Associate Agreement — Doximity. No publication date given. Read August 30, 2026.
- Doximity Terms of Service — Doximity. Published July 20, 2026. Read August 30, 2026.
- Is Doximity HIPAA/HITECH Compliant? — Doximity. No publication date given. Read August 30, 2026.
- Our Commitment to Security — Doximity. No publication date given. Read August 30, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Doximity’s published documentation as read on August 30, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.