Is Zoom HIPAA compliant? What Zoom's healthcare pages say, as of 9 October 2026

Zoom does not describe itself as making a practice HIPAA compliant. As of 9 October 2026, Zoom's healthcare page states that Zoom for Healthcare "helps enable customers' HIPAA compliance by executing a Business Associate Agreement (BAA)." The same page says the platform offers security features, encryption and administrative controls designed to protect patient health information and "support customers in meeting healthcare regulatory requirements" ^[1]. That wording describes support for the customer's compliance. The page does not state that using Zoom by itself makes a customer compliant ^[1]. The plan-by-plan part of the question cannot be answered from Zoom's own pages as fetched. Zoom's healthcare pricing page, retrieved the same day, returned site navigation and contact details but no plan names, prices or terms ^[2].

Terms used in this guide

The SmartMeet BAA refers to "the HIPAA Rules at 45 C.F.R. Parts 160 and 164" and takes the meaning of its undefined terms from them ^[3].

In the SmartMeet BAA, the subscriber accepting the agreement is the "Covered Entity" and SmartMeet is the "Business Associate." That agreement defines protected health information (PHI) as the health information SmartMeet creates, receives, maintains or transmits on the subscriber's behalf through the service ^[3]. Zoom's healthcare page uses the abbreviation PHI and expands it as "patient health information" ^[1].

In the SmartMeet version, the business associate agreement sets out the vendor's duties toward that information, including the following ^[3]:

• Use and disclose PHI only to provide the service, as required by law, or for its own proper management and administration ^[3].
• Apply administrative, physical and technical safeguards to electronic PHI ^[3].
• Report security incidents and breaches ^[3].
• Bind its subcontractors in writing to the same restrictions and conditions ^[3].
• Return or destroy PHI when the agreement ends ^[3].

What Zoom's healthcare page says, as of 9 October 2026

The statements below come from Zoom's own healthcare page, retrieved on 9 October 2026, and are reported as Zoom's claims ^[1]:

• Zoom for Healthcare executes a BAA with customers to help enable their HIPAA compliance ^[1].
• Under the heading "Support compliance," the page says Zoom can enable an organization to meet its obligations under SOC 2, HIPAA, GDPR, PIPEDA/PHIPA and PCI ^[1].
• Zoom for Healthcare integrates with major electronic health record (EHR) platforms, and the page cites more than 200 healthcare integrations ^[1].
• Zoom Workplace for Clinicians includes Clinical Note, which the page describes as AI note-taking that documents in-person and virtual visits and syncs the documentation into the EHR ^[1].
• The healthcare product family listed on the page includes Zoom Meetings, Zoom Phone, Zoom Contact Center, Zoom Clinical Note, Zoom Virtual Agent, Zoom Workplace, Zoom Rooms and the Zoom App Marketplace ^[1].
• Zoom Workplace for Frontline is described as connecting nurses, care teams and staff through one platform ^[1].
• A developer platform is offered for building custom healthcare experiences that integrate telehealth, EHR systems, patient portals, contact centres and scheduling ^[1].
• The page links to a resource on how Zoom supports small healthcare clinics ^[1].

The page's FAQ lists Meetings, Phone, Chat, Docs, Whiteboard and AI Companion as tools that healthcare organizations can combine with Zoom's healthcare solutions ^[1].

What the healthcare pricing page shows

Zoom's healthcare pricing page, retrieved on 9 October 2026, returned only the following in its fetched text ^[2]:

• site navigation ^[2]
• a sales phone number, 1.888.799.9666 ^[2]
• language and currency selectors ^[2]
• legal and policy links ^[2]

It listed no plans, prices, seat counts or BAA terms ^[2].

The healthcare page offers "Request a demo" and "Contact sales" links and shows no published price ^[1]. It also notes that ZoomMate AI features "may be available with eligible paid Zoom Workplace plans" and may not be available for all regions or industry verticals ^[1].

As a result, the following points are not stated on Zoom's fetched pages and would have to come from Zoom directly ^[1][2]:

• the price ^[1][2]
• which plan carries the BAA ^[1][2]
• whether the AI features apply to a particular plan, region or specialty ^[1][2]

Why compliance depends on use

Zoom's language is that it "helps enable" and "supports" customers' compliance, and the page does not say the customer's own obligations are removed ^[1].

Zoom's BAA text was not among the pages fetched for this guide. Its specific terms, and any duties it places on the customer, cannot be reported here ^[1][2].

A BAA can assign concrete duties to the customer. The SmartMeet agreement, for example, makes two such duties explicit ^[3]:

• The customer is responsible for obtaining any consent required to record a meeting ^[3].
• The customer must not place PHI in parts of the service not intended to hold it, such as meeting titles visible to guests ^[3].

Under that agreement, these two duties sit with the customer, not the vendor ^[3].

Scope matters as well. The SmartMeet agreement covers PHI handled "through the Service" ^[3]. Zoom's page describes a broad suite that includes chat, documents, whiteboards and AI tools, and its fetched pages do not state which of these products its BAA covers ^[1][2].

Where Zoom is likely the better fit

Zoom's page describes capabilities that SmartMeet's approved product facts do not list, and for some readers that makes Zoom the more suitable choice ^{[1][SmartMeet]}:

• Health systems or clinics that need visit documentation written directly into the EHR. Zoom describes Clinical Note syncing into the EHR, and SmartMeet's listed features do not include EHR integration ^{[1][SmartMeet]}.
• Organizations that want telephony, a patient contact centre or a virtual agent on the same platform as video visits; Zoom's page lists Zoom Phone, Zoom Contact Center and Zoom Virtual Agent ^[1].
• Teams with developers who plan to build custom telehealth or portal integrations on a vendor platform ^[1].
• Organizations that prefer to start with a demo and a sales conversation, which are the routes Zoom's healthcare page links to ^[1].

Where SmartMeet differs

SmartMeet by iPMS combines booking pages and video meetings in one plan. It is positioned as a replacement for Zoom and Calendly ^[SmartMeet].

The published price is $15 a month with everything included. Guests never pay, and a 7-day free trial is available. The plan includes the following ^[SmartMeet]:

• booking pages and video ^[SmartMeet]
• live captions ^[SmartMeet]
• AI meeting summaries ^[SmartMeet]
• email and text reminders ^[SmartMeet]
• no meeting time limit ^[SmartMeet]

SmartMeet checks the host's calendar to prevent double bookings, and guests can reschedule themselves. Nothing needs to be installed, and the product page states that moving from Zoom takes one tap ^[SmartMeet].

A BAA is included. Clinics and health teams accept it at signup, with no sales call and no extra plan ^[SmartMeet]. The exact text accepted is kept with the account, and the typed name, time and network address of acceptance are kept as the record of signature ^[3].

The published agreement, version 2026-10-01, states the following ^[3]:

• Meeting audio and video travel encrypted between participants; the agreement names the method as DTLS-SRTP ^[3].
• Where a relay is needed, it is operated under its own business associate agreement ^[3].
• Recordings kept in the service are stored on access-controlled servers in the United States ^[3].
• Breaches of unsecured PHI will be reported without unreasonable delay and no later than 60 calendar days after discovery ^[3].
• The customer can download and delete recordings and attendance records from its account at any time ^[3].
• The agreement ends with the subscription. PHI is then returned or destroyed, or protected for as long as it is retained where return or destruction is infeasible ^[3].

SmartMeet is not described as HIPAA compliant. It includes a BAA, and compliance also depends on how the customer uses it ^[SmartMeet].

What these sources cannot tell you

The fetched Zoom pages do not show the text of Zoom's BAA, its breach-notification timeline, how the BAA is obtained, its plan names or its prices. Any comparison on those points has to wait until Zoom supplies them directly ^[1][2].

How to decide

Each of the following questions can be checked against a vendor's own documents before the first patient session ^[1][3]:

• Does your workflow require notes written into your EHR from the visit? If so, Zoom's page describes that capability, and SmartMeet's listed features do not ^{[1][SmartMeet]}.
• Do you need phone, a contact centre or a virtual agent from the same vendor as your video visits? Zoom's page lists all three products ^[1].
• Can you obtain a signed BAA before clinical use, and through what process? Zoom's fetched pages do not describe the process ^[1][2]. SmartMeet's is accepted at signup with no sales call ^[SmartMeet].
• Which plan carries the BAA, and at what monthly cost for your number of hosts? Zoom's healthcare pricing page, as fetched, did not say ^[2]. SmartMeet lists $15 a month ^[SmartMeet].
• Which features does the BAA cover? Ask specifically about AI notes, chat, whiteboards and recordings ^[1][3].
• What breach-notification deadline does the agreement set? SmartMeet's states 60 calendar days at most ^[3].
• Where are recordings stored, and can you delete them yourself? SmartMeet's agreement answers both ^[3].
• If you choose SmartMeet, who in your team will handle recording consent and keep PHI out of meeting titles and other guest-visible fields, which its agreement assigns to the customer ^[3].
• Do you need booking pages and video in one subscription, or are those handled elsewhere already ^[SmartMeet].