Is Zoom HIPAA Compliant for Therapists?
Quick Answer
No — not on the Free or Basic plan, and not automatically even on paid plans. Zoom offers a Business Associate Agreement (BAA) starting on the paid Pro tier, but it must be manually enabled in your billing settings — it is not on by default. You do not need the separate 'Zoom for Healthcare' bundle just to get a baseline BAA; Pro and up qualifies once the BAA is enabled and HIPAA mode is turned on.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified August 2026 against Zoom's official HIPAA compliance page
BAA Available?
Yes
On Which Plan
Pro and above — BAA must be manually enabled
Free/Basic Zoom can never be used for anything touching client PHI, and a later upgrade does not retroactively cover past sessions. On Pro or higher, go to your Zoom billing portal, explicitly request and enable the Business Associate Agreement, then turn on HIPAA mode in your account settings before your first client session.
What to Use Instead for Client Work
If you would rather not manage Zoom's settings yourself, SimplePractice includes HIPAA-compliant telehealth with the BAA already signed and no separate configuration step — video runs inside the same platform as your notes and billing.
Affiliate link — we may earn a commission at no extra cost to you.
Why Free Zoom Fails HIPAA
Zoom's Free and Basic plans are excluded from the BAA program entirely — there is no setting or workaround that makes them compliant. Recordings, chat transcripts, and even meeting metadata on these tiers are not covered by any Business Associate Agreement, so any session involving a client counts as an unauthorized disclosure under HIPAA if PHI is discussed.
What 'Enabling the BAA' Actually Means
Unlike some platforms where a BAA is bundled automatically with a paid plan, Zoom requires you to actively request and enable it from your account's billing settings. Skipping this step means you are paying for Zoom Pro but are still not covered — the plan tier alone is not proof of compliance. Pair this with Zoom's HIPAA mode, which disables cloud recording to unsupported locations and restricts certain third-party app integrations during the call.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Zoom and HIPAA
Do I need Zoom for Healthcare specifically, or does Zoom Pro work?
Zoom Pro (or higher) qualifies for a baseline Business Associate Agreement once you manually enable it — you do not need the separate Zoom for Healthcare bundle just to get a BAA. Zoom for Healthcare adds extra features (like Epic EHR integration) aimed at larger organizations, not a requirement for solo or small practices.
Is Zoom's free plan ever safe to use with clients?
No. Free and Basic Zoom accounts are excluded from Zoom's BAA program entirely, with no workaround. Any client-facing session that could involve PHI requires a paid Pro-or-higher plan with the BAA explicitly enabled.
Does enabling the BAA change anything about how Zoom works for my clients?
Clients join the same way. On your end, HIPAA mode restricts some features like local recording storage locations and certain third-party integrations during the call — worth testing once before your first real session.