Is Doxy.me HIPAA compliant?
Yes, doxy.me gives every user a free agreement you generate yourself in account settings, but the version on individual accounts names one provider, so a practice with two or more clinicians needs the clinic version instead.
Applies to Doxy.me telemedicine. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Generate the agreement before your first patient visit: Account Settings → BAA tab → enter your information → Generate → download a copy. Doxy.me also keeps a copy in the account.
- Solo providers use the individual agreement as generated: doxy.me states it is meant for individual providers only.
- If more than one provider from your organization uses doxy.me, contact them about being covered under a clinic agreement instead.
- Organizations wanting a tailored document use the Premium plan, which lists a custom agreement among its features.
- On clinic accounts, only account admins can generate the agreement.
- To change practice details later, delete the existing agreement, update your information, then generate a replacement.
- Document the visit in your own chart. Doxy.me states sessions are never recorded or stored, and transferred files are permanently deleted after 15 minutes.
Does Doxy.me sign a business associate agreement?
Yes. Doxy.me offers one. All plans, including the free tier. The individual version covers solo providers; multi-provider organizations need a clinic agreement, and Premium includes a custom one. Self-serve: Account Settings → BAA tab → enter your information → Generate → download. For a clinic agreement covering several providers, contact doxy.me support.
What this means in practice
Doxy.me is unusual among telehealth vendors: the agreement is free and self-serve on every tier, including the no-cost plan. You generate it yourself from account settings, fill in your practice details, and download a copy that doxy.me also stores in the account. There is no sales call and nothing to negotiate.
The catch is who the agreement names. The version available on individual accounts is written for a single provider. If two or more clinicians in your organization use doxy.me, that document does not cover the organization, and doxy.me directs you to a clinic agreement instead: the Premium plan bundles a custom version aimed at legal and procurement review.
Doxy.me's design does some of the work for you. Sessions run in real time and are not recorded or stored, and files shared during a call are permanently deleted after fifteen minutes. That keeps very little patient information sitting in the vendor's systems, but it also means anything you need for the record has to be written into your own chart during or after the visit.
How organizations get this wrong
- Assuming the individual agreement covers the whole practice. Two clinicians on one doxy.me organization need the clinic version.
- Expecting doxy.me to hold a record of the visit. Sessions are never recorded and transferred files vanish after fifteen minutes.
- Changing practice name or address without regenerating the agreement: you must delete the old document first, then generate a fresh one.
- Adding Dokbot intake forms and assuming the main doxy.me agreement stretches to cover them; Dokbot has its own separate process.
What the agreement does not cover
- Multi-provider organizations relying on the individual agreement: doxy.me directs these to a clinic agreement.
- Doxy.me publishes no feature-level covered-services list, so newer additions are not separately confirmed as in scope.
- Dokbot, doxy.me's patient intake product, which has its own separate agreement process.
Alternatives
Bundles telehealth into a full record system under an agreement accepted at signup
Clinic-grade telehealth where the agreement is requested from a dedicated address
Keep a record of your Doxy.me agreement
Sources
- BAA: how do I get a BAA with doxy.me?: Doxy.me. Read July 29, 2026.
- How do I know if I need a BAA?: Doxy.me. Read July 29, 2026.
- Security you can trust from doxy.me: Doxy.me. Read July 29, 2026.
Doxy.me can change these terms at any time. If something here no longer matches what Doxy.me tells you, tell us.