Best HIPAA-Compliant Telehealth Platforms for Therapists — 2026 Teletherapy Guide
Not all video platforms are HIPAA-compliant — and the difference matters enormously for therapists. A telehealth platform that will not sign a Business Associate Agreement (BAA) is off-limits for therapy sessions, regardless of how secure it claims to be. Conducting therapy sessions on a non-BAA platform is a HIPAA violation for every session held.
Since 2023, OCR has significantly increased enforcement of telehealth-specific violations — particularly practices using consumer video platforms (standard Zoom, FaceTime, Google Meet) that were common during the COVID-19 telehealth expansion. Here is an honest assessment of the five best HIPAA-compliant teletherapy platforms for therapists in 2026, with verified BAA status for each.
HIPAA Telehealth Platforms — Quick BAA Reference
| Platform | BAA Available | Price | Best For |
|---|---|---|---|
| SimplePractice | ✓ All paid plans | From $29/mo | All-in-one EHR + telehealth |
| Doxy.me | ✓ Including free plan | Free – $50/mo | Free standalone teletherapy |
| Zoom for Healthcare | ✓ Healthcare plan only | From $200/mo | Large group practices |
| VSee | ✓ All paid plans | From $49/mo | Multi-location practices |
| Google Meet (Workspace) | ✓ Business plan only | From $12/mo | Google Workspace users |
| Standard Zoom | ✗ NO BAA | Free – $15/mo | Not suitable for therapy |
| FaceTime | ✗ NO BAA | Free | Not suitable for therapy |
| Google Meet (personal) | ✗ NO BAA | Free | Not suitable for therapy |
Common mistake: Standard Zoom is NOT HIPAA-compliant
Many therapists use regular Zoom, FaceTime, or Google Meet without realizing these platforms will not sign a HIPAA BAA. OCR has actively pursued these violations since 2023. Always verify your platform has a signed BAA.
SimplePractice
Best all-in-one: EHR + telehealth in one platform
Included with EHR ($29–$99/mo)
PROS
- ✓No separate subscription needed
- ✓BAA covered under main EHR agreement
- ✓Client waiting room
- ✓Automated session reminders
- ✓Mobile app for clients
CONS
- ✗Must pay for full SimplePractice plan
- ✗Not standalone — tied to EHR subscription
BAA STATUS
✓ Included in all paid plans
Doxy.me
Best free option — BAA included even on free plan
Free / Pro $35/mo / Clinic $50/mo
PROS
- ✓Free plan includes BAA — rare
- ✓No app download required for clients
- ✓Simple link-based sessions
- ✓Waiting room feature
- ✓Works in any browser
CONS
- ✗Free plan has limited features
- ✗No EHR integration — just video
- ✗Less polished than SimplePractice
BAA STATUS
✓ Included on all plans including free
Zoom for Healthcare
Most familiar platform — but requires paid healthcare plan
From $200/mo (Healthcare plan)
PROS
- ✓Familiar interface for clients
- ✓High reliability
- ✓BAA available on Healthcare plan
- ✓Large group sessions
CONS
- ✗Standard Zoom does NOT include a BAA
- ✗Healthcare plan is expensive
- ✗Overkill for solo therapists
- ✗Many therapists accidentally use standard Zoom
BAA STATUS
✓ Healthcare plan only — NOT standard Zoom
VSee
Best for complex multi-location group practices
From $49/mo
PROS
- ✓HIPAA-compliant BAA included
- ✓Multi-provider scheduling
- ✓Low bandwidth optimization
- ✓Good for rural/poor connection clients
CONS
- ✗Older interface
- ✗Higher price for solo use
- ✗Less intuitive than newer platforms
BAA STATUS
✓ BAA included on all paid plans
Google Meet (Workspace Business)
Only HIPAA-compliant if using Google Workspace Business
From $12/mo per user (Workspace Business)
PROS
- ✓Familiar to most clients
- ✓Integrated with Google Calendar
- ✓BAA available with Workspace Business
CONS
- ✗Standard Google Meet = NOT HIPAA compliant
- ✗Must have Business plan AND request BAA separately
- ✗Easy to accidentally use personal account
- ✗Not purpose-built for therapy
BAA STATUS
✓ Workspace Business only — NOT personal Google accounts
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
What HIPAA Actually Requires for Telehealth Sessions
HIPAA does not prohibit telehealth — it simply requires that any technology platform used to deliver telehealth services that involve PHI must sign a Business Associate Agreement. Beyond the BAA, there are four specific requirements that apply to telehealth therapy:
1. BAA with your video platform
The most critical requirement. If your video platform will not sign a BAA, you cannot use it for therapy sessions. There are no exceptions based on platform security claims or encryption levels.
2. Encryption in transit
Your video sessions must be transmitted over an encrypted connection. All platforms on this list use end-to-end or transport encryption. Standard consumer platforms vary — FaceTime uses encryption but lacks the BAA.
3. Access controls
Clients should only be able to access their own sessions. Waiting rooms, session passcodes, and individual login credentials all support this requirement. A platform where anyone with a link can join a session creates access control concerns.
4. Session storage and recording policy
If you record sessions, those recordings become PHI and must be stored in a BAA-covered system. Many therapists record sessions for supervision — this is fine, but the recording must be stored in SimplePractice, a BAA-covered cloud system, or similar, not in personal Dropbox or iCloud.
Multi-State Telehealth: Extra HIPAA Considerations
If you serve clients in multiple states, you face additional HIPAA-adjacent requirements beyond federal law. Several states have mental health privacy laws stricter than HIPAA — and when you serve a client in that state, their state's law applies to you.
See our complete telehealth HIPAA guide for multi-state compliance requirements.
FAQ — HIPAA Telehealth for Therapists
Is regular Zoom HIPAA-compliant for therapy?
No. Standard Zoom (free or paid Pro/Business plans) does not include a HIPAA BAA. Only Zoom for Healthcare — a separate, significantly more expensive plan — includes a BAA. Most solo therapists use Doxy.me (free BAA) or SimplePractice's built-in telehealth instead.
Is FaceTime HIPAA-compliant for therapy sessions?
No. Apple does not offer HIPAA Business Associate Agreements for FaceTime on any plan. FaceTime cannot be used for therapy sessions involving protected health information, regardless of Apple's encryption claims.
What is the cheapest HIPAA-compliant telehealth option?
Doxy.me offers a free plan that includes a BAA — making it the cheapest legitimate HIPAA telehealth option. For therapists who also need an EHR, SimplePractice includes telehealth in all paid plans starting at $29/month.
Do I need a separate telehealth platform if I use SimplePractice?
No. SimplePractice includes HIPAA-compliant telehealth in all paid plans and the BAA covers the telehealth sessions. You do not need Doxy.me or Zoom for Healthcare if you use SimplePractice.
What should I do if I have been using standard Zoom for therapy sessions?
Document when you became aware of the compliance issue and when you switched. Switch immediately to a HIPAA-compliant platform. Do not file a self-report with OCR for past violations unless you have had an actual breach or disclosure — the violation was using the platform, but if no breach occurred, switching and documenting is the appropriate response. Consult a HIPAA compliance attorney if you are unsure.