HIPAA-Compliant Telehealth Platforms: 2026 Playbook

Why Fora Soft wrote this playbook

Fora Soft is a software development company that has shipped 250+ projects since 2005 with 50 in-house engineers, and telemedicine is one of our deepest verticals. We built and run the video stack behind CirrusMED, a HIPAA telehealth platform serving a direct-primary-care practice, and TransLinguist, a medical-interpreting platform on the NHS UK national framework with 75+ languages and 30,000+ interpreters. Polina Sapunova, our co-founder, leads the healthcare practice.

Across those engagements we have signed a lot of Business Associate Agreements, sat on the engineering side of SOC 2 audits, and cleaned up a few compliance findings that only surfaced when an acquirer’s diligence team went looking. So this isn’t a vendor explainer. It’s what we tell founders when they ask which HIPAA-compliant telehealth platform to buy, when to build instead, and how to walk into a SOC 2 Type 2 audit without flinching.

If your buyer is asking about HIPAA, SOC 2, or both, this guide covers what each one actually requires for video, which off-the-shelf platforms sign a BAA, the reference architecture that passes audit, and the real 2026 dollar math — including why doing both together saves you money.

What a HIPAA-compliant telehealth platform actually is

A HIPAA-compliant telehealth platform is one where every component that touches Protected Health Information is covered by a signed Business Associate Agreement, encrypts PHI in transit and at rest, enforces access control with MFA, and logs every PHI access. “HIPAA-compliant” is not a product badge you can buy — it’s a property of how your whole system is configured, contracted, and operated.

PHI here means anything that ties a person to their care: names, faces on a video call, recordings, transcripts, chat messages, appointment metadata, even the fact that someone is a patient. The moment your platform creates, receives, stores, or transmits that on behalf of a covered entity (a clinic, hospital, or health plan), you are a Business Associate under U.S. federal law, administered by the HHS Office for Civil Rights.

This got real in 2023. During COVID, OCR ran a Notification of Enforcement Discretion that let clinicians use consumer Zoom, Skype or FaceTime for telehealth without penalty. That discretion expired on May 11, 2023, and the 90-day grace period ended August 9, 2023. Since then, a consumer video tool with no BAA is a plain HIPAA violation. That single date is why the “is this platform HIPAA-compliant?” question now gates every telehealth purchase.

Which telehealth platforms are actually HIPAA-compliant?

The HIPAA-compliant telehealth platforms worth shortlisting are the ones that will sign a BAA on the plan you’re actually on: Doxy.me, Zoom for Healthcare, SimplePractice, VSee, Healthie, TheraPlatform, Doximity, Amwell, and Google Meet or Microsoft Teams inside a configured Workspace or Enterprise tenant. The trap is that the consumer edition of the same brand usually will not sign one. A signed BAA on your specific plan is the line between compliant and not.

For a solo practice or a clinic doing standard visits, buying one of these is the right first move: faster and cheaper than building. Prices and BAA terms below are current as of mid-2026; always confirm the BAA covers your exact plan before you run a single session.

Doxy.me

Doxy.me is HIPAA-compliant and signs a BAA on both its free and paid plans, which makes it the fastest legitimate way for a solo clinician to start. It runs in the browser with nothing to install, and paid tiers add group calls, waiting rooms and light branding. The trade-off is shallow customization and no deep EHR integration.

Zoom for Healthcare

Zoom is HIPAA-compliant for telehealth only on the Zoom for Healthcare tier with a signed BAA. Standard Zoom Pro and Business plans are not, no matter how the meeting is configured. The healthcare tier adds waiting rooms and PHI-aware recording controls from around $150/month, which suits teams already fluent in Zoom.

SimplePractice and behavioral-health platforms

SimplePractice signs a BAA on every paid plan ($29–$99/mo) and bundles video with notes, scheduling and billing, which is why behavioral-health practices favor it. TheraPlatform and Healthie fill the same all-in-one niche; both sign BAAs and are strong picks for HIPAA-compliant telehealth platforms aimed at therapy, psychiatry and nutrition.

VSee and Amwell

VSee signs a BAA, offers end-to-end encrypted video that holds up on low bandwidth, and is a common pick for kiosks and device-heavy deployments. Amwell sits at the enterprise end with deep HL7/FHIR EHR integration and BAA coverage across its deployments, which is the right fit when a health system needs telehealth wired into an existing chart.

Google Meet and Microsoft Teams

Both can be HIPAA-compliant, but only inside a paid Google Workspace or Microsoft 365 Business or Enterprise tenant with a signed BAA and correct configuration. Consumer Gmail, free Google Meet, and free or consumer Teams are not eligible, and third-party add-ons usually fall outside the BAA, so the edition and configuration matter as much as the brand.

Two honest caveats. First, the BAA covers the vendor’s infrastructure only — your own configuration, staff training and device security are still on you. Second, these platforms are closed boxes: the moment you need custom patient flows, deep EHR integration, your own encryption keys, or an enterprise SOC 2 story of your own, you’ve outgrown “buy” and you’re into “build,” which is the rest of this playbook.

HIPAA vs SOC 2 — what overlaps, what doesn’t

HIPAA is mandatory law about handling PHI; SOC 2 is a voluntary attestation that your security controls work — and about 60% of the technical controls overlap. You need both for different reasons, but you build the shared core once.

Figure 1. HIPAA and SOC 2 share most technical controls; each adds a distinct layer you can’t skip.

HIPAA applies the instant you handle PHI for a covered entity. There is no “HIPAA Lite.” You sign a BAA, implement the Security Rule’s safeguards, and carry breach-notification duties. Miss it and the penalties are federal and scale into the millions per violation category.

SOC 2 is an attestation framework from the AICPA. No regulator fines you for lacking it. But every enterprise healthcare, payer, and SaaS buyer asks for the SOC 2 Type 2 report before signing, and without one your sales cycle stretches 90–180 days while their security team runs a bespoke assessment. A SOC 2 report does not prove HIPAA compliance, and a HIPAA assessment does not satisfy SOC 2 — they answer different questions. The overlap is in the plumbing: access controls, audit logs, encryption, vulnerability management and incident response serve both, so one policy set and one tooling stack feed a single evidence window.

What HIPAA actually requires for video

For a video platform, four technical safeguards do most of the work: encryption in transit and at rest, access control with MFA, tamper-evident audit logging, and a signed BAA with every vendor in the chain. Get these right and you’ve cleared the bulk of the Security Rule.

1. Encryption, in transit and at rest. WebRTC media is encrypted in transit by default via DTLS-SRTP, so that part is free. At rest is the work: every recording, transcript and snapshot needs AES-256 with managed keys (KMS or HSM). Encryption is technically an “addressable” specification today, but in practice no auditor accepts unencrypted PHI, and the proposed 2025 rule would make it explicitly required.

2. Access control and MFA. Role-based access to PHI is non-negotiable, and multi-factor authentication is now the de-facto standard your buyers and auditors expect across patient, clinician and admin surfaces. If anyone with a room URL can join a visit, you don’t have access control — you have a link.

3. Audit logging. Log every PHI access: who, what, when, from where. The log is PHI-adjacent, so it’s encrypted, tamper-evident, and retained six years. For video that means per-session events (who joined, who recorded, who viewed) plus per-record events on every clip retrieval.

4. Business Associate Agreements. Every vendor that touches PHI signs a BAA — your media server, cloud provider, storage, captioning service, analytics. No BAA, no PHI, no exceptions. A vendor’s “HIPAA-compliant” marketing page is not a BAA; the signed document is.

5. Breach notification. If PHI is exposed, you notify affected individuals without unreasonable delay and no later than 60 days; breaches affecting 500 or more people also go to HHS and the media within that window. Your incident-response plan has to rehearse this — run the tabletop at least annually, not the week the breach lands.

The 2025 Security Rule update — proposed, not yet law

The headline HIPAA changes everyone is bracing for are still a proposal. HHS published the Security Rule Notice of Proposed Rulemaking in the Federal Register on January 6, 2025; the comment period closed March 7, 2025 with 4,000+ comments. As of mid-2026 it is not final, and the government’s own regulatory agenda now targets roughly 2027 for a final rule — which could be scaled back from the draft.

If finalized as written, the NPRM would remove most of the “addressable vs required” discretion that lets teams skip controls. Encryption in transit and at rest, MFA, an asset and network inventory, network segmentation, vulnerability scanning and penetration testing on a defined cadence, and annual business-associate certification would all become mandatory and auditable.

Here’s the practical read: don’t wait for the rule, and don’t tell your buyers it’s already in force. Every control in the NPRM is either already best practice or already something a SOC 2 auditor will test. Build them now and you’re both audit-ready today and future-proofed for whenever — and in whatever form — the final rule lands. Treating a proposed rule as current law in your marketing is the kind of inaccuracy a technical buyer will catch, and it costs you trust.

SOC 2 Type 2 — the five trust criteria

SOC 2 grades your controls against five Trust Services Criteria; most telehealth platforms scope to Security, Availability and Confidentiality and skip Processing Integrity and Privacy, which add audit cost without much buyer value.

Security (the Common Criteria, mandatory). Controls against unauthorized access. CC6.1–CC6.8 are the access-control criteria, and this is where naive WebRTC implementations fail: if a shared room link is the only gate, you have no access control to attest to.

Availability. Uptime SLA, monitoring, capacity planning, business continuity. Telehealth buyers expect 99.9% or better, which means your media servers span at least two regions, your database has replicas, and your incident playbook is rehearsed rather than aspirational.

Confidentiality. Protecting confidential data beyond access control — encryption posture, recording-retention limits, and vendor due diligence. For video this is where your E2EE story and your BAA chain get examined.

Type 1 vs Type 2. Type 1 says your controls were designed correctly on one date; Type 2 says they operated effectively across an observation window, commonly 3 to 12 months. Enterprise buyers want Type 2. Plan for the observation window from day one, because you can’t shortcut calendar time.

Reference architecture that passes audit

A telehealth video stack that passes a HIPAA + SOC 2 audit has six discrete layers, each with a clear owner and a clear control. Get one wrong and the auditor finds it, usually the storage or logging layer.

Figure 2. Six-layer reference architecture — identity, application, self-hosted SFU, encrypted storage, audit log, all under a BAA umbrella.

The identity layer gives you SSO, MFA and role-based scopes so PHI access maps to a named person and role. The application tier enforces PHI minimization and writes an audit event on every access. The media layer is a self-hosted SFU (mediasoup or LiveKit OSS) inside your own VPC, so recordings are encrypted before they ever hit disk and the media never leaves your trust boundary. Storage is S3 with KMS and customer-managed keys; the audit log is tamper-evident with six-year retention and SIEM alerting. Underneath it all, a BAA umbrella covers every vendor — AWS or GCP or Azure, your identity provider, your observability stack.

Build vs buy — SDK, platform, or self-hosted

Buy a BAA-signed platform for standard visits; build on a BAA-covered SDK when you need custom UX or to embed video in your own app; self-host media when you need full PHI control, data residency, or your own keys. Most teams move down this ladder as they grow, not all at once.

Figure 3. Build-vs-buy decision tree — take the first branch that fits your visit flows, customization, and data-control needs.

The buy tier (Doxy.me, Zoom for Healthcare, SimplePractice) is fastest and cheapest, and for a huge share of clinics it’s the correct permanent answer. The SDK tier (Daily, Vonage Video, LiveKit Cloud) hands you a BAA and a video API so you control the patient experience without operating media infrastructure — you pay per minute and accept the vendor in your BAA chain. The self-hosted tier (mediasoup or LiveKit OSS in your VPC) gives you full control and the cleanest data-residency and key story; the trade is that you are now the Business Associate signing BAAs with your own customers, and you own the SRE burden.

A concrete signal we use: if you’re under ~10,000 provider-minutes a month, buy or use an SDK. Past that, and especially if enterprise buyers are asking for your own SOC 2 report and your own encryption keys, self-hosting usually wins on both cost and control. See our deep dive on the HIPAA-compliant video platform layer for the SFU-specific detail.

Vendor BAA matrix — who signs what

Before you pick a media vendor, confirm it will sign a BAA on the tier you can afford. This is the build-side companion to the platform table above — the infrastructure and SDK vendors you’d assemble yourself, current as of mid-2026.

One correction worth flagging, because the old advice is everywhere: Twilio’s Programmable Video was scheduled for end-of-life, then Twilio reversed that decision in October 2024, and the product remains supported and open to new accounts in 2026. If a 2024-era guide told you to rip Twilio out, re-check before you spend a sprint migrating.

Cost model — the real 2026 numbers

For a typical telehealth startup, a combined HIPAA + SOC 2 Type 2 program lands around $92k in year one; doing the two sequentially runs closer to $145k. The savings come from building the shared controls once and running a single overlapping evidence window.

Figure 4. Combined vs sequential first-year cost — modeled midpoints of 2026 ranges; your numbers move with scope and team size.

SOC 2 Type 2 audit fees. $15–60k for a small-to-mid SaaS from a specialist firm (A-LIGN, Schellman, Prescient, BARR); Big Four firms run higher and are usually overkill for a startup. Renewals cost less than the first audit.

HIPAA risk assessment. $5–15k for an external assessor (Compliancy Group, Accountable, MedCurity) on the first cycle, or near zero if you self-assess with your compliance platform’s templates — though we’d pay for one external pass before your first real audit.

Compliance tooling. $7.5–20k a year for a sub-50-person team on Drata, Secureframe or Vanta; Sprinto runs cheaper. Budget about $10–15k/year for a 20-person telehealth startup.

Engineering effort. 4–8 weeks of senior time to build the controls if compliance was designed in from the start; 12–20 weeks to retrofit a codebase that wasn’t. That retrofit gap is the single biggest variable in the whole budget.

The combined math. Add it up and combined HIPAA + SOC 2 lands roughly a third below sequential, because you write one policy set, wire one tooling stack, and give the auditor one overlapping evidence window instead of two. We use Agent Engineering to compress the build-out further, so treat these figures as conservative market midpoints — if a number here doesn’t match a quote you’ve been given, the gap is usually scope, and worth a conversation.

Compliance tooling — Vanta, Drata, Sprinto, Secureframe, Comp AI

A compliance-automation platform is not optional past a handful of engineers — it collects the evidence auditors want on autopilot. The five worth knowing for telehealth, with where each wins and where it breaks:

Vanta. The category leader: the broadest integration catalogue and the most mature evidence collection. Where it breaks: modular pricing that scales aggressively per-user and per-framework, so budget for renewal sticker-shock. Roughly $10k+/year at telehealth scope.

Drata. Vanta’s closest peer — comparable coverage, a slightly cleaner UX, similar $7.5–15k/year band for single-framework SOC 2 under 50 people. We’ve shipped clients on both and wouldn’t talk you out of either.

Sprinto. Lighter and cheaper, strong for HIPAA + SOC 2 together, popular with earlier-stage and international teams. Smaller integration catalogue than Vanta, but it covers the essentials for a video startup.

Secureframe. Comparable to Drata on features and price ($7.5–20k/year for the entry tier), with solid HIPAA + SOC 2 mappings. A safe pick if Vanta’s pricing model puts you off.

Comp AI. An open-source compliance platform (launched 2025) with a free tier — worth a look for cash-strapped early teams who can trade hand-holding for cost. Less mature than the paid four; validate the integrations you actually need before you commit.

12-month roadmap — from MVP to audited

From a working MVP, plan on 9 months to audit-ready and about 12–15 months to a SOC 2 Type 2 report, because the observation window is calendar time you can’t compress.

Mini case — a telehealth build hitting audit-ready

A US telehealth client came to us with a working MVP, two hospital systems in pilot, and SOC 2 plus HIPAA sitting on the contract as hard requirements. The architecture looked a lot like our work on CirrusMED, so we knew the shape of the problem.

Plan. Months 1–3, we moved the media plane onto self-hosted mediasoup in the client’s own AWS VPC, added customer-managed KMS keys, put MFA on every surface via the identity provider, and pointed the audit log at a dedicated store with six-year retention. Months 4–6, we wired in a compliance platform, ran an external HIPAA risk assessment, and closed two penetration-test cycles. Months 7–9, SOC 2 Type 1 plus HIPAA attestation.

Outcome. Audit-ready in month 9 against a 12-month target, with the Type 2 report following after the observation window. Both pilot hospital systems converted to multi-year contracts on the strength of the report, which is the whole point: compliance wasn’t a cost center, it was the thing that turned pilots into signed revenue. Want a similar plan for your platform? Book a 30-min scoping call.

Pitfalls to avoid

1. A “HIPAA-compliant” SDK with no signed BAA. Marketing copy is not a contract. Get the BAA signed and stored with your evidence, or the auditor finds nothing to rely on.

2. Recordings in S3 without bucket encryption and access logging. Use SSE-KMS with customer-managed keys, turn on bucket access logging, set a six-year lifecycle. Default settings have leaked PHI more than once.

3. Storing PHI in transcripts without redaction. Voice and chat transcripts capture SSNs, dates of birth and diagnoses said out loud. Redact at write time; don’t trust a post-hoc cleanup job.

4. Nailing the Security Rule and forgetting the Privacy Rule. Patient access rights, accounting of disclosures, minimum-necessary — the Privacy Rule has its own requirements that audits check, and most teams skip them entirely.

5. Treating SOC 2 as a one-off. Type 2 is a continuous program. Build evidence collection into your weekly engineering rhythm, not a panic sprint the month before renewal.

A decision framework — pursue both in five questions

Q1. Will you handle PHI of US patients? Yes → HIPAA is mandatory, full stop.

Q2. Will you sell to enterprise healthcare buyers? Yes → SOC 2 Type 2 will be a contract requirement; plan the observation window from day one.

Q3. Are you pre-Series-A or Series-A+? Pre-A: HIPAA first, SOC 2 Type 1 second, Type 2 by Series B. Series-A+: run a combined sprint to Type 2 over 12–15 months.

Q4. Are EU patients in scope? Add GDPR and data residency — EU regions with EU-only key access. If HIPAA is already in place, the incremental burden is small.

Q5. How big is your engineering team? Under five engineers, lean on your compliance platform’s templates and hire external counsel. Above ten, dedicate one engineer about 30% of their time to compliance operations.

KPIs to measure

Quality KPIs. Control-test pass rate in your compliance platform: 99%+. Critical pentest findings per cycle: zero. Mean time to remediate an audit finding: under 30 days.

Business KPIs. Enterprise sales-cycle compression once the Type 2 report is in hand: 30–90 days faster. Multi-year hospital-system contracts won after attestation. Access to the compliant (higher) pricing tier.

Reliability KPIs. Incident-response drill cadence: quarterly. PHI breaches: zero. Time to detect an access anomaly: under 60 minutes via SIEM alerting.

When NOT to chase both at once

Pre-revenue with no enterprise design partners. Shipping direct-to-consumer (say, a DTC mental-health app)? HIPAA is enough for now; SOC 2 Type 2 is premature. Do Type 1 once you sign your first enterprise pilot.

Non-US, non-PHI workloads. An EU-only platform lives under GDPR and ISO 27001 instead; HIPAA doesn’t apply, and SOC 2 may be premature without US enterprise buyers.

Wellness-only, no diagnostic or treatment data. Fitness, meditation and sleep tracking are arguably outside HIPAA scope, but the moment you add a clinician portal or a diagnosis you’ve crossed the line, so design as if you’ll cross it.

FAQ

Is Zoom HIPAA-compliant for telehealth?

Only Zoom for Healthcare (or an enterprise plan with a signed BAA) is. Standard Zoom Pro and Business plans do not include a BAA and cannot be used for telehealth involving PHI. The healthcare tier adds the BAA plus waiting rooms and PHI-aware recording controls, from about $150/month.

Is Google Meet or Microsoft Teams HIPAA-compliant?

Both can be, but only inside a paid Google Workspace or Microsoft 365 Business/Enterprise tenant with a signed BAA in place and correct configuration. Consumer Gmail, free Google Meet, and free/consumer Teams are not eligible, and third-party add-ons usually fall outside the BAA.

Is Twilio Video still shutting down?

No. Twilio announced an end-of-life for Programmable Video, then reversed that decision in October 2024. The product remains supported and open to new accounts in 2026, and Twilio signs BAAs for eligible products. Older guides that told you to migrate off Twilio are out of date.

Does LiveKit Cloud sign a BAA?

Yes, on an enterprise tier with a custom contract. For most telehealth startups the simpler path is self-hosting LiveKit OSS in your own VPC — the same SDK, no BAA negotiation, and full data-residency control.

How long does SOC 2 Type 2 actually take?

From a clean start, 6–9 months to Type 1, then a minimum 6-month observation window before the Type 2 audit — about 12–15 months total. From a non-compliant codebase, add 3–6 months of remediation up front.

Is the 2025 HIPAA Security Rule update in effect?

Not yet. It’s a proposed rule (NPRM) published in January 2025; a final rule isn’t expected before roughly 2027 and may change. The proposed MFA, encryption and asset-inventory requirements are already best practice and already tested by SOC 2, so build them now regardless.

Can we use OpenAI or Claude in a HIPAA telehealth workflow?

Yes, under a signed BAA: Azure OpenAI text endpoints under Microsoft’s BAA, the OpenAI API and Anthropic’s Claude API or Enterprise under their first-party BAAs with zero data retention, or via AWS Bedrock and GCP Vertex under the cloud provider’s BAA. The BAA covers the vendor only — redaction, access control and audit evidence are still yours. Real-time audio is the least consistently covered, so a chained speech-to-text to LLM to text-to-speech pipeline of individually covered services is the safer 2026 pattern. Our OpenAI Realtime production guide has the detail, and our AI integration team builds these HIPAA-eligible pipelines.

Do you need both SOC 2 Type 1 and Type 2?

Enterprise buyers want Type 2; most ignore Type 1. Type 1 is a useful checkpoint to validate your controls before the observation window starts, but it’s not the deliverable that closes deals.

What about HITRUST?

HITRUST is a stricter framework that maps to HIPAA, SOC 2 and ISO 27001. Few startups need it — pursue it only when a major hospital system explicitly requires HITRUST CSF certification. The audit cost roughly doubles versus SOC 2 alone.

What to Read Next

Ready to ship a compliant telehealth platform?

Buy a BAA-signed platform if your visits are standard; build on an SDK or self-host when you outgrow it. Either way, compliance is architectural: design it in or pay about 3× to retrofit. The combined HIPAA + SOC 2 path runs roughly a third below doing them sequentially, takes 12–15 months from MVP, and wins the enterprise hospital contracts that disqualify non-compliant vendors on the first call.

And keep the facts straight with your buyers: the big 2025 Security Rule changes are proposed, not law; the telehealth enforcement free pass ended in August 2023; and Twilio Video didn’t shut down. Getting those right is part of looking like a team that actually knows this domain.