Is Zoom HIPAA compliant?
Yes, if you are on a paid Zoom plan and you execute Zoom's business associate agreement before using Zoom for anything involving patient information.
Applies to Zoom Workplace (Meetings, Webinars, Zoom Phone). Last reviewed against Zoom's own documentation. Next review November 26, 2026.
Reviewed by Carlos Mendez — IT Security Manager, regional healthcare network.
What you must do
- Be on a paid plan. Zoom names Pro, Business, Business Plus and Enterprise as the plans it offers healthcare customers.
- New Pro purchases: select the 'United States Agreement (BAA)' option at checkout and accept the terms.
- Existing accounts: sign in to the Zoom web portal, go to Plans and Billing → Plan Management, find the 'Business Associate Agreement (US only)' section, click Enable, then Proceed.
- Business, Business Plus and Enterprise buyers must contact Zoom Sales to sign the agreement.
- Execute the agreement before any patient information is discussed, recorded or stored in Zoom.
- Zoom says no additional manual configuration is required once signed, but waiting rooms, passcodes, access control and recording retention remain your responsibility.
Does Zoom sign a business associate agreement?
Yes. Zoom offers one. Paid plans — Pro, Business, Business Plus, Enterprise. Pro can self-serve; Business and above go through Zoom Sales. Zoom web portal → Plans and Billing → Plan Management → 'Business Associate Agreement (US only)' → Enable → Proceed. New Pro purchases can choose the US Agreement (BAA) option at checkout.
What this means in practice
Zoom's position here is really a commercial one dressed up as a compliance rule. The agreement rides on a paid subscription, so a clinic running video visits from a free Basic account has nothing in place at all, however careful the clinician is at the other end of the call. On Pro you can settle it yourself in the web portal under Plans and Billing in a few minutes. On Business, Business Plus and Enterprise you have to go through Zoom Sales, which takes days rather than minutes and regularly catches out practices that have already advertised a telehealth start date.
The mistake we see most often is reading Zoom's line that no additional manual configuration is required as permission to stop thinking. It is not. Waiting rooms, passcodes, who may admit whom, and how long recordings sit in the cloud all stay with you.
Doing this properly is unglamorous. One named person owns the Zoom account, the agreement is enabled before the first patient is booked, and someone reviews recording retention on a schedule rather than discovering years of stored consultations after something has already gone wrong.
How organizations get this wrong
The specific mistakes we see with Zoom, not generic advice.
- Running telehealth on the free Basic account because the paid seats were only ever bought for internal staff meetings and admin.
- Enabling the agreement months after recorded consultations already sit in the Zoom cloud, then assuming it covers what came before.
- Assuming a Business or Enterprise subscription is covered automatically, when those tiers require Zoom Sales to sign before anything is in place.
- Switching on Zoom's AI meeting features without asking Zoom which of them are withheld from healthcare accounts that have signed.
What the agreement does not cover
- Zoom's free Basic plan — only paid plans are listed as eligible.
- Some AI features. Zoom states certain AI features may not be available to healthcare customers with an agreement in place, without naming which.
- Canadian customers receive a Personal Health Information Annex rather than a US business associate agreement.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Covered by the Google Workspace agreement you accept yourself in the Admin console
In scope under Microsoft's agreement, which applies by default through the Data Protection Addendum
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Zoom, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Zoom’s own published documentation, read on the date shown.
- HIPAA Business Associate Agreement (BAA) — Zoom. No publication date given. Read July 29, 2026.
- Health Data & HIPAA-Compliance — Zoom. No publication date given. Read July 29, 2026.
- Zoom HIPAA Compliance Guide (PDF) — Zoom. Published August 5, 2024. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Zoom’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.