Zoom vs Google Meet vs Teams: Which Sign a HIPAA BAA?

Zoom, Google Meet and Microsoft Teams all offer a HIPAA business associate agreement (BAA), but only on business accounts and only once the BAA is in place: Zoom enters into BAAs on its paid plans, Google lists Meet among the Workspace services its BAA covers, and Microsoft lists Teams as in scope for the BAA it makes available by default to covered entities and business associates (Zoom; Google; Microsoft). A video BAA covers the video service, not the pixels on your website or what your ad platforms receive. Curve Compliance covers that side: it sends booking conversions to your ad platforms server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan.

Book a call. Your video BAA covers the visit. Curve Compliance covers the ad tracking around it: it keeps the ad click when a patient books through a scheduler, credits bookings and visits to the original ad click, and removes PHI before anything is sent to an ad platform. Curve's team does the setup. Book a call with Curve.

The short answer

Each row comes from the vendor's own page, fetched October 26, 2026. Each tool name links to its BAA Directory entry.

Tool	Signs a BAA?	Plans or accounts covered	How you get it	Source
Zoom	Yes, on paid plans	Pro, Business, Business Plus and Enterprise, plus other paid plans	Pro: choose the United States BAA at checkout and accept it. Business and up: contact Zoom Sales. Existing paid plans: an admin enables it in Plans and Billing	Zoom Support
Google Meet	Yes, inside Google Workspace	Google Workspace accounts; Meet is on Google's list of covered services	An administrator reviews and accepts the BAA in the Admin console	Google Workspace Help; covered services
Microsoft Teams	Yes	Office 365 Commercial and GCC; Teams is in scope for both	Available by default through the Microsoft Online Services Data Protection Addendum to covered entity and business associate customers	Microsoft Learn

All three leave compliant use to the customer. Google, for one, says "Complying with HIPAA is a shared responsibility between you and Google" (Google). The sections below give each vendor's words.

Zoom

Zoom says it "enters into business associate agreements (BAAs) with customers, including those in the higher education and healthcare industries." It names the plans: "Zoom offers Pro, Business, Business Plus, and Enterprise plans to customers in the healthcare space. Zoom also enters into BAAs with customers who are subscribed to other paid plans" (Zoom).

On Pro, you select "United States Agreement (BAA)" in the country menu at checkout and accept the agreement. For Business, Business Plus or Enterprise, Zoom says to "contact Sales to sign a BAA with Zoom." On a paid plan you already have, an admin goes to Plans and Billing and enables "Business Associate Agreement (US only)." After that, Zoom says "no additional manual configuration is required" (Zoom).

Two details matter for clinics. Zoom says AI features "are available to customers with BAAs in place with Zoom," though "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place." It also says "Zoom's customers are responsible for ensuring their use of Zoom's services aligns with their obligations under HIPAA" (Zoom). Zoom's page describes BAAs on paid plans and none for a free account. For setup detail, see is Zoom HIPAA compliant.

Google Meet

Google's own list settles it. Under "Google Workspace supported services," Google says "The following Google Workspace services are included in the Google Cloud BAA" and lists Google Meet, alongside Gmail, Google Calendar and Google Drive (Google). Customers who want to use those services with PHI "must enter a Business Associate Amendment (BAA) with Google," and "Administrators must review and accept a BAA before using PHI in Google services." Until then, "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (Google).

Add-ons sit outside it: "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA" (Google). Google's pages describe the BAA for Workspace and Cloud Identity customers and none for a personal Google account. See the Google Meet and Google Workspace entries.

Microsoft Teams

Microsoft's in-scope table lists Microsoft Teams for both Office 365 Commercial and GCC (Government Community Cloud) subscriptions. Its BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." Microsoft also says it "can't use a customer's Business Associate Agreement," so the BAA is Microsoft's own (Microsoft).

Microsoft is clear about limits: "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft). The page describes the BAA for those Office 365 subscriptions and none for a personal Microsoft account. See the Microsoft Teams and Microsoft 365 entries.

Free accounts and the end of the COVID exception

During the COVID-19 public health emergency, HHS did not penalize providers for the "good faith provision of telehealth" on non-public facing tools. HHS says those notifications expired "at 11:59 pm on May 11, 2023," and the transition period that followed "will expire at 11:59 p.m. on August 9, 2023" (HHS). The usual rules apply again.

HHS's audio-only telehealth guidance states the rule: "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI." Its example is an app that stores PHI "(e.g., recordings, transcripts)" in the developer's cloud (HHS). None of the three vendor pages above describes a BAA for a free or personal account, so run video visits on a covered business account with the BAA in place.

What a video BAA does not cover

Each BAA covers that vendor's own service. It does not reach:

• Your website pixels. A pixel sends data from the visitor's browser to the ad platform, which is not a party to your video BAA. Curve's BAA Directory lists Meta and Google Ads as not signing one; see which ad platforms sign a BAA.
• The session page. The waiting room and video page should carry no ad tracking at all; see ad tracking boundaries for telehealth video tools.
• Your scheduler and forms. The tool that books the visit needs its own BAA; see HIPAA compliant scheduling software.
• Add-ons. Google excludes third-party add-ons from its BAA, so check note-taking and scheduling add-ons on their own.

Tracking telehealth bookings without PHI

For a telehealth brand, the conversion that matters is the booked or completed visit. It can reach your ad platforms without visit details:

• Keep pixels off clinical pages. No ad tags on the waiting room, session, portal or post-visit pages.
• Keep the ad click through the booking. Store the click on your side when the visitor lands, so the booking can be matched later.
• Report the visit server-side. Send a neutral event with no visit time, reason or provider name. See booked appointment attribution.
• Send only what each platform needs. See the minimum necessary rule for ad tracking. Which events fit your setup is a legal question, so talk to your counsel.

How Curve Compliance helps

Curve Compliance handles the ad side of a telehealth funnel under the BAA it signs on every plan. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. When a patient leaves to book, Curve keeps the ad click through schedulers such as IntakeQ, Calendly, Acuity and Jane App, and bookings made days later still match. Outcomes reach Curve from booking systems and CRMs through incoming webhooks, or as offline conversion uploads from a CRM or EHR, and Curve credits each to the original ad click. Healthie outcomes reach Curve through Keragon; see Curve and Healthie.

Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. See Curve for telehealth.

Sources, checked October 26, 2026: Zoom, HIPAA Business Associate Agreement (BAA); Google, HIPAA Compliance with Google Workspace and Cloud Identity; Google, HIPAA compliance on Google Cloud and Google Workspace; Microsoft, HIPAA and the HITECH Act; HHS, HIPAA and Telehealth; HHS, audio-only telehealth guidance.

Frequently Asked Questions

Do Zoom, Google Meet and Microsoft Teams sign a HIPAA BAA?

Yes, all three, on business accounts with the BAA in place: Zoom on its paid plans, Google Meet inside Google Workspace once an administrator accepts Google's BAA, and Microsoft Teams under the BAA Microsoft makes available by default to Office 365 Commercial and GCC customers that are covered entities or business associates (Zoom; Google; Microsoft).

Is Zoom HIPAA compliant?

Zoom can be used under HIPAA on a paid plan with a signed BAA. Zoom names Pro, Business, Business Plus and Enterprise for healthcare customers, and says customers are responsible for making sure their use of Zoom meets their HIPAA obligations (Zoom; Directory entry).

Is free Zoom HIPAA compliant?

Zoom's BAA page describes BAAs on paid plans and none for a free account, and HHS's COVID-era telehealth enforcement discretion ended in 2023 (Zoom; HHS). Use a paid plan with the BAA signed.

Is Google Meet HIPAA compliant?

It can be, inside Google Workspace. Google lists Meet among the services its BAA covers, and an administrator must accept the BAA before PHI is used (Google; Google). Google's pages describe no BAA for a personal Google account.

Is Microsoft Teams HIPAA compliant?

It can be. Microsoft lists Teams as in scope for Office 365 Commercial and GCC under the BAA it makes available by default to covered entity and business associate customers, and says using its services "doesn't on its own achieve HIPAA compliance" (Microsoft).

Can I use regular Zoom for telehealth now that the COVID rules have ended?

HHS's telehealth enforcement discretion expired May 11, 2023, with the transition period ending August 9, 2023 (HHS). HHS says a covered entity must have a BAA with a vendor that is more than a mere conduit for PHI (HHS), and Zoom offers its BAA on paid plans (Zoom).

Does a video BAA cover my booking page or ads?

No. It covers the vendor's own service, not the pixels on your booking page or what your ad platforms receive. Curve's BAA Directory lists Meta and Google Ads as not signing a BAA; see which ad platforms sign a BAA.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Your video BAA covers the visit. Curve Compliance covers the ad tracking around it, crediting booked visits to the ad that drove them with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.