Best HIPAA-Compliant Video Consultation Platforms for Healthcare Practices (2026)

The best HIPAA-compliant video consultation platforms for most healthcare practices in 2026 are Doxy.me (free plan with an individual BAA), VSee Clinic (free to $49 per provider per month, BAA on every Clinic plan), SimplePractice ($49 to $99 a month with telehealth and a BAA on all three plans), TheraPlatform ($39 to $79 a month, BAA at no extra charge), Spruce Health ($24 or $49 per user per month) and Zoom (BAA on paid plans). ClinAds is not one of them. It is an AI marketing platform for clinics that brings patients to your door, and it sits outside the video visit rather than inside it. Pick the video tool on its BAA terms first, then choose the marketing layer.

That order matters because the draft version of this guide got it wrong. It ranked a marketing tool as a telehealth product and quoted prices nobody could find on vendor sites. This version checks every BAA claim against the vendor's own pages and every regulatory point against HHS.

Key takeaways

• The BAA is the gate. HHS says covered providers "must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements" for telehealth video (telehealth.hhs.gov). If a vendor won't sign one, nothing else on its feature list matters.
• The pandemic grace period is long over. OCR's COVID-19 telehealth enforcement discretion expired on May 11, 2023, and the 90-day transition period ended on August 9, 2023 (HHS). FaceTime-style workarounds are no longer protected.
• Which plan signs matters as much as whether the vendor signs. Doxy.me's free plan covers one provider with an individual BAA; a clinic-level BAA needs a paid plan (Doxy.me). Zoom's free tier isn't covered at all.
• All-in-one platforms bundle the BAA with the chart. SimplePractice and TheraPlatform include video, notes, scheduling and billing under a single agreement, which means fewer vendors to track.
• ClinAds belongs in a different part of the stack. It generates ads, blogs and AI-search visibility for clinics and says it "does not require patient health records" to do that (ClinAds FAQ). Pair it with a telehealth platform. It doesn't replace one.
• The riskiest gap is the handoff. HHS names telehealth platforms as user-authenticated pages where tracking code generally has access to PHI (HHS). Keep ad pixels out of the visit.

Comparison at a glance

Prices are list prices from each vendor's pricing page as of September 2026. "BAA" means what the vendor says on its own site, not what a review site says.

Tool	What it is	Video visits	BAA terms (vendor-stated)	Starting price	Best fit
ClinAds	AI marketing platform (ads, SEO, blogs, AI-search visibility)	✗	Not applicable; says it does not need patient records	Custom quote on a call	Filling the calendar before the visit
Doxy.me	Browser-based telehealth	✓	Individual BAA on Free; clinic-level BAA on paid plans	Free; Premium billed per user	Solo clinicians and low-volume telehealth
VSee Clinic	Telehealth clinic with waiting room and intake	✓	Signed BAA on Free, Plus, Premium and Enterprise	Free; Plus $29; Premium $49 per provider/month	Solo to mid-size clinics that want to grow into workflows
SimplePractice	Practice management with built-in telehealth	✓	BAA accepted at signup, covers all features including telehealth	$49 a month (Starter)	Therapy and behavioral health practices
TheraPlatform	EHR, billing and teletherapy bundle	✓	BAA provided at no additional charge	$39 a month (Basic)	Therapists, SLPs and OTs on a budget
Spruce Health	Phone, text, fax and video communication hub	✓	BAA included automatically in trials and paid plans	$24 per user/month	Primary care and multi-staff clinics that live on the phone
Zoom	General video platform with a healthcare BAA	✓	BAA executed on paid plans; online BAA for up to 9 Pro licenses (US)	Paid plan required	Practices already standardized on Zoom

What HIPAA actually requires from a video platform

HIPAA doesn't certify software. There is no government "HIPAA-approved" badge, and a vendor that claims one is marketing, not describing a credential. What the law requires is a relationship and a process.

The relationship is the business associate agreement. Under HHS guidance, a covered entity may disclose PHI to a business associate only after getting "satisfactory assurances," in the form of a contract, that the vendor will safeguard it (HHS). A video platform that routes, stores, records or transcribes your sessions is doing work on your behalf with PHI, so it's a business associate. HHS publishes sample BAA provisions if you want to check what a vendor's agreement should cover: permitted uses, safeguards, breach reporting, subcontractor flow-down and termination rights.

The process is your risk analysis. HHS's guidance on audio-only telehealth says the risks of any remote communication technology "need to be identified, assessed, and addressed as part of a covered entity's risk analysis and risk management processes" under the Security Rule (HHS). That covers interception in transit, recordings, transcripts and storage. A vendor's encryption helps, but the analysis is still your job.

There's one narrow exception worth knowing. HHS says a plain telephone carrier that only has transient access to a call acts as a "conduit" and doesn't need a BAA. The moment a vendor stores, records or transcribes, it stops being a conduit. Almost every modern video platform does at least one of those things, so assume you need a BAA.

The COVID-era flexibility that let practices use consumer video apps ended in 2023. OCR's notifications of enforcement discretion expired at 11:59 pm on May 11, 2023, and the 90-calendar-day transition period expired at 11:59 pm on August 9, 2023 (HHS). If your practice started telehealth in 2020 on a tool that never signed a BAA, that setup has been out of compliance for three years.

How we evaluated these platforms

We looked at three things for each vendor, in this order.

1. BAA availability and scope. Does the vendor sign one, on which plans, and does it cover one user or the whole clinic? We only accepted what the vendor states on its own pricing, security or help-center pages.
2. Verified list price. We used the vendor's current pricing page. Where a price wouldn't render or wasn't published, we say so rather than quoting a third-party estimate.
3. Fit for a practice's workflow. Solo or group, therapy or medical, standalone video or bundled EHR, and how patients join.

We didn't test call quality ourselves, and we didn't take vendor claims about uptime or satisfaction at face value. Where a vendor figure appears, it's attributed.

Where ClinAds fits: the patient-acquisition layer

ClinAds doesn't run video visits. It describes itself as a "full-service, AI-accelerated marketing agency" for dental, dermatology, med spa, optometry and multi-location clinics, and the product on getclinads.com is a marketing stack: it checks weekly whether ChatGPT, Claude and Gemini recommend your clinic, audits your website and a competitor's, publishes blogs to your site, and generates on-brand ads sized for Instagram and Facebook. We're listing it first because it's the client this guide was written for. We are not ranking it as a video platform, because it isn't one.

Why include it at all in a telehealth guide? Because a telehealth service only pays off if patients book it. A practice that adds virtual follow-ups or remote consults still has to tell people the option exists, rank for "online dermatologist near me" type searches, and show up when a patient asks an AI assistant who offers virtual visits. That's the job ClinAds is built for.

• AI-search visibility checks. ClinAds says it asks patient-style questions across ChatGPT, Claude and Gemini every week and shows you whether your clinic is named, which is useful for promoting a new telehealth service.
• Content and ad production. A weekly blog engine and an ad studio produce clinic-branded creative, so a "now offering video visits" campaign doesn't wait on an agency.
• Stays out of clinical data. Its FAQ says ClinAds "creates advertising creative and does not require patient health records," and tells clinics to avoid uploading PHI into any ad tool.

Best for: Dental, dermatology, med spa, optometry and multi-location practices that already have a compliant telehealth platform and need more patients to book it.

What to consider: ClinAds offers no video, no charting and no BAA-covered patient workflow, so it can't be your telehealth tool under any reading. Pricing isn't published; you get a number on a sales call, which makes side-by-side budgeting harder. The FAQ also says you "remain responsible" for meeting each ad platform's health advertising policies, so compliance review of ads still sits with you. And because ClinAds pushes traffic to your website, the booking page it sends people to has to be set up carefully (see the tracking section below).

For a wider look at marketing tools that sit on the booking side of this handoff, see our guide to tools that manage both online booking and local SEO for healthcare practices.

The video consultation platforms

1. Doxy.me

Doxy.me is a browser-based telehealth room. Patients click a link, check in to a virtual waiting room and wait for the provider, without installing an app or creating an account. It has a permanent free plan, which is why it shows up in so many solo practices, and a paid Premium plan priced per user per month and billed annually. Doxy.me says more than 1.5 million care providers have used it.

The BAA detail is what most reviews miss. Doxy.me's help center describes two kinds of agreement. The individual BAA "covers a single user and their personal room" and is available on Free plans. The clinic-level BAA covers every user in the clinic and is available only on paid plans. If you downgrade from paid to free, the clinic BAA stops applying and each provider needs their own (Doxy.me).

• Free plan with an individual BAA, suited to one clinician.
• Premium adds group calls of up to 25 participants, SMS invites, intake and consent workflows, roles and permissions, and clinic-level reporting (Doxy.me pricing).
• No patient download or login, which lowers the tech barrier for older patients.

Best for: Solo clinicians, part-time telehealth users, and practices testing whether patients want video visits before committing budget.

What to consider: The free plan is built for one person. A three-provider practice running everyone on separate free accounts ends up with three individual BAAs and no central admin, which is messy in an audit. Doxy.me is a video room, not an EHR, so notes and billing live somewhere else. The Premium price didn't render on the public pricing page when we checked, so confirm the current per-user figure with a quote.

2. VSee Clinic

VSee Clinic is a telehealth clinic in a box: a waiting room, intake forms, scheduling, payments and, on higher tiers, EMR-style notes. It has a free tier and grows up to a white-label enterprise product. VSee's pricing page states it "signs a HIPAA BAA for all VSee plans except Free VSee Messenger," and the Free Clinic plan lists "Signed BAA for HIPAA compliance" as a feature (VSee).

• Free ($0): one-click video link, unlimited one-to-one HD video, chat and screen share, a personalized waiting room, quick intake and a signed BAA.
• Plus ($29 per provider per month): custom subdomain, patient portal, group video, SMS and email reminders, card payments, and the ability to add family members or interpreters to a call.
• Premium ($49 per provider per month): shared waiting room and scheduling for multiple providers, custom intake, standard EMR notes, reporting and user management. VSee lists a $200 one-time setup fee alongside Premium.

Best for: Clinics that want a free start with a BAA and a clear upgrade path to multi-provider workflows, and practices that need interpreters or family members on calls.

What to consider: Free and Plus allow only one provider, so a group needs Premium or Enterprise from day one. Eligibility checks and claims submission are Enterprise-only. Monthly Plus and Premium subscriptions are non-refundable, according to VSee's FAQ, so trial it properly before paying.

3. SimplePractice

SimplePractice is practice management software for therapists and other health and wellness clinicians, with telehealth built in. It isn't a standalone video tool. Its appeal is that video, scheduling, notes, the client portal and insurance claims live in one account under one agreement.

SimplePractice's help center says telehealth is "included on all subscription plans at no additional cost" (SimplePractice). On the BAA, the company says you agree to it when you create your trial account, that it covers "all features" including telehealth, and that you don't need to sign again when you move to a paid plan. It also says it is HITRUST certified.

• Three plans: Starter at $49 a month, Essential at $79 a month and Plus at $99 a month (SimplePractice pricing).
• Group telehealth is included on Plus and costs $20 per clinician per month as an add-on on Essential.
• Clients join in a browser or through the SimplePractice telehealth app, and reminders carry the video link.

Best for: Solo and small-group therapy, counseling and behavioral health practices that want video bundled with notes and billing.

What to consider: Adding team members requires the Plus plan, and each additional clinician costs $74 a month for practices with two to five clinicians, stepping down to $69 at 16 or more. SimplePractice doesn't offer refunds, per its own FAQ. It is built around behavioral health workflows, so a medical clinic that needs ePrescribing, lab orders or complex medical billing will find it narrower than a medical EHR. Insurance claim fees are changing on October 1, 2026, with a standard starting rate of $0.39 per claim, so budget for that if you bill insurance.

4. TheraPlatform

TheraPlatform bundles an EHR, scheduling, billing and teletherapy for mental health, speech, occupational and physical therapists. Every plan includes unlimited telehealth and unlimited clients. The company says it "provides business associate agreement (BAA) with no additional charge" and describes AES-256 encryption for data at rest, encrypted daily backups and regular HIPAA risk assessments (TheraPlatform security).

• Basic: $39 a month, for a single provider (it can't add more).
• Pro: $69 a month, plus $39 for each additional provider.
• Pro Plus: $79 a month, plus $49 for each additional provider (TheraPlatform pricing).

TheraPlatform also includes interactive therapy apps inside the video room, which pediatric speech and OT practices tend to value more than adult medical clinics do.

Best for: Budget-conscious therapy practices, especially speech-language pathologists and pediatric therapists who want in-session tools alongside video.

What to consider: Bundling means dependency. If the video module has a bad afternoon, there's no clean way to swap in another tool without breaking the documentation flow, so test connection quality during the 30-day free trial. The launch prices on the pricing page are promotional (50% off for three months), so budget on the full rate. It's built for therapy, not for general medical visits.

5. Spruce Health

Spruce Health is a communication platform for medical practices that combines a business phone system, texting, secure messaging, fax and video telemedicine in one shared inbox. Video isn't the headline feature; it's one channel among several. For practices where most patient contact starts with a phone call or text, that's the point.

Spruce says "all Spruce trials and paid plans automatically include a BAA" for organizations that need one, agreed electronically when you create the organization (Spruce pricing).

• Basic: $24 per user per month, including the BAA, phone, text, video, fax and team chat.
• Communicator: $49 per user per month, adding automation and collaboration features.
• Spruce says it doesn't charge separately for texts, video calls or voice minutes on normal usage.

Best for: Primary care, concierge and multi-staff clinics that want phone, text and video under one BAA and one inbox.

What to consider: Spruce prices per user, and a user is any teammate, including front-desk staff and virtual assistants, not just clinicians. A seven-person clinic pays for seven seats. There's also a one-time $19.50 SMS registration fee and, since November 2025, pass-through telecom taxes on invoices. It isn't an EHR, so documentation stays in your existing system.

6. Zoom

Zoom is the general-purpose option. Plenty of practices already use it for staff meetings, and Zoom will execute a BAA for healthcare customers. Its HIPAA page says Zoom "helps customers enable HIPAA compliant programs by executing a Business Associate Agreement" and offers a SOC 2 plus HITRUST report (Zoom). In a 2021 announcement, Zoom said small US practices could buy Zoom Pro online, tick a box to accept a BAA and cover up to nine licenses that way, with larger deployments going through sales (Zoom).

• BAA available on paid plans; the free tier isn't a HIPAA option.
• Waiting rooms, passcodes and meeting locks help control who joins.
• Zoom Phone and team chat can fall under the same BAA, which suits practices consolidating tools.

Best for: Practices and health systems already standardized on Zoom that want one vendor for internal meetings and patient visits.

What to consider: Zoom is a meeting tool, not a clinical workflow. There's no intake, patient queue or charting built for care, so your staff do more manual work per visit. Patients who have never used Zoom may need help with the join flow. The BAA also has to be accepted on your account, so confirm in writing that your specific plan and any add-ons you enable (cloud recording, AI features) are covered before patient data touches them.

Matching the platform to your practice

Your practice	Start with	Why
Solo clinician, occasional video visits	Doxy.me Free or VSee Free	Both include a BAA at $0 for one provider
Solo therapist who wants notes and billing too	TheraPlatform Basic or SimplePractice Starter	Video and charting under one agreement
Group therapy practice, 2 to 10 clinicians	SimplePractice Plus or TheraPlatform Pro	Multi-provider support; group telehealth
Medical clinic where patients call and text first	Spruce Health	Phone, text, fax and video in one BAA-covered inbox
Growing clinic that expects to add providers	VSee Premium	Shared waiting room and scheduling; path to Enterprise
Organization already on Zoom company-wide	Zoom with BAA	One vendor, fewer tools to train on
Any of the above that needs more bookings	Add ClinAds alongside	Handles ads, SEO and AI-search visibility, not the visit

The marketing-to-telehealth handoff: where PHI leaks

This is the part most "best telehealth platform" lists skip, and it's where marketing and compliance collide.

HHS's bulletin on online tracking technologies uses "a telehealth platform" as an example of a user-authenticated page, and says tracking technologies on those pages "generally have access to PHI" such as IP addresses, appointment dates and contact details. If a third-party tracker receives appointment information along with a patient's IP address, HHS says that vendor is a business associate and a BAA is required (HHS).

In practice, that means the Meta pixel or Google tag your marketing team added to measure ad performance must never fire inside the telehealth room, the patient portal or a logged-in booking flow. Unless the ad vendor has signed a BAA that covers that data, there's no compliant way to send it.

The picture is less settled for public pages. On June 20, 2024, a federal court in the Northern District of Texas vacated the part of HHS's guidance that said HIPAA is triggered when tracking connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers (American Hospital Association v. Becerra). HHS says it is evaluating next steps. The authenticated-page guidance still stands.

A workable split looks like this:

1. Public marketing pages (service pages, blog posts, "now offering telehealth" landing pages): marketing tools like ClinAds operate here. Keep health-condition detail out of any data sent to ad platforms anyway, since state privacy laws and ad platform health policies apply regardless of HIPAA.
2. The handoff (the "book a video visit" button): link out to the telehealth platform's own booking or intake page rather than embedding it inside a pixel-tracked page.
3. Inside the visit (portal, intake, video room): only BAA-covered vendors. No ad pixels, no session replay tools without a BAA.

If you run marketing across several locations, our guide to AI marketing platforms for multi-location healthcare groups covers how central teams keep that split consistent.

A BAA checklist before your first video visit

Use this before any patient joins a call.

• Get the BAA in writing and file it. For self-serve tools, download or screenshot the accepted agreement from account settings. Doxy.me, SimplePractice, Spruce and Zoom all use click-through acceptance, which is easy to forget you did.
• Check the scope. Does it cover one user or the whole account? Doxy.me's split between individual and clinic-level BAAs is the clearest example of why this matters.
• Check which features are covered. Recording, transcription and AI note-taking add PHI storage. SimplePractice says its BAA covers all platform features; with other vendors, ask.
• Confirm what happens on downgrade or cancellation. Doxy.me says downgrading from paid removes the clinic BAA. Ask every vendor how you export records if you leave.
• Add the tool to your risk analysis. Record where video, chat logs and recordings are stored, who can access them, and how long they're kept.
• Train staff on the patient side. HHS publishes privacy and security tips for patients you can adapt into your appointment reminders.
• Keep licensure separate from software. Video platforms don't verify whether a clinician may treat a patient in another state. The Interstate Medical Licensure Compact offers physicians an expedited licensing pathway; its snapshot as of August 31, 2026 lists 44 member states and 2 US territories. It covers physicians only, and it's a licensing route, not a check your video tool runs for you.

Limitations

This guide has real gaps, and you should know them before you rely on it.

• We didn't run clinical call-quality tests. Our comparison is based on vendor documentation, pricing pages and HHS guidance. Connection stability on rural broadband or older phones varies, and a trial on your own patients is the only reliable test.
• Prices change often. Every figure here comes from vendor pages as of September 2026, several of them promotional. Doxy.me's Premium price wasn't visible on its public page, and ClinAds only quotes on a call.
• A BAA isn't the whole of compliance. A signed agreement shifts some obligations to the vendor. It doesn't cover your staff's device security, where they take calls, or your own risk analysis.
• The lineup isn't exhaustive. Large health systems usually run video through their EHR (Epic, Oracle Health and others) or enterprise platforms we didn't cover. Dental-specific and specialty tools exist too.
• Tracking rules are in flux. The 2024 court ruling left HHS's guidance on public pages unsettled, and state health privacy laws keep changing. Check with counsel before running retargeting on health-service pages.
• This isn't legal advice. HIPAA obligations depend on your entity type and workflows. Talk to a healthcare attorney or privacy officer about your specific setup.

Conclusion

Start with the agreement, not the feature list. For a solo clinician, Doxy.me Free or VSee Free gets you a signed BAA at no cost, as long as you understand it covers one person. Therapy practices that want video tied to notes and billing will get more out of SimplePractice or TheraPlatform, with TheraPlatform cheaper at the entry level and SimplePractice stronger for growing groups. Spruce Health suits medical clinics where the phone and text inbox is the real front door, and Zoom makes sense mainly if you've already standardized on it and turned on the BAA.

ClinAds fits alongside any of these, not instead of them. It's a marketing platform, and its value in a telehealth rollout is getting patients to find and book the service. Keep its tracking and ads on the public side of your website, send the booking click straight to your BAA-covered platform, and you get the growth without dragging PHI into an ad system.

Frequently asked questions

Is ClinAds a HIPAA-compliant video consultation platform?

No. ClinAds is an AI marketing platform for clinics that produces ads, blogs, SEO work and AI-search visibility checks. It doesn't host video visits. Its FAQ says it "does not require patient health records" to create advertising. Use it to promote a telehealth service that runs on a separate platform with a BAA.

Do I need a business associate agreement for telehealth video?

In almost every case, yes. HHS says covered providers must use telehealth vendors that comply with HIPAA and will enter into business associate agreements. The only narrow exception is a plain telecom carrier acting as a conduit with transient access, which doesn't describe a modern video platform that stores, records or transcribes.

Are free telehealth plans HIPAA compliant?

Some are. Doxy.me's free plan includes an individual BAA for a single provider, and VSee's free Clinic plan includes a signed BAA. Zoom's free tier isn't a HIPAA option. Free plans are usually built for one clinician, so a multi-provider practice should expect to pay for a clinic-wide BAA.

Can I still use FaceTime or regular Zoom for patient visits?

Not under the pandemic flexibility. OCR's enforcement discretion for consumer video apps expired on May 11, 2023, and the transition period ended on August 9, 2023. Since then, providers need a vendor that will sign a BAA. For Zoom, that means a paid plan with the BAA enabled.

How much does a HIPAA-compliant video platform cost?

From free to about $99 a month for a single clinician, based on vendor list prices in September 2026. VSee Plus is $29 and Premium $49 per provider per month. SimplePractice runs $49 to $99 a month. TheraPlatform runs $39 to $79 a month. Spruce Health is $24 or $49 per user per month, and every staff member counts as a user.

Can I put a Meta or Google tracking pixel on my telehealth booking page?

Not on logged-in pages or inside the visit. HHS says trackers on user-authenticated pages such as telehealth platforms generally have access to PHI, and a tracking vendor receiving appointment details needs a BAA, so unless your ad vendor has signed one covering that data, it can't receive it. Keep pixels on public marketing pages and link the booking button straight to your telehealth vendor.