HIPAA Compliant Telehealth Platforms: Which Sign a BAA

Doxy.me, Healthie, SimplePractice, Jane and Tebra say they sign a business associate agreement (BAA), Zoom signs one on paid plans, Google Meet and Microsoft Teams fall under Google's and Microsoft's business BAAs, and Apple's license rules out FaceTime for PHI, per each vendor's own terms in Curve's BAA Directory. That is what HHS asks for: covered providers "must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (HHS). A telehealth BAA covers the visit, not the ads that bring patients to it. Curve Compliance tracks those ads server-side, strips PHI before data reaches an ad platform and signs its own BAA on every plan.

Book a call. A telehealth BAA covers the visit. Curve Compliance covers the ad tracking around it: it keeps the ad click when a patient books, credits booked visits to the original ad click, and removes PHI before anything is sent to an ad platform. Curve's team does the setup. Book a call with Curve.

HHS's rule for telehealth technology

HHS's telehealth site puts it plainly: "All telehealth services provided by covered health care providers and health plans must comply with the HIPAA Rules." The technology vendor has to comply too, and sign a BAA (HHS). A vendor that keeps session data for you is a business associate. HHS's audio-only guidance says "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI," and its example is an app that stores PHI "(e.g., recordings, transcripts)" in the developer's cloud (HHS).

The COVID-era exception is over. HHS says its enforcement discretion notifications "will expire at 11:59 pm on May 11, 2023," with a transition period that ended August 9, 2023 (HHS). Everyday video apps now need a BAA like any other vendor. For Zoom, Google Meet and Teams side by side, see Zoom vs Google Meet vs Teams.

Which telehealth platforms sign a BAA

Each row comes from the vendor's own words, quoted in Curve's BAA Directory, with the date Curve last checked that vendor's BAA page. Each name links to its Directory entry. Rows are grouped by type, not ranked.

Platform	Type	Signs a BAA?	Plans or conditions, per the vendor	Checked	Source
Doxy.me	Video platform for healthcare professionals	Yes	All users get a BAA; individual accounts are for individual providers, and groups ask about a Clinic BAA	Sep 29, 2026	Doxy.me Help
Healthie	Practice platform with telehealth	Yes	Entered into when your Healthie account is created	Oct 1, 2026	Healthie BAA
SimplePractice	Practice platform with telehealth	Yes	Agreed when you create your account; carries over to paid plans	Oct 1, 2026	SimplePractice Support
Jane	Practice platform with telehealth	Yes	Jane says it "can work with you to develop a BAA Agreement"	Sep 29, 2026	Jane Guide
Tebra	Practice platform with video visits	Yes	Part of Tebra's Terms of Service for customers that are covered entities	Oct 1, 2026	Tebra BAA
Doximity	Secure communication tools for clinicians, such as Doximity Dialer	Yes	PHI sent through tools Doximity identifies as appropriately secure is handled under the BAA in its Terms of Service	Oct 26, 2026	Doximity Privacy Policy
Zoom	Video meetings	On paid plans	Pro, Business, Business Plus, Enterprise and other paid plans	Sep 29, 2026	Zoom Support
Google Meet	Video meetings, part of Google Workspace	On Google Workspace	Workspace accounts, after an administrator accepts Google's BAA	Oct 5, 2026	Google Workspace Help
Microsoft Teams	Video meetings and chat, part of Office 365	On business plans	Office 365 Commercial or GCC; the BAA comes by default through Microsoft's Data Protection Addendum	Oct 5, 2026	Microsoft Learn
FaceTime	Apple system service	No	Apple's iOS and iPadOS license bars covered entities and business associates from using it with PHI	Oct 5, 2026	Apple license

Some BAAs leave features out. Zoom says "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place," and Google says "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA" (Zoom; Google Meet).

Video tools vs full telehealth platforms

Zoom, Google Meet and Microsoft Teams are meeting tools that fall under a business BAA, and each vendor leaves compliant use to you. Zoom says "Zoom's customers are responsible for ensuring their use of Zoom's services aligns with their obligations under HIPAA or other applicable laws" (Zoom), and Microsoft says "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft Teams). Scheduling, intake and notes then live in other tools, each needing its own BAA.

Telehealth platforms build the visit into the practice system. Doxy.me describes itself as a video platform "solely for healthcare professionals" (Doxy.me). SimplePractice says you can "launch sessions directly from your calendar" (SimplePractice), Jane connects each session to "your schedule, charting, and billing" (Jane), and Tebra lists "virtual waiting rooms" among its telehealth features (Tebra). Healthie lists Telehealth & Webinars next to Scheduling and Patient Portal (Healthie). When video runs inside the practice platform, confirm that the platform's BAA covers its telehealth feature. For the practice software side, see HIPAA compliant practice management software.

Audio-only telehealth and BAAs

Phone visits follow their own rules. HHS says "The HIPAA Security Rule does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line, often described as a traditional landline, because the information transmitted is not electronic." Most calls no longer run that way: "traditional landlines are rapidly being replaced with electronic communication technologies such as Voice over Internet Protocol (VoIP)," and "The HIPAA Security Rule applies when a covered entity uses such electronic communication technologies" (HHS).

On BAAs, HHS says "The HIPAA Rules require a covered entity to enter into a business associate agreement (BAA) with a telecommunication service provider (TSP) only when the vendor is acting as a business associate." A provider using a telephone "is not required to enter into a BAA with a TSP that has only transient access to the PHI it transmits," while an app that stores recordings or transcripts needs one (HHS). For phone tools, see HIPAA compliant phone systems.

Measuring telehealth ad conversions without PHI

HHS names "a telehealth platform" among the logged-in pages where "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI" (HHS). So the visit itself is no place for an ad pixel. Measure the steps around it instead:

• Keep ad tags off the session, waiting room and portal. See ad tracking boundaries for telehealth video tools.
• Count the booked visit, not the session. Send a neutral event server-side when the visit is booked or completed, with no visit reason, time or provider.
• Keep the ad click through scheduling. Store it when the visitor lands, so a booking made later still matches.
• Send only the fields each platform needs. See the minimum necessary rule for ad tracking. Which events fit your setup is a legal question, so talk to your counsel.

How Curve Compliance helps

Curve Compliance handles the ad side of a telehealth practice under the BAA it signs on every plan. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. When a patient leaves to book, Curve keeps the ad click through schedulers such as IntakeQ, Calendly, Acuity and Jane App, and bookings made days later still match. Healthie outcomes reach Curve through Keragon; see Curve and Healthie. Curve Forms adds HIPAA-hosted intake and lead forms with ad attribution attached.

Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. See Curve for telehealth.

Sources, checked October 26, 2026: HHS, HIPAA Rules for telehealth technology; HHS, audio-only telehealth guidance; HHS, HIPAA and Telehealth; HHS, Use of Online Tracking Technologies; Zoom, HIPAA Business Associate Agreement; Doxy.me, BAA; SimplePractice; Jane; Tebra; Healthie; Google, HIPAA compliance on Google Cloud and Google Workspace; vendor BAA pages as linked in the table, via Curve's BAA Directory.

Frequently Asked Questions

Which telehealth platforms are HIPAA compliant?

No platform is compliant by itself, but Doxy.me, Healthie, SimplePractice, Jane and Tebra say they sign a BAA, Zoom signs one on paid plans, and Google Meet and Microsoft Teams fall under Google's and Microsoft's business BAAs (BAA Directory). HHS says providers must use telehealth vendors that comply with the HIPAA Rules and will sign a BAA (HHS).

Is Google Meets HIPAA compliant for telehealth?

Google Meet can be, inside Google Workspace. Google lists Google Meet among the Workspace services included in its BAA, and says "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (Google; Google; Directory entry).

Is FaceTime HIPAA compliant for telehealth?

No. Apple's iOS and iPadOS license, which covers FaceTime, says a HIPAA covered entity or business associate "will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information" (Apple; Directory entry). HHS's COVID-era flexibility for such apps ended in 2023 (HHS).

Is there a version of Zoom that is HIPAA compliant?

Yes: Zoom's paid plans, once a BAA is in place. Zoom says it offers Pro, Business, Business Plus and Enterprise plans to healthcare customers and enters into BAAs with customers on its other paid plans too (Zoom; Directory entry).

Can Zoom be HIPAA compliant?

Yes, with a signed BAA and your own setup. Zoom says it "enters into business associate agreements (BAAs) with customers, including those in the higher education and healthcare industries" (Zoom). For setup, see is Zoom HIPAA compliant.

Is Doxy better than Zoom?

Both offer a BAA, so the choice comes down to fit. Doxy.me says all its users get a BAA and describes itself as a video platform "solely for healthcare professionals" with no downloads, while Zoom offers healthcare customers its Pro, Business, Business Plus and Enterprise plans with a BAA (Doxy.me; Doxy.me; Zoom). Sign the BAA before the first visit either way.

Does a telehealth platform BAA cover my ads?

No. It covers the vendor's own service, not the pixels on your booking pages or what your ad platforms receive. Curve's BAA Directory lists Meta and Google Ads as not signing a BAA; see which ad platforms sign a BAA.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, sends booked-visit conversions to your ad platforms server-side, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Your telehealth platform runs the visit. Curve Compliance credits the booked visits to the ads that drove them, with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.