Is Doxy.me HIPAA compliant?
Yes — doxy.me gives every user a free agreement you generate yourself in account settings, but the version on individual accounts names one provider, so a practice with two or more clinicians needs the clinic version instead.
Applies to Doxy.me telemedicine. Last reviewed against Doxy.me's own documentation. Next review December 28, 2026.
Reviewed by Dr. Anita Desai, MD — Psychiatrist, solo private practice.
What you must do
- Generate the agreement before your first patient visit: Account Settings → BAA tab → enter your information → Generate → download a copy. Doxy.me also keeps a copy in the account.
- Solo providers use the individual agreement as generated — doxy.me states it is meant for individual providers only.
- If more than one provider from your organization uses doxy.me, contact them about being covered under a clinic agreement instead.
- Organizations wanting a tailored document use the Premium plan, which lists a custom agreement among its features.
- On clinic accounts, only account admins can generate the agreement.
- To change practice details later, delete the existing agreement, update your information, then generate a replacement.
- Document the visit in your own chart. Doxy.me states sessions are never recorded or stored, and transferred files are permanently deleted after 15 minutes.
Does Doxy.me sign a business associate agreement?
Yes. Doxy.me offers one. All plans, including the free tier. The individual version covers solo providers; multi-provider organizations need a clinic agreement, and Premium includes a custom one. Self-serve: Account Settings → BAA tab → enter your information → Generate → download. For a clinic agreement covering several providers, contact doxy.me support.
What this means in practice
Doxy.me is unusual among telehealth vendors: the agreement is free and self-serve on every tier, including the no-cost plan. You generate it yourself from account settings, fill in your practice details, and download a copy that doxy.me also stores in the account. There is no sales call and nothing to negotiate.
The catch is who the agreement names. The version available on individual accounts is written for a single provider. If two or more clinicians in your organization use doxy.me, that document does not cover the organization, and doxy.me directs you to a clinic agreement instead — the Premium plan bundles a custom version aimed at legal and procurement review.
Doxy.me's design does some of the work for you. Sessions run in real time and are not recorded or stored, and files shared during a call are permanently deleted after fifteen minutes. That keeps very little patient information sitting in the vendor's systems, but it also means anything you need for the record has to be written into your own chart during or after the visit.
How organizations get this wrong
The specific mistakes we see with Doxy.me, not generic advice.
- Assuming the individual agreement covers the whole practice. Two clinicians on one doxy.me organization need the clinic version.
- Expecting doxy.me to hold a record of the visit. Sessions are never recorded and transferred files vanish after fifteen minutes.
- Changing practice name or address without regenerating the agreement — you must delete the old document first, then generate a fresh one.
- Adding Dokbot intake forms and assuming the main doxy.me agreement stretches to cover them; Dokbot has its own separate process.
What the agreement does not cover
- Multi-provider organizations relying on the individual agreement — doxy.me directs these to a clinic agreement.
- Doxy.me publishes no feature-level covered-services list, so newer additions are not separately confirmed as in scope.
- Dokbot, doxy.me's patient intake product, which has its own separate agreement process.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Bundles telehealth into a full record system under an agreement accepted at signup
Clinic-grade telehealth where the agreement is requested from a dedicated address
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Doxy.me, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Doxy.me’s own published documentation, read on the date shown.
- BAA: how do I get a BAA with doxy.me? — Doxy.me. No publication date given. Read July 29, 2026.
- How do I know if I need a BAA? — Doxy.me. No publication date given. Read July 29, 2026.
- Security you can trust from doxy.me — Doxy.me. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Doxy.me’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.