Telehealth HIPAA Compliance: BAA Rules for Video, Recordings and Hosting (2026)

Last updated: October 20, 2026

Telehealth HIPAA compliance means a virtual visit follows the same HIPAA Rules as an office visit, in every system that handles it for you. Each vendor that stores or processes that patient data for you must sign a Business Associate Agreement (BAA) before the data moves. The COVID-era waiver that let providers use almost any video app ended on May 11, 2023. A 90-day transition period followed and closed on August 9, 2023. Since then, telehealth HIPAA compliance has worked like any other HIPAA program. This guide covers who signs which BAA, why recordings are PHI, and where the app and its data should live.

Choosing the video vendor itself? Our dated comparison of HIPAA compliant telehealth platforms shows who signs a BAA on which plan. The setup for each video tool is in HIPAA compliant video conferencing. This page covers the rules that apply whichever vendor you pick.

TL;DR: Quick answer

• The COVID telehealth waiver expired on May 11, 2023, and the 90-day transition period HHS allowed ended on August 9, 2023. Every visit now falls under the full HIPAA Rules.
• A vendor that creates, receives, maintains or transmits PHI for your visits is generally a business associate (45 CFR § 160.103). It must sign a BAA before it gets patient data.
• That can include the video platform, scheduler, texting tool, EHR, AI scribe and host. A carrier that only connects a call is a conduit and needs no BAA.
• Visit recordings, transcripts and AI summaries are PHI. Store them only with a vendor or host that has signed a BAA, never in a personal cloud account.
• HIPAA names no encryption protocol. Encryption in transit is an addressable part of 45 CFR § 164.312(e), and TLS 1.2 or newer is a sound benchmark, not a HIPAA rule.
• We sell no telehealth platform. We host the app you build on single-tenant AWS, and our BAA covers the servers and services we run.

Does telehealth still need a BAA after the COVID waiver?

Yes. The waiver paused penalties; it never changed the rules. In March 2020, the HHS Office for Civil Rights (OCR) issued its Notification of Enforcement Discretion for Telehealth. OCR said it would not penalize good faith telehealth on non-public facing apps, even without a BAA. The notice named popular apps such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom and Skype.

That notice expired with the COVID-19 public health emergency at 11:59 p.m. on May 11, 2023. OCR then gave providers a 90-calendar-day transition period, which ended at 11:59 p.m. on August 9, 2023. Since then, telehealth HIPAA compliance has had no special treatment. The Privacy Rule, the Security Rule and the Breach Notification Rule apply in full. OCR still enforces them. So far in 2026 (through October 20), OCR has announced 11 HIPAA settlements totaling $3,170,250 and no civil money penalties.

This matters because a visit touches PHI at several points: the booking, the intake form, the live video, the chat, the notes and any recording. Each vendor that stores or processes PHI in those steps needs a BAA under 45 CFR § 164.308(b). Whether your organization is in scope is covered in our guide to who needs HIPAA-compliant hosting. For telehealth platforms, the answer is almost always yes. For a practice, it depends on whether its own website, portal or app collects or stores patient data. We sell no telehealth platform. We host the app you build on our HIPAA compliant healthcare hosting, and our BAA covers the servers and services we run. Telehealth platforms serving Canadian patients should read HIPAA Canada PIPEDA before choosing a host.

Which vendors in a telehealth visit need a BAA?

A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate under 45 CFR § 160.103. Under 45 CFR § 164.502(e), you may share PHI with one only after you obtain satisfactory assurance that it will safeguard the data. That assurance must be documented in a written contract that meets 45 CFR § 164.504(e), which is the BAA. For telehealth HIPAA compliance, the test is what a vendor does with the data, not what it sells.

The exception that matters most here is narrow. HHS says a phone carrier that only connects a call, with transient access to the data, is a conduit and needs no BAA. A vendor that stores recordings, transcripts or messages is more than a conduit. HHS says you need its BAA before you use it with patients.

Here is who signs which BAA in a typical telehealth visit.

Each BAA covers only that vendor's own services. What every BAA should say is in our guide to the HIPAA business associate agreement. The rest of a practice's systems, from email to backups, are mapped in our guide to healthcare IT hosting.

Which video and practice platforms sign a BAA, and on which plans? Vendor terms change, so this page leaves that list to our dated telehealth platform comparison. Check it, then confirm current terms with the vendor before the first session.

The video tool is only half the picture

Here is the part that trips up many telehealth providers and the companies that build telehealth software. A compliant video tool protects the live call. It does not protect everything around it. The patient portal, the scheduling and intake system, the clinical notes, the billing data and any recordings kept outside the video tool live somewhere else. That somewhere has to be HIPAA-compliant hosting under its own BAA. A fully covered video platform that feeds a portal on a host with no BAA still leaves patient data uncovered. The booking tool a patient uses to schedule the visit is in scope too; see is Calendly HIPAA compliant. Appointment reminders and patient messages sent by SMS follow the same rule, covered in our guide to HIPAA compliant texting.

This is why telehealth HIPAA compliance is a hosting question as much as a video question. The app and its data need a host that signs a BAA. That host should also put the Security Rule safeguards in place: access controls, audit logging, encryption at rest and in transit, and tested backups. Our complete guide to HIPAA-compliant hosting covers those safeguards. For the cloud platforms that telehealth software usually runs on, see which clouds sign a BAA.

Are telehealth recordings PHI?

Yes. HIPAA defines health information as information, "whether oral or recorded in any form or medium," about a person's health or care (45 CFR § 160.103). A visit recording ties an identifiable patient to their care, so it is PHI. Stored as a file, it is ePHI. HHS's telehealth guidance lists tools that record or transcribe a session among those the Security Rule covers. The same logic covers transcripts and AI summaries of a visit.

Storage is where recordings test telehealth HIPAA compliance. A recording cannot sit in a personal cloud account with no BAA, such as a personal Google Drive. It belongs with a vendor or host that has signed a BAA, in encrypted storage, with logs that show who opened it. HHS also tells providers to weigh, in their risk analysis, whether recordings and transcripts can be encrypted. Where that data lives is part of the hosting question, which we break down in HIPAA compliant database hosting. Consent, storage and retention rules for recordings have their own guide: HIPAA compliant video recording.

If you build telehealth software, you are a Business Associate

Telehealth platforms, scheduling tools, remote monitoring dashboards and AI scribes are business associates when they handle PHI for provider customers (45 CFR § 160.103). HHS says business associates are directly liable for some HIPAA violations, including failures to comply with the Security Rule. You also need BAAs with your provider customers and with any subcontractor that stores or processes PHI for you, such as your host. If you build an AI scribe, you usually sign two subcontractor BAAs: one with the model vendor and one with your host. See HIPAA compliant AI hosting.

Your customers' telehealth HIPAA compliance depends on your product too. Intake forms are part of the same chain; building them correctly is covered in HIPAA compliant forms. Mental health practices have specific rules; see HIPAA compliant hosting for therapists. The broader software-company view is in HIPAA compliant hosting for healthcare SaaS.

A telehealth HIPAA compliance checklist

• A BAA with every vendor that stores or processes PHI, signed before the first session: video, scheduling, texting, EHR, AI tools and hosting.
• Encryption in transit and at rest, decided and documented in your risk analysis. HIPAA names no protocol; TLS 1.2 or newer is a sound benchmark.
• Covered storage for recordings, transcripts and AI summaries, never a personal cloud account.
• Access controls and audit logs so you can show who saw what and when.
• Secured devices, because the clinician's laptop or phone is an ePHI system too. It should require a login and lock after a period of inactivity.
• A private setting for each visit where feasible, as OCR expects, or lowered voices and no speakerphone when it is not.
• A documented risk analysis that covers the whole telehealth data path; our HIPAA risk analysis guide lists what OCR looks for. OCR's 14th Risk Analysis Initiative action came in June 2026.

Where to host the telehealth side

The video tool is a contract you sign. The infrastructure is a choice you make. Your setup may feed a portal, keep recordings outside the video tool, or run on custom software. That side of telehealth HIPAA compliance needs a host that signs a BAA. If you are building a telehealth product for provider customers, start with our application infrastructure for healthtech teams. If your practice runs its own portal or custom app, see our HIPAA compliant cloud hosting.

Every plan runs on single-tenant AWS. Each one includes CloudFront CDN, a web application firewall, EBS storage with 7-day snapshot retention and encryption at rest and in transit. It also includes six-year audit logging and tested encrypted backups. We sign the BAA within 24 hours of signup, before patient data moves. Managed plans start at $229 a month, and the Performance tier for n8n, Drupal, Strapi, Docker and Phalcon starts at $259. Monthly plans have no long-term contract. Your first month includes 4 hours of migration and configuration, then $175 an hour, quoted before work starts.

When are we the wrong choice? If every system that holds patient data is a SaaS tool with its own BAA, and your website collects none, you do not need us. Each plan is one server in one AWS availability zone, and a multi-zone design is quoted separately. Root access needs an Enterprise engagement. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. We sell this hosting, so weigh our view with that in mind. If you want a straight read on your own data path, tell us what your telehealth setup collects and stores.

Frequently asked questions

Is telehealth still allowed under HIPAA after the COVID waiver ended?

Yes. Telehealth is fully allowed. The enforcement discretion expired on May 11, 2023, and the 90-day transition period ended on August 9, 2023. Every visit must now meet the full HIPAA Rules. What went away is the freedom to use everyday video apps without a BAA.

Does HIPAA require TLS 1.2 for telehealth?

No. HIPAA names no protocol. The transmission security standard, 45 CFR § 164.312(e), requires you to guard ePHI sent over a network. Its encryption specification is addressable, which does not mean optional. You assess it, then implement it, or document why not and use an equivalent measure if reasonable and appropriate (45 CFR § 164.306(d)(3)). HHS's breach guidance cites NIST SP 800-52 for encrypting data in motion. That NIST guide requires government TLS servers and clients to support TLS 1.2, and to support TLS 1.3 by January 1, 2024. So TLS 1.2 or newer is a sound benchmark, not a HIPAA rule.

Is Zoom HIPAA compliant for telehealth?

It can be. Zoom says it helps customers enable HIPAA compliant programs by signing a Business Associate Agreement (checked October 20, 2026). Which plans qualify, and which settings to turn on, are covered in is Zoom HIPAA compliant. Other vendors are in our telehealth platform comparison.

Can I record a telehealth visit and save it to Google Drive?

Not to a personal Drive. A recording is PHI and needs storage covered by a BAA. Google offers its HIPAA BAA to Google Workspace and Cloud Identity customers. Google says customers who have not signed it "must not use PHI" in those services (checked October 20, 2026).

Does a HIPAA compliant video tool make my whole telehealth setup compliant?

No. The video tool's BAA covers the video tool. The portal, intake forms, notes, billing data and any recordings kept outside the video tool need their own covered home under their own BAAs. HIPAA compliant telehealth needs both halves.

Is my telehealth software company a Business Associate?

Yes, if it creates, receives, maintains or transmits PHI for provider customers. HHS says business associates are directly liable for some HIPAA violations, including Security Rule failures. You need BAAs with your customers and with subcontractors that store or process PHI for you, including your host.

Recap: telehealth HIPAA compliance

To recap, telehealth HIPAA compliance comes down to contracts and storage. Every vendor that stores or processes PHI for your visits signs a BAA before the data moves, from the video platform to the host. Recordings, transcripts and AI summaries are PHI, so they need covered, encrypted storage. The COVID waiver and its transition period are over, so this applies to every visit. That is what HIPAA compliant telehealth looks like in 2026. Pick a platform from a dated BAA table. Then host the portal, forms and any recordings kept outside the platform with a provider that signs for them.

This article is general information, not legal advice. Telehealth also involves state licensure and consent rules beyond HIPAA. Confirm your obligations with qualified counsel and base your safeguards on a documented risk analysis. Reviewed October 2026.

Sources

• HHS: Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency
• Federal Register: Notice of Expiration of Certain Notifications of Enforcement Discretion (88 FR 22380, April 13, 2023)
• HHS: HIPAA and Telehealth (expiration and transition period)
• HHS: Guidance on HIPAA and audio-only telehealth (BAAs, conduits, recordings, private settings)
• HHS: Direct Liability of Business Associates
• HHS: Guidance to Render Unsecured Protected Health Information Unusable (encryption of data in motion)
• NIST: SP 800-52 Rev. 2, Guidelines for TLS Implementations
• 45 CFR 160.103, 164.502 and 164.504 (definitions, disclosures to business associates, BAA contents)
• 45 CFR § 164.306 (addressable specifications): law.cornell.edu
• 45 CFR § 164.312 (technical safeguards): ecfr.gov
• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov
• HHS: Guidance on HIPAA and Cloud Computing
• HHS OCR: newsroom (2026 settlements) and 14th Risk Analysis Initiative action (June 18, 2026)
• Zoom: HIPAA compliance and Google Workspace Help: HIPAA compliance with Google Workspace (both checked October 20, 2026)