Knowledge BaseApril 6, 2026

How to Get HIPAA Compliance for Video Conferencing (8-Step Guide)

Table of Contents

  1. The 8-Step Compliance Checklist
  2. Step 1: Conduct a Risk Assessment
  3. Step 2: Choose a HIPAA-Capable Platform
  4. Step 3: Execute a BAA or Self-Host
  5. Step 4: Configure Security Settings
  6. Step 5: Train Your Staff
  7. Step 6: Document Policies and Procedures
  8. Step 7: Conduct a Compliance Audit
  9. Step 8: Establish Ongoing Monitoring
  10. Technical Requirements Checklist
  11. Common HIPAA Violations with Video Conferencing
  12. Penalties for Non-Compliance
  13. Platform Options That Simplify Compliance
  14. Frequently Asked Questions
  15. Key Takeaways

The 8-Step Compliance Checklist

Getting HIPAA compliance for video conferencing requires eight concrete steps, completed in order. There is no shortcut, no single vendor feature that grants compliance, and no certification you can purchase. Compliance is an organizational process that combines technology, policy, training, and documentation.

Here is the complete sequence:

  1. Conduct a risk assessment identifying every point where PHI could be exposed during video sessions.
  2. Choose a HIPAA-capable platform that meets technical safeguard requirements.
  3. Execute a Business Associate Agreement (BAA) with your vendor, or self-host to eliminate the third-party dependency entirely.
  4. Configure security settings to enforce encryption, access controls, and audit logging.
  5. Train every staff member who will use or administer the video platform.
  6. Document your policies and procedures governing video-based PHI transmission.
  7. Conduct a formal compliance audit before going live with patient-facing video.
  8. Establish ongoing monitoring with regular reviews, incident response protocols, and annual reassessment.

Skip any step and you have a compliance gap. HHS does not care that your platform vendor signed a BAA if your staff shares meeting links on unsecured channels. Each step addresses a different category of HIPAA safeguard, and all eight are required.

Step 1: Conduct a Risk Assessment

The HIPAA Security Rule requires a thorough risk assessment before implementing any technology that handles PHI. This is not optional and not a formality. HHS has fined organizations millions of dollars specifically for failing to conduct adequate risk assessments.

For video conferencing, your risk assessment must identify where PHI appears during a video session (audio, video, screen shares, chat messages, recordings, file transfers), how that PHI is transmitted and stored, who has access at each stage, and what would happen if each component were breached.

Map every data flow. A telehealth video call involves the patient's device, your clinician's device, the network connection on both ends, the video platform's servers (if cloud-based), any recording storage, and any integrations with your EHR or scheduling system. Each point is a potential vulnerability.

Document every risk you identify, rate each by likelihood and impact, and define your mitigation plan for each. This document becomes the foundation for every subsequent step and the first thing an HHS auditor will request during an investigation.

Step 2: Choose a HIPAA-Capable Platform

Not every video conferencing platform can support HIPAA compliance. Your platform must meet specific technical requirements before organizational policies can close the remaining gaps.

The platform must provide AES-256 encryption (or equivalent) for data in transit and at rest. It must offer granular access controls so administrators can restrict who joins sessions, who records them, and who accesses stored recordings. It must produce audit logs that capture meeting creation, participant access, recording events, and administrative changes. It must support configurable data retention policies. And critically, it must either sign a BAA or give you the ability to self-host on your own HIPAA-compliant infrastructure.

Evaluate platforms against your risk assessment. If your assessment identified data residency as a high risk, a cloud-only platform that routes traffic through servers you do not control may not be acceptable regardless of what BAA they offer. If your assessment identified encryption key custody as critical, platforms where the vendor holds the keys create a risk you must either accept or mitigate.

Step 3: Execute a BAA or Self-Host

If you use a third-party video conferencing platform, HIPAA requires a Business Associate Agreement between your organization (the covered entity) and the vendor (the business associate). The BAA defines both parties' responsibilities for protecting PHI, establishes breach notification procedures, and creates legal accountability.

Read the BAA carefully. Not all BAAs are equal. Some cover only specific products within a vendor's suite. Some exclude features like AI transcription, cloud recording, or chat. Some limit the vendor's liability in ways that shift most of the breach risk back to you. Know exactly what the BAA covers and what it excludes before you sign.

The alternative is self-hosting. When you deploy a video conferencing platform on your own HIPAA-compliant infrastructure, there is no third-party business associate in the video layer. You control the servers, the encryption keys, the data residency, and the complete audit trail. This eliminates the BAA requirement for the video component (though you may still need BAAs for hosting providers, depending on your infrastructure). Self-hosting requires engineering resources but provides the strongest compliance posture.

Step 4: Configure Security Settings

A compliant platform with a signed BAA is still non-compliant if configured incorrectly. Security configuration is where many organizations fail.

Enable encryption for all sessions. Ensure AES-256 encryption is active for every meeting, not just those flagged as clinical. PHI can surface in any conversation.

Require meeting authentication. Disable open join links. Require participants to authenticate before entering a session. Use waiting rooms to verify identity before admitting patients.

Restrict recording permissions. Only authorized personnel should be able to record sessions. Disable participant recording by default. If cloud recording is used, verify that recordings are encrypted at rest and subject to your retention policy.

Disable non-compliant features. Features like live transcription stored on vendor servers, AI meeting summaries, third-party app integrations, and social media sharing may not be covered by your BAA. Disable anything not explicitly covered.

Configure audit logging. Ensure all meeting events, access events, and administrative changes are logged and that logs are retained according to your HIPAA documentation requirements (minimum six years for policies, though log retention varies).

Set data retention policies. Configure automatic deletion of recordings, chat logs, and session metadata according to your documented retention schedule.

Step 5: Train Your Staff

HIPAA requires workforce training, and video conferencing introduces specific risks that general HIPAA training does not cover. Every staff member who uses the video platform needs training on proper meeting setup procedures (authentication, waiting rooms, encryption verification), what can and cannot be said, shown, or shared on screen, how to verify patient identity before discussing PHI, what to do if an unauthorized person joins a session, how to handle recordings and where they may be stored, and how to report a potential breach or security incident.

Training must be documented. Record who was trained, when, on what material, and retain those records. Conduct refresher training annually and whenever the platform or your policies change. A signed BAA and perfect technical configuration do not protect you if a staff member conducts a telehealth session from a coffee shop with the screen visible to other patrons.

Step 6: Document Policies and Procedures

HIPAA requires written policies and procedures for every aspect of PHI handling, and video conferencing needs its own documentation. At minimum, you need a video conferencing acceptable use policy defining who may use the platform, for what purposes, and under what conditions. You need a telehealth-specific privacy policy that patients can review. You need an incident response plan for video-specific scenarios (unauthorized access to a session, lost recording, platform breach). You need a data retention and destruction policy for video recordings and session metadata. And you need a vendor management policy documenting your evaluation of the platform, the BAA, and your ongoing oversight procedures.

These documents must be current, accessible to your workforce, and reviewed at least annually. Store them where they can be produced quickly if HHS requests them during a compliance review or breach investigation.

Step 7: Conduct a Compliance Audit

Before going live with patient-facing video, conduct a formal compliance audit that tests every control you have implemented. Walk through each step of a video session from the patient's perspective and the clinician's perspective. Verify that encryption is active by checking session metadata, not by trusting a vendor claim. Attempt to join a session without authentication to confirm access controls work. Create a test recording and verify it is encrypted at rest and subject to your retention policy. Review audit logs to confirm they capture the events you expect. Run through your incident response plan with a simulated breach scenario.

Document the audit findings, remediate any gaps, and retain the audit report. This report serves as evidence that you performed due diligence, which matters significantly if a breach occurs later. HHS consistently imposes lighter penalties on organizations that can demonstrate a good-faith compliance program compared to those that cannot produce documentation.

Step 8: Establish Ongoing Monitoring

HIPAA compliance is not a one-time achievement. Your ongoing monitoring program should include regular review of audit logs for anomalous access or usage patterns, quarterly access reviews to ensure only current authorized personnel have platform access, annual risk reassessment incorporating any changes to the platform, your organization, or the regulatory environment, prompt evaluation of platform updates and new features for compliance impact, breach notification and incident response drills, and re-training when policies or technology change.

Assign a specific person or team responsibility for video conferencing compliance monitoring. Without clear ownership, monitoring becomes nobody's job and gaps accumulate silently until an incident forces attention.

Technical Requirements Checklist

Use this checklist to evaluate whether your video conferencing setup meets HIPAA technical safeguard requirements.

  • AES-256 encryption (or equivalent) for all data in transit
  • Encryption at rest for stored recordings, chat logs, and session metadata
  • Unique user authentication for every participant (no shared accounts)
  • Role-based access controls for hosts, participants, and administrators
  • Meeting password or authentication gate for every session
  • Waiting room or host-admit functionality
  • Host-only recording controls with recording consent notifications
  • Comprehensive audit logging (session events, access, admin changes)
  • Configurable data retention and automated deletion
  • Automatic session timeout and idle disconnect
  • Signed BAA covering all video products in use, or self-hosted infrastructure
  • Ability to disable non-compliant features (AI transcription, third-party apps, social sharing)
  • Breach notification mechanism from vendor (if cloud-hosted)
  • Encryption key management (vendor-managed with BAA, or self-managed)
  • Network segmentation capability for the video platform

Every item must be checked before your video conferencing deployment can be considered HIPAA compliant.

Common HIPAA Violations with Video Conferencing

These are the violations HHS encounters most frequently in video conferencing investigations.

Using a platform without a BAA. This is the most straightforward violation. If PHI is transmitted through a video platform and no BAA exists between you and the vendor, you are in violation regardless of the platform's security features.

Failing to disable non-covered features. Signing a BAA and then using features not covered by that BAA (AI companions, third-party integrations, certain recording options) creates a gap where PHI flows outside the agreement's protections.

Sharing meeting links via unsecured channels. Sending a telehealth session link through unencrypted email or SMS exposes the meeting access point. If the link allows unauthenticated join, anyone with the link can access the session.

Conducting sessions in public or shared spaces. A clinician joining a telehealth session from a shared workspace, public location, or any environment where the screen or audio can be observed by unauthorized individuals constitutes a PHI disclosure.

Failing to configure access controls. Using default platform settings without enabling waiting rooms, authentication requirements, or recording restrictions leaves sessions open to unauthorized access.

No audit log review. Having audit logs but never reviewing them fails the HIPAA requirement for ongoing monitoring. Logs that exist but are never examined do not satisfy the audit control standard.

Inadequate training documentation. Conducting informal training without documenting who was trained, when, and on what material fails the administrative safeguard requirement for workforce training.

Penalties for Non-Compliance

HIPAA violations carry significant financial and legal consequences across four penalty tiers.

Tier 1 --- Lack of knowledge. The covered entity did not know and could not reasonably have known about the violation. Penalties range from $137 to $68,928 per violation, with an annual maximum of $2,067,813.

Tier 2 --- Reasonable cause. The violation was due to reasonable cause and not willful neglect. Penalties range from $1,379 to $68,928 per violation, with the same annual maximum of $2,067,813.

Tier 3 --- Willful neglect, corrected. The violation resulted from willful neglect but was corrected within 30 days. Penalties range from $13,785 to $68,928 per violation, annual maximum of $2,067,813.

Tier 4 --- Willful neglect, not corrected. The violation resulted from willful neglect and was not corrected within 30 days. Minimum penalty is $68,928 per violation, with an annual maximum of $2,067,813.

These are per-violation figures. A single misconfigured video platform serving hundreds of patients can generate hundreds of individual violations. In 2024, HHS settled multiple cases exceeding $1 million specifically involving telehealth and video communication failures. Criminal penalties can also apply, including fines up to $250,000 and imprisonment up to 10 years for violations involving intent to sell or use PHI for personal gain.

The cost of compliance is always less than the cost of a breach.

Platform Options That Simplify Compliance

Some platforms reduce the compliance burden by handling more of the technical requirements by default.

WhiteLabelZoom (self-hosted). Deploys on your infrastructure, eliminating the need for a third-party BAA in the video layer. You own the encryption keys, control data residency, and maintain the complete audit trail. The platform ships with HIPAA-aligned security defaults, reducing the configuration burden. Deployment completes in under 48 hours with your branding throughout.

Purpose-built telehealth platforms. Doxy.me, Amwell, and similar platforms design HIPAA compliance into the product from the ground up. They include patient intake workflows, EHR integrations, and clinical documentation features. The tradeoff is less customization and no infrastructure ownership.

Embedded video APIs. Twilio Video, Daily.co, and Vonage offer BAAs and allow you to embed HIPAA-compliant video directly into your existing applications. This approach gives you control over the user experience while the API provider manages the media infrastructure.

Enterprise cloud platforms. Microsoft Teams and Zoom offer BAAs on qualifying plans. Both require manual configuration to reach compliance, and both route PHI through their cloud infrastructure. These work for organizations comfortable with third-party data handling and willing to manage the configuration requirements.

The best option depends on your risk tolerance, technical resources, and how much control you need over the infrastructure handling PHI.

Frequently Asked Questions

1. How long does it take to get HIPAA compliance for video conferencing?

For a cloud platform with an available BAA, you can complete the technical setup in one to two weeks if your risk assessment and policies are already in place. If you are starting from scratch --- risk assessment, policy development, staff training, and platform deployment --- expect six to twelve weeks for a thorough implementation. Self-hosted deployments add infrastructure setup time but can compress the BAA and vendor evaluation phases since you control the entire stack.

2. Can I use a free video conferencing tool for HIPAA-compliant telehealth?

No. Free tiers of major video platforms (Zoom Basic, Google Meet free, Microsoft Teams free) do not offer BAAs and cannot be used to transmit PHI. There is no configuration or workaround that makes a free plan HIPAA compliant. Any use of PHI on a platform without a BAA is a violation, regardless of the platform's technical security features.

3. Is a BAA alone enough for HIPAA compliance?

No. A BAA is one of eight requirements in a complete compliance program. The BAA addresses the vendor relationship, but your organization must still conduct a risk assessment, configure the platform correctly, train staff, document policies, perform audits, and monitor ongoing compliance. Organizations that sign a BAA and stop there have significant compliance gaps.

4. Do I need end-to-end encryption (E2EE) for HIPAA-compliant video?

HIPAA does not specifically require E2EE. The Security Rule requires "transmission security" and names encryption as an addressable implementation specification, meaning you must implement it if reasonable and appropriate. AES-256 encryption in transit combined with encryption at rest satisfies this requirement for most organizations. E2EE provides stronger protection but often disables features like cloud recording and transcription. Your risk assessment should determine whether E2EE is necessary for your use case.

5. What should I do if a HIPAA breach occurs during a video session?

Activate your incident response plan immediately. Document what happened, what PHI was potentially exposed, and who was affected. Notify your privacy officer and legal counsel. If the breach affects 500 or more individuals, you must notify HHS within 60 days and issue media notification. For breaches affecting fewer than 500 individuals, you must log the breach and report it to HHS within 60 days of the end of the calendar year. All affected individuals must be notified regardless of breach size.

6. Does recording telehealth sessions create additional HIPAA obligations?

Yes. Recordings containing PHI must be encrypted at rest, stored in a HIPAA-compliant location, subject to your data retention and destruction policies, and accessible only to authorized personnel. You must also obtain patient consent for recording where required by state law, which varies by jurisdiction. Cloud recordings on a vendor's servers must be covered by the BAA, and you should verify that the vendor's recording storage meets HIPAA requirements.

7. Can my IT team self-host a HIPAA-compliant video platform?

Yes, if your infrastructure meets HIPAA requirements. Self-hosting requires HIPAA-compliant servers (your own data center or a cloud provider with a BAA like AWS or Azure), encryption at every layer, access controls, audit logging, regular patching, and disaster recovery planning. Open source platforms like Jitsi Meet can be self-hosted, though they require significant configuration. Turnkey self-hosted solutions like WhiteLabelZoom ship with HIPAA-aligned defaults and reduce the engineering burden while preserving infrastructure control.

8. How often do I need to reassess HIPAA compliance for video conferencing?

At minimum, conduct a full reassessment annually. Additionally, reassess whenever you change video platforms, when your current platform releases significant updates or new features, when there is a security incident or near-miss, when HIPAA regulations are updated, or when your organization undergoes significant changes (mergers, new service lines, new locations). Ongoing monitoring between formal assessments should catch most issues, but the annual reassessment provides a structured opportunity to evaluate the complete compliance picture.

Key Takeaways

  • HIPAA compliance is an 8-step process, not a feature. No vendor can make you compliant by themselves. Technology, policy, training, and ongoing monitoring all play a role.
  • Start with a risk assessment. Every subsequent decision flows from understanding where PHI is exposed in your video workflows.
  • A BAA is necessary but not sufficient. The agreement covers the vendor relationship; configuration, training, documentation, and monitoring remain your responsibility.
  • Self-hosting provides the strongest compliance posture. Eliminating third-party data routing removes an entire category of risk and simplifies your compliance surface.
  • Configuration errors are the most common cause of violations. Default platform settings are rarely HIPAA compliant. Review and harden every setting.
  • Document everything. Your risk assessment, policies, training records, and audit reports are your evidence of good-faith compliance. Without documentation, compliance does not exist in the eyes of HHS.
  • Penalties are severe and per-violation. A single misconfigured platform can generate thousands of dollars in fines per affected patient.
  • Compliance is ongoing. Annual reassessment, regular log review, and continuous training are not optional activities.

Ready to deploy HIPAA-compliant video conferencing on your own infrastructure? WhiteLabelZoom gives you full encryption key ownership, zero third-party data routing, and HIPAA-aligned security defaults --- deployed with your branding in under 48 hours.

Related Articles

Related Resources