What makes a video tool compliant, which platforms therapists actually use, and how to pick the right fit for your practice.
A video platform is HIPAA-compliant for teletherapy only if the vendor signs a business associate agreement, or BAA, and the tool uses strong security. Consumer apps like personal FaceTime or free Zoom do not qualify, while options such as Doxy.me, Zoom for Healthcare, Google Workspace with Meet, and EHR-based telehealth do.
Choosing the right platform protects your clients and your practice, and it does not have to be complicated once you know the one rule that decides it. This guide explains what makes a video tool compliant, which options therapists actually use, and how to pick the right fit.
A secure video platform is one part of running a virtual practice, which we cover more broadly in our guide to how to start a private therapy practice. At Mental Health IT Solutions, we help therapists set up and grow HIPAA-conscious practices.
This article is general education for mental health professionals and is not legal advice. Vendor plans and BAA availability change, so confirm current terms directly with each provider, and remember that signing a BAA does not by itself make your practice compliant. Base your safeguards on a documented risk analysis and confirm your obligations with a qualified professional.
What makes a video platform HIPAA-compliant?
A video platform is HIPAA-compliant when the vendor signs a business associate agreement and the tool provides the safeguards HIPAA requires, such as encryption and access controls.
The BAA is the non-negotiable piece. Any vendor that handles protected health information on your behalf, including your video provider, must sign one. On top of that, the platform should offer encryption in transit and at rest, access controls like waiting rooms and unique logins, and audit logging. There is no official HIPAA certification, so the real test is simply whether the vendor will sign a BAA for your plan and whether you configure the account correctly. This sits within the broader HIPAA compliance checklist for a new therapy practice.
One important nuance: a HIPAA-compliant platform enables compliance, but it does not make you automatically compliant. You still have to use it correctly, which we cover below.
Why consumer video apps are not enough
Personal FaceTime, free Zoom, consumer Skype, and similar apps are not HIPAA-compliant for therapy, because the vendors will not sign a BAA for those accounts.
It does not matter how secure or encrypted a consumer app looks. Without a signed BAA, it is not compliant for clinical use. For a few years during the public health emergency, providers could use almost any video app under a temporary enforcement waiver, but that waiver has ended, so it now applies to every session. Using a non-compliant tool puts client privacy and your practice at real risk.
HIPAA-compliant video platforms therapists use
The options below all sign a BAA on the right plan. They fall into two broad groups: telehealth-specific video tools, and practice platforms that build video into your EHR.
| Platform | What to know |
| Doxy.me | Telehealth-specific and browser-based, so clients join by link with no download. Signs a BAA, including on its free tier, which makes it a common starting point for solo therapists. |
| Zoom for Healthcare | The paid healthcare or business tier includes a BAA. The free consumer version does not, so the plan you choose is what matters. |
| SimplePractice | A mental health EHR with built-in telehealth and a BAA, so video, scheduling, notes, and billing live in one system. |
| EHR-based telehealth (TherapyNotes, TheraPlatform, Healthie) | Many practice platforms include HIPAA-compliant video with a BAA, keeping your sessions and records together. |
| Google Meet (Google Workspace) | Compliant on a Google Workspace plan that includes a BAA. The free consumer version is not. |
| Microsoft Teams (Microsoft 365) | Compliant on a qualifying business plan with a signed BAA. |
| VSee | A telehealth-specific tool known for holding up on low bandwidth, with a BAA on paid plans. |
In short, you are choosing between a standalone video tool, such as Doxy.me or Zoom for Healthcare, and your EHR’s built-in telehealth, such as SimplePractice or TherapyNotes. Many therapists prefer the all-in-one route so scheduling, notes, billing, and video live in one compliant system, while others like the simplicity of a dedicated video link. Either way, confirm the BAA before you rely on it.
How to choose the right platform for your practice
Start with the BAA, then weigh ease of use for clients, integration with your other tools, and cost.
- Confirm the vendor signs a BAA for the exact plan you will use. This is the first filter, before any feature.
- Check the security basics: encryption, a waiting room, unique logins, and multifactor authentication.
- Consider client ease of use. Browser-based tools with no download reduce friction, which matters for showing up to sessions.
- Decide between a standalone tool and EHR-integrated telehealth based on how the rest of your practice runs.
- Look at reliability and video quality, especially if your clients have limited bandwidth.
- Factor in cost, which ranges from free compliant tiers to paid healthcare plans.
- Avoid recording sessions unless you genuinely need to, since recordings add protected health information and consent obligations.
A BAA is required, but it is not the whole job
Signing a BAA is necessary, but you are still responsible for using the platform in a HIPAA-compliant way.
Hold sessions in a private space on a secure device and network, get telehealth-specific consent from clients, keep session links out of unsecured email, and store any recordings only in encrypted, BAA-covered storage. These habits, along with the rest of your setup, are what actually keep you compliant. For the full picture, work through our HIPAA compliance checklist for a new therapy practice.
Get clients into your virtual sessions
A compliant platform lets you deliver teletherapy safely. Filling those sessions is a separate job.
Your video tool does not bring you clients; your online presence does. To fill a virtual calendar, you need a website that makes booking easy and the visibility to be found. A well-designed therapist website and strong SEO for therapists help the right clients find you, and if you see clients in more than one state, make sure you are licensed where they are located.
Fill your virtual calendar
We build fast, conversion-focused websites for therapists that turn visitors into booked teletherapy sessions. Explore website design and development
A secure platform and a steady stream of clients are what make a teletherapy practice work.
Get found by teletherapy clients
Our mental health SEO services help your practice rank on Google and in AI search, so new inquiries keep coming in. See our mental health SEO services
Frequently asked questions
Is Zoom HIPAA compliant for therapy?
Only with a BAA. Zoom offers a healthcare or business plan that includes a BAA and can be compliant once configured correctly. The free consumer version does not include a BAA and is not compliant for sessions.
Is FaceTime HIPAA compliant?
No. Apple does not sign a BAA for FaceTime, so it is not HIPAA-compliant for therapy, even though calls are encrypted. Use a platform whose vendor will sign a BAA.
Is Doxy.me HIPAA compliant?
Yes. Doxy.me signs a BAA, including on its free tier, and clients join through a browser link with no download. That combination makes it a popular starting point for solo therapists.
Does a HIPAA-compliant platform make my practice compliant?
No. A compliant platform enables compliance, but you are still responsible for using it correctly, from private session spaces to telehealth consent. The platform is one piece of your overall HIPAA compliance.
Do I need a BAA for my video platform?
Yes. Any tool that handles protected health information on your behalf, including your video platform, requires a signed BAA before you use it for sessions.
Is Google Meet HIPAA compliant?
It can be, on a Google Workspace plan that includes a BAA. The free consumer version of Google Meet does not include a BAA and is not compliant for therapy.
Can I record teletherapy sessions?
Generally, avoid it. Recordings create additional protected health information and consent obligations, and they must be stored in encrypted, BAA-covered storage. Only record when you have a clear need and proper client consent.
Choose the platform, then build the practice
A HIPAA-compliant video platform for teletherapy comes down to one rule: the vendor signs a BAA and you use the tool correctly. Pick an option that fits how your practice runs, whether that is a simple video link like Doxy.me or an all-in-one EHR with built-in telehealth, and confirm the agreement before your first session. With a compliant platform in place, you can focus on filling your calendar and growing.
Ready to grow your teletherapy practice?
Mental Health IT Solutions helps therapists build and market HIPAA-conscious practices, from websites to SEO. Let us help you fill your sessions. Contact our team for a free consultation