Is Zoom HIPAA compliant?
Yes, if you are on a paid Zoom plan and you execute Zoom's business associate agreement before using Zoom for anything involving patient information.
Applies to Zoom Workplace (Meetings, Webinars, Zoom Phone). Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Be on a paid plan. Zoom names Pro, Business, Business Plus and Enterprise as the plans it offers healthcare customers.
- New Pro purchases: select the 'United States Agreement (BAA)' option at checkout and accept the terms.
- Existing accounts: sign in to the Zoom web portal, go to Plans and Billing → Plan Management, find the 'Business Associate Agreement (US only)' section, click Enable, then Proceed.
- Business, Business Plus and Enterprise buyers must contact Zoom Sales to sign the agreement.
- Execute the agreement before any patient information is discussed, recorded or stored in Zoom.
- Zoom says no additional manual configuration is required once signed, but waiting rooms, passcodes, access control and recording retention remain your responsibility.
Does Zoom sign a business associate agreement?
Yes. Zoom offers one. Paid plans: Pro, Business, Business Plus, Enterprise. Pro can self-serve; Business and above go through Zoom Sales. Zoom web portal → Plans and Billing → Plan Management → 'Business Associate Agreement (US only)' → Enable → Proceed. New Pro purchases can choose the US Agreement (BAA) option at checkout.
What this means in practice
Zoom's position here is really a commercial one dressed up as a compliance rule. The agreement rides on a paid subscription, so a clinic running video visits from a free Basic account has nothing in place at all, however careful the clinician is at the other end of the call. On Pro you can settle it yourself in the web portal under Plans and Billing in a few minutes. On Business, Business Plus and Enterprise you have to go through Zoom Sales, which takes days rather than minutes and regularly catches out practices that have already advertised a telehealth start date.
The mistake we see most often is reading Zoom's line that no additional manual configuration is required as permission to stop thinking. It is not. Waiting rooms, passcodes, who may admit whom, and how long recordings sit in the cloud all stay with you.
Doing this properly is unglamorous. One named person owns the Zoom account, the agreement is enabled before the first patient is booked, and someone reviews recording retention on a schedule rather than discovering years of stored consultations after something has already gone wrong.
How organizations get this wrong
- Running telehealth on the free Basic account because the paid seats were only ever bought for internal staff meetings and admin.
- Enabling the agreement months after recorded consultations already sit in the Zoom cloud, then assuming it covers what came before.
- Assuming a Business or Enterprise subscription is covered automatically, when those tiers require Zoom Sales to sign before anything is in place.
- Switching on Zoom's AI meeting features without asking Zoom which of them are withheld from healthcare accounts that have signed.
What the agreement does not cover
- Zoom's free Basic plan, only paid plans are listed as eligible.
- Some AI features. Zoom states certain AI features may not be available to healthcare customers with an agreement in place, without naming which.
- Canadian customers receive a Personal Health Information Annex rather than a US business associate agreement.
Alternatives
Covered by the Google Workspace agreement you accept yourself in the Admin console
In scope under Microsoft's agreement, which applies by default through the Data Protection Addendum
Keep a record of your Zoom agreement
Sources
- HIPAA Business Associate Agreement (BAA): Zoom. Read July 29, 2026.
- Health Data & HIPAA-Compliance: Zoom. Read July 29, 2026.
- Zoom HIPAA Compliance Guide (PDF): Zoom. Published August 5, 2024. Read July 29, 2026.
Zoom can change these terms at any time. If something here no longer matches what Zoom tells you, tell us.