Is Zoom HIPAA compliant? On a paid plan, with a signed BAA.

The short answer

What Zoom says about HIPAA

Three Zoom sources matter:

• Zoom's HIPAA page. On its trust center, Zoom says it helps customers enable HIPAA-compliant programs by executing a Business Associate Agreement.
• Zoom's healthcare pricing page. The healthcare plans page says "to enable HIPAA compliance, select a paid plan and establish a BAA agreement." In October 2026 it showed Pro at $14.16 per user per month billed annually ($16.99 monthly), with Business, Business Plus and Enterprise priced on request. It also notes, correctly, that no official body certifies HIPAA compliance; HHS's Office for Civil Rights enforces it.
• Zoom's small-practice post. A 2021 Zoom blog post said small practices could accept a BAA online on a Pro plan with up to nine licenses in the US, and that larger organizations should contact sales. That's older guidance; confirm the current process with Zoom before relying on it.

So the answer is yes, with conditions: a paid plan, a BAA actually signed or accepted for your account, and settings that match your policies. A practitioner on a free account, or on a personal Pro account nobody signed a BAA for, is not covered.

Settings and features to decide on

A BAA makes Zoom eligible to handle PHI. It doesn't make every configuration safe. Questions to settle with your compliance advisor:

• Cloud recording. Do you record sessions at all? If yes, where are recordings stored, who can access them and how long are they kept?
• AI features. Zoom's AI tools can summarize meetings. Zoom's healthcare page doesn't say which AI features are available under a BAA, and third parties such as Paubox report that some may be limited. Confirm in writing before turning them on for patient sessions.
• Waiting rooms and passcodes. Make sure only the patient you expect gets into the session.
• Chat and file transfer. Files shared in meeting chat may be stored; decide whether that's allowed.
• Integrations. Each connected app, whether a scheduler, note-taker or CRM, needs its own BAA if PHI flows through it.

After the call

Where should the notes go?

For most practices, the risky part of video isn't the call itself; it's what happens afterwards. Summaries get emailed around, recordings sit in a personal cloud folder, and the follow-up lives in someone's head. Clinical notes belong in your clinical system or EHR. Non-clinical notes, such as what a prospective client asked about pricing, what a franchisee needs from HQ or what was agreed with a vendor, belong on the client or account record where the whole team can see them.

That's where JBMOnboard360 fits. It is not a telehealth platform and we don't suggest replacing Zoom for patient visits. It's a CRM with team chat, internal audio and video calls between staff, and AI meeting summaries saved to the client record, all under the Business Associate Agreement included on every plan and hosted on AWS in the United States. Read how that works on CRM with AI meeting notes.

Professional is $79 per user per month billed annually ($99 monthly). JBMOnboard360 is not an EHR, doesn't take US card payments and doesn't send SMS.