Key takeaways
• “Secure” in a facility is a compliance statement, not a marketing one. The right answer shifts with HIPAA, FedRAMP, CJIS, FERPA, GDPR, and NDAA Section 889, plus whichever jurisdiction the camera points at.
• Deployment topology is the first and biggest decision. Cloud-native, hybrid split-media, on-prem, and air-gapped each trade latency, scale, and attack surface differently. Choose it before you choose a vendor.
• End-to-end encryption is possible but not free. DTLS-SRTP with AES-256-GCM is table stakes; true E2EE (WebRTC insertable streams, MLS) costs you cloud recording, analytics, and some call features.
• Identity is the real attack surface. Most facility-grade breaches start with an over-privileged admin account or an IdP misconfiguration, not a broken cipher.
• Integration is where cost balloons. Wiring video into EHR, LMS, SIEM, SIP PBX, and physical access can double the budget. Scope it up front or pay twice.
Secure video communication software is the layer regulated facilities now run their most sensitive conversations through. Hospitals hold consults over WebRTC; courts hear witnesses on Webex for Government; classrooms stream through Teams GCC or Zoom for Education; power plants pipe camera feeds into remote operations centres. Every one of those workloads sits inside a regulatory envelope — HIPAA, FedRAMP, CJIS, FERPA, GDPR, NDAA Section 889, and a stack of state laws — and every one is a target. This playbook is how Fora Soft builds and chooses that software.
The audience is facility operators and product owners: CISOs, facilities directors, clinical-engineering leads, campus IT, and founders building vertical video platforms for regulated sectors. We cover the threat model, the five engineering layers that actually matter, the standards per facility type, a platform comparison, a reference architecture, real cost math, and a decision framework. The goal is to give you enough to scope the project internally — and, if it is bigger than the team in the room, to show what working with us looks like.
Why Fora Soft wrote this playbook
Fora Soft is a software development company that has built secure real-time video since 2005 — 250+ projects across healthcare, government-adjacent, education, and enterprise. The through-line: none of it fits inside a generic Zoom licence. Every engagement carries a regulatory, latency, or integration constraint that forces custom thinking.
On CirrusMED we run HIPAA-grade WebRTC consults with audited logging and role-based access. On MyOnCallDoc we deliver on-call physician scheduling with integrated video. On BrainCert we run a WebRTC virtual classroom serving 100,000+ customers and 500M+ classroom minutes with FERPA-aware recording controls. On ProVideoMeeting we shipped enterprise conferencing with digital signatures and phone dial-in for compliance-heavy tenants. On Netcam Studio we hardened a multi-camera IP surveillance product for operators who feed video into their own security operations.
We are deep in the open real-time stack too — our teams are LiveKit experts, Agora experts, and WebRTC architects. Agent Engineering inside our delivery pipeline means we ship faster and cheaper than a traditional outsourced team, so factor that in before you compare quotes.
Need facility-grade video but not sure where to start?
Book a 30-minute call and we’ll map your compliance envelope, your current stack, and the shortest path to secure, reliable video for your facility.
What “secure video communication for facilities” really means
The phrase gets used loosely. A working definition has four dimensions, and secure video communication software has to satisfy all four at once.
1. Regulatory-fit. The software meets the controls the facility’s regulator or auditor requires — HIPAA for hospitals, FedRAMP Moderate or High for federal tenants, CJIS for law enforcement, FERPA for schools, GDPR for EU operations, ISO 27001 where an enterprise demands it.
2. Confidential by design. Media is encrypted on the wire and at rest; identities are verified; logs are tamper-evident; the blast radius of a compromised device or account is bounded.
3. Operationally resilient. The system degrades gracefully when a cloud region or the internet drops; an outage does not cascade into physical lockouts, unattended patients, or missed court appearances.
4. Integrated with the facility stack. Video ties into identity (SSO), medical records, learning systems, physical access control, SIEM, and — for many facilities — a SIP PBX older than most of the engineers replacing it.
Reach for the full playbook when: the facility is regulated, multi-site, or mission-critical; the deployment is greenfield; or the current platform just failed its last audit.
The facility threat model — what actually goes wrong
Forget exotic APTs for a moment. The attacks that lose data on facility video systems cluster into five boring, well-documented patterns — and each one maps to a specific defensive layer.
1. Insider and over-privileged admin accounts. The nurse who shares a kiosk login, the contractor whose credential was never revoked, the admin who can join any meeting silently. Most “video breaches” in HHS settlements trace back here.
2. Supply-chain backdoors and banned hardware. A camera or codec running firmware that phones home, a vendor caught by NDAA Section 889, or a third-party SDK quietly shipping audio to an unexpected region.
3. Lateral movement from video into IT or OT. A compromised video gateway shares a VLAN with patient monitors or industrial controllers, and the attacker pivots from a video CVE into the clinical or operational network.
4. Unpatched platform CVEs. In July 2026 Zoom patched CVE-2026-53412, a 9.8-severity Windows flaw that enabled account takeover; roughly 30 Zoom-client CVEs landed across 2025 (average severity 6.3). Webex, Teams, Polycom, and Avaya ship their own. Enterprise patch cycles routinely lag by months.
5. Ransomware on archives. Video archives are high-volume, often poorly backed up, and attractive targets. Clinical and legal archives carry real legal-hold implications the moment an attacker encrypts them.
Figure 1. Five attack paths that lose data on facility video — and the layer that stops each one.
The five layers of a facility-grade video stack
Every layer below closes one of the attack paths above. Skip any single layer and the stack turns fragile.
- Deployment topology — cloud, hybrid, on-prem, or air-gapped, chosen by compliance and latency.
- Encryption — TLS 1.3 signalling, DTLS-SRTP with AES-256-GCM, optional E2EE.
- Identity, access, and audit — SSO, MFA, RBAC, tamper-evident logs.
- Integration with facility systems — EHR, LMS, SIEM, PBX, physical access.
- Operational security and lifecycle — patching, monitoring, incident response, decommissioning.
Figure 2. The five layers — each one maps back to an attack path in Figure 1.
Layer 1 — deployment topology
Where the media and control plane live is the single biggest architectural decision, and the one most teams get wrong by choosing on feelings. The right answer is a function of compliance, latency, scale, and the facility’s IT capacity.
Cloud-native
Zoom for Government, Teams GCC High, Webex for Government, LiveKit Cloud, Daily, Agora, Vonage. Cheapest to stand up, fastest to scale, biggest residual compliance question. FedRAMP-authorized variants exist for federal; HIPAA BAAs exist for healthcare. Use cloud-native when the facility accepts the SaaS boundary and the vendor’s attestations are enough.
Hybrid split-media
Control plane in the cloud, media servers on-prem. The attractive middle ground for facilities that must keep content inside their perimeter — patient-identifiable consults, court proceedings — but lack the team to run a full cloud. Pexip Infinity, LiveKit self-hosted, Jitsi with its Video Bridge, and self-hosted WebRTC SFUs are the typical shapes.
On-premises
Everything runs inside the facility network, usually on a dedicated hardened cluster. Used by defence, intelligence, and some financial institutions. High operational cost, full sovereignty over logs, keys, and media.
Air-gapped
No internet at all — the classified and tactical case. Self-hosted Jitsi, LiveKit, or custom WebRTC stacks, with updates side-channelled through approved media. Rare, but when you need it there is no substitute.
Figure 3. The four topologies scored on the five things that actually decide the call.
Reach for hybrid split-media when: media must stay inside the facility but you still want cloud elasticity for signalling, recording, and monitoring. It is the default for new healthcare and higher-ed builds in 2026.
Reach for on-prem or air-gapped when: a regulator or classification level forbids any third-party custody of media and keys, and you have the operations team to run and patch the cluster yourself.
Layer 2 — encryption and E2EE
Facility-grade encryption is not exotic, but it is specific. Get the defaults right and turn off the fallbacks.
TLS 1.3 for signalling and control
All REST APIs, admin consoles, and SIP signalling ride TLS 1.3 — no 1.0, 1.1, or 1.2 fallback. TLS 1.3 enforces perfect forward secrecy and strips weak ciphers from the negotiation, which blocks the downgrade attacks that still land on facility systems.
DTLS-SRTP with AES-256-GCM for media
Audio and video ride UDP, so DTLS-SRTP (RFC 5764) handles the key exchange and encrypts every packet. Pick AES-256-GCM over AES-CBC: GCM is authenticated, widely hardware-accelerated, and sidesteps the padding-oracle class that bites CBC. Disable fallback to plain RTP at the server explicitly.
True end-to-end encryption
Facilities that need no server-side plaintext can use Zoom’s E2EE mode, Microsoft Teams Premium E2EE, or custom WebRTC with insertable streams. MLS (Messaging Layer Security, RFC 9420, published 2023) is the emerging standard for scalable group E2EE. It is powerful and under-used, but it costs real features: server-side transcription, cloud recording, speaker detection, and some large-scale SFU optimisations either disappear or move to the client. Scope accordingly.
Encryption at rest and key management
Recordings and transcripts are AES-256 encrypted in the datastore, with keys in an HSM or KMS (AWS CloudHSM, Azure Key Vault, GCP Cloud KMS). For FedRAMP and NDAA workloads the module must be FIPS 140-3 validated — and this is a live deadline, not a formality: FIPS 140-2 modules move to Historical status on 21 September 2026, so anything you procure now should already be 140-3. Rotate keys at least annually, and immediately on staff change or suspected compromise. If you want the deeper build detail, our WebRTC architecture for production systems guide covers the media path end to end.
Figure 4. The wire-and-at-rest baseline, plus where optional true E2EE fits.
Reach for true E2EE when: your compliance envelope requires zero plaintext at the server, or your threat model assumes a hostile cloud insider. Otherwise DTLS-SRTP plus encryption-at-rest is plenty.
Layer 3 — identity, access, and audit
If encryption is the fence, identity is the gate. Nearly every facility-scale video breach in public post-mortems traces back to an identity failure, not a broken cipher.
Single sign-on and MFA by default
Residents, clinicians, officers, students, and admins sign in through the facility identity provider (Okta, Microsoft Entra ID, Ping, ADFS) over SAML or OIDC. MFA is enforced for any privileged role. De-provisioning an account in the IdP instantly revokes video access — that is the whole point of central identity.
Role-based access control
Physicians join the consult room but not the legal-hold archive. Students join the class but not the admin console. Security operators view surveillance feeds but cannot delete them. Least privilege is not a nice-to-have; it is the only way to keep audit logs usable.
Tamper-evident audit logs and SIEM
Every session start, join, recording, admin action, and access to stored media lands in an append-only, ideally hash-chained store and ships to a SIEM (Splunk, Elastic Security, Microsoft Sentinel) within minutes. HIPAA, FedRAMP, CJIS, and SOC 2 all require this — not to stop the attack, but to prove what happened when the regulator asks.
Service-to-service identity
Back-end microservices authenticate each other with mutual TLS or signed JWTs. No implicit trust from VLAN membership. NIST SP 800-207 (Zero Trust) is the reference; you need not adopt it wholesale, but every new service should assume it.
Facing an audit on your video stack?
We audit HIPAA, FedRAMP, CJIS, FERPA, and GDPR video deployments, rank findings by exploit likelihood, and hand you a remediation plan without ripping everything out.
Layer 4 — integration with facility systems
A video system that does not talk to the rest of the facility is either shelfware or shadow IT. Integrations are where the real engineering lives and where cost overruns hide.
Healthcare — EHR, HIS, PACS, device feeds
Telemedicine video ties to the electronic health record (Epic, Oracle Health, Meditech) over HL7 v2, FHIR, or SMART on FHIR. DICOM viewers stream into consult rooms. Vitals from medical devices merge with the video feed. Every integration is a new data-flow diagram, a new BAA, and a new line in the DPIA.
Government and law enforcement — CJIS, case management
Courtroom and interrogation video interfaces with case management, evidence management (chain of custody), and CJIS-compliant identity. Recordings become evidence, which means tamper-evident storage with legal-hold, hashed export, and retention driven by statute, not IT policy.
Education — LMS and SIS integration
Classroom video hooks into the learning management system (Canvas, Blackboard, Moodle, Google Classroom) over LTI 1.3 and into the student information system for roster sync. FERPA constrains what can be recorded and who sees it afterward; K–12 adds parental consent.
Physical access and surveillance
Video intercom, badge readers, and CCTV integrate through ONVIF (Profiles A/C/S/T) and OSDP. For the intercom side of this, see the secure intercom systems playbook; for choosing NDAA-clean cameras, our AI security-camera decision sheet walks the procurement checklist, and secure cloud video management covers the recording tier.
SIP and PBX bridges
Many facilities still run a SIP PBX (Asterisk, FreeSWITCH, Cisco CUCM, Avaya). A secure video platform bridges via SIPS/SRTP so dial-in participants ride encrypted paths, and NAT ALG is disabled at the edge because it routinely breaks encrypted SIP.
Layer 5 — operational security and lifecycle
Three operational capabilities separate a system that is compliant on day one from one still compliant on day 365.
1. Patch pipeline with an SLA. Critical CVEs in the video stack get patched within 30 days, high CVEs within 60. Ship on a canary-then-fleet rollout so a bad build never drops a live consult or a court session.
2. Continuous monitoring. SIEM rules tuned to video: failed-auth surges, unusual admin joins, media-server CPU anomalies, DTLS handshake failures, unexpected outbound traffic to unknown regions.
3. Documented incident response and tabletop exercises. Who isolates a compromised media server, who notifies the supervisory authority inside GDPR’s 72 hours, who tells clinicians when the consult platform is down. Drill it at least twice a year.
Standards and compliance by facility type
The matrix below is the one we walk clients through on scoping calls. If your facility maps to multiple rows, the obligations stack.
| Facility type | Primary standards | Must-have controls | Common gotcha |
|---|---|---|---|
| Healthcare (US) | HIPAA + HITECH, SOC 2, state laws | BAA, AES-256 at rest, audit logs, RBAC | Recording transcripts are PHI |
| US federal civilian | FedRAMP Moderate, NIST 800-53 | FIPS 140-3 crypto, MFA, continuous monitoring | Boundary definition for hybrid deploys |
| DoD / intelligence | FedRAMP High, DFARS / NIST 800-171, ITAR | Air-gap or GCC High, US-person operations | Export control on the codec |
| Law enforcement | CJIS Security Policy | AES-256, advanced authentication, CJIS-trained ops | Chain-of-custody for evidence |
| State & local gov | StateRAMP, CJIS (if applicable) | NIST 800-53 Moderate baseline, audit | Varies by state; read each AO requirement |
| Education (K–12, higher-ed) | FERPA, COPPA (K–12), state privacy laws | Parental consent (K–12), student-record protection | Third-party LTI apps share records |
| EU facilities | GDPR, EU AI Act, national DPAs | DPIA, data residency, subject rights | Schrems II — avoid US-only cloud |
| Financial institutions | PCI-DSS, SOX, GLBA, FFIEC | E2EE for regulated calls, retention, surveillance | Regulated recording of client calls |
How the facility platforms compare
A pragmatic cut of the facility-grade platforms, organised by the decision you actually make — FedRAMP, HIPAA, self-hosted, or custom. Pricing is indicative.
| Platform | Shape | Compliance | Starting price | Good fit |
|---|---|---|---|---|
| Pexip Infinity | Hybrid / on-prem | FedRAMP Moderate, HIPAA BAA | ~$15K/year entry | Healthcare, gov, courts |
| Microsoft Teams GCC High / DoD | Cloud | FedRAMP High, ITAR | ~$20/user/month | US federal, DoD |
| Zoom for Government | Cloud | FedRAMP Moderate, HIPAA BAA | ~$25/user/month | Federal civilian, healthcare |
| Cisco Webex for Government | Cloud / hybrid | FedRAMP Moderate, HIPAA BAA | Enterprise negotiated | Federal, large enterprise |
| Jitsi self-hosted | On-prem / air-gapped | Configurable to HIPAA, GDPR | Free + ops | Sovereign deploys, budget-constrained |
| LiveKit Cloud / self-host | Cloud or self-host | SOC 2, HIPAA on request | Free tier, then usage-based | Custom builds, AI-agent video |
| Daily / Vonage / Agora | Cloud SDK | SOC 2, HIPAA BAA available | Usage-based, low entry | Embedded video in vertical SaaS |
| Custom (Fora Soft) | Any topology | Designed to your envelope | Project-based | Differentiated vertical platforms |
One 2024 scare worth correcting: Twilio announced an end-of-life for Programmable Video, then reversed it in October 2024 — Video remains a standalone product, so existing users need not migrate. Single-vendor risk is still real, though, which is why many teams dual-source or build on LiveKit experts and custom WebRTC.
Reference architecture for a hybrid facility deployment
The shape below is what we deploy on most new healthcare and higher-ed facility builds in 2026: hybrid split-media, TLS everywhere, identity through the facility IdP, recording in a customer-managed KMS bucket.
Figure 5. Hybrid facility architecture — media stays on-prem, the cloud runs only the un-regulated control plane.
Three deliberate choices distinguish this architecture. First, media never leaves the facility, which shrinks the compliance surface for recording. Second, the cloud control plane runs only the un-regulated work (scheduling, notifications, metadata analytics), so the cloud side stays small and easy to audit. Third, every integration — EHR, LMS, case management — goes through a dedicated adapter service with its own identity, so an EHR outage never cascades into a video outage.
Mini case — secure video across healthcare, learning, and surveillance
A concrete spread from our own portfolio. On CirrusMED we run HIPAA-grade WebRTC consults with encrypted media, role-based access, and audit trails that pass a BAA walkthrough. On Cloud Doctors and MyOnCallDoc we extend the same pattern to multi-facility coordination and on-call scheduling.
On BrainCert we run WebRTC virtual classrooms for 100,000+ customers and 500M+ classroom minutes, with FERPA-aware recording controls and rolling updates that never drop a live class. On InstaClass and Tabsera we run education- and healthcare-adjacent platforms that reuse the same primitives.
On Netcam Studio we rebuilt a multi-camera IP surveillance platform with PTZ control and event-driven recording — the same primitives underpin facility-grade surveillance integration. On VALT we have been the sole development team for over a decade on a legal- and interview-recording platform used by 770+ US organizations — police departments, courtrooms, and universities — serving 50,000+ users under HIPAA-grade controls and chain-of-custody export. On ProVideoMeeting we ship enterprise conferencing with digital signatures and phone dial-in for regulated tenants. Every one of those engagements has the same shape behind it: hybrid topology, DTLS-SRTP, SSO, audited logs, ONVIF or HL7 integration, and a patch pipeline that keeps CVE response inside 30 days.
Cost model — what a facility-grade build actually costs
The single biggest cost driver is not encryption or identity — it is integration. A facility video platform with HL7, FHIR, LTI, SIP, and ONVIF bridges can triple the budget of the “just the video” scope. Budget for it explicitly.
| Line item | Annual range | What drives it |
|---|---|---|
| Platform licence (commercial) | $15K–$500K | Seat count, FedRAMP tier, number of sites |
| On-prem media infra | $25K–$250K | Hardware, racks, redundancy |
| Integration work (EHR/LMS/PBX) | $50K–$500K | Number and depth of integrations |
| Compliance (audit, DPIA, BAA) | $30K–$120K | SOC 2, FedRAMP ATO, HIPAA scope |
| Ongoing ops + patching | 15–20% of build annually | SLA, patch cadence, monitoring |
| Incident response retainer | $30K–$100K | Outside SOC or integrator-led |
Worked example — a 400-clinician hospital going hybrid. Take mid-range figures from the table. A commercial platform licence near $60K, an on-prem media cluster with redundancy near $90K, six real integrations (Epic, Entra ID, the SIP PBX, the SIEM, badge access, and a DICOM viewer) at roughly $45K each = $270K, and a compliance workstream (SOC 2 refresh, HIPAA scoping, DPIAs) near $80K. That is $60K + $90K + $270K + $80K = $500K in year one. Run-rate at 18% of build is about $90K a year, plus a $40K incident-response retainer.
Notice where the money sits: $270K of that $500K is integration, not video. Agent Engineering compresses exactly those integration and delivery months, so our real quotes usually land below this illustrative math, not above it. When a number is genuinely uncertain, we would rather scope it with you than print it here.
A decision framework — scope in five questions
Q1. What regulated data does the video touch? PHI, CJI, classified, student records, cardholder data? Each answer pulls specific controls into scope.
Q2. Where can the media sit? Public cloud, government cloud, your on-prem, or only behind an air gap? That is the topology decision and the biggest cost driver.
Q3. How many other systems must it touch? Count the EHRs, LMSs, PBXs, SIEMs, access-control panels, and state registers. Above five, treat integration as its own work-stream.
Q4. What is the regulator’s next move? HHS OCR, a FedRAMP PMO review, a state AG, or a DPA. Write the controls that regulator asks about first.
Q5. What is the fail-safe behaviour? When the system breaks, does it default to safe (locked, logged, unavailable) or to open (anyone joins, nothing is recorded)? There is a right answer, and it is “locked and logged.”
Five pitfalls that quietly fail an audit
1. Shadow SaaS. Clinicians sign up for free Zoom accounts because the sanctioned platform is awkward. The auditor finds it. Every facility needs one sanctioned stack and enough UX to keep staff on it.
2. Recording without a retention policy. Archives grow forever, storage cost grows forever, and retention law gets violated both ways. Define retention per content type before you enable recording.
3. Flat VLANs for video. Video systems on the same segment as clinical, operational, or payment networks are a lateral-movement incident waiting to happen. Segment aggressively; allow only the flows the integrations need.
4. Buying for certification, not operations. A FedRAMP-authorized platform still needs your team to run it correctly. The attestation is the floor, not a substitute for your own security programme.
5. Ignoring NDAA Section 889 in the camera supply chain. Prohibited cameras — Hikvision, Dahua, Huawei, ZTE, Hytera — still land in federal and healthcare deployments through integrators, and the FCC has blocked new US authorizations for the worst offenders since 2022. Audit the SKUs and firmware.
KPIs — what to measure
Security KPIs. Mean time to patch a critical CVE (target under 30 days). Privileged accounts per 100 users (target below 2). MFA coverage (100% of admins, 95%+ of clinicians). Failed-auth anomalies detected and handled within 24 hours.
Operational KPIs. Call-setup success rate above 99%. Consult or class MOS (mean opinion score) above 4.0 on a 5-point scale. End-to-end latency under 300 ms. Availability 99.95% inside stated maintenance windows.
Compliance KPIs. 100% of privileged actions logged and shipped to SIEM within five minutes. DPIA coverage on every regulated data flow. Time-to-notify under regulatory thresholds in the last tabletop (72 hours for GDPR). Retention-policy adherence at 100% on sampled archives.
When NOT to build custom
Custom video is not the right answer for every facility. If you are a single-site operator with standard compliance needs, a handful of integrations, and no product-differentiation story built around video, a FedRAMP-authorized or HIPAA-BAA SaaS plus disciplined operations will beat a custom build on both time and cost.
Custom pays off when video is the product (a vertical SaaS in telehealth, ed-tech, or gov-tech), when deep integration with a bespoke EHR or case-management system matters, when latency or sovereignty constraints sit outside what SaaS offers, or when the fleet is large enough that per-seat licence savings swamp the engineering cost. If any of those apply, the rest of this playbook scopes the project.
Building a vertical video platform for a regulated market?
We can pair WebRTC, LiveKit, or Agora specialists with your team, audit your existing stack, or deliver the platform end-to-end under HIPAA, FedRAMP, FERPA, or GDPR scope.
FAQ
Is Zoom HIPAA-compliant?
Zoom can be used in a HIPAA-compliant way with the paid Zoom for Healthcare tier or an Enterprise agreement that includes a Business Associate Agreement. The BAA is the instrument that makes the platform usable for PHI — without it, Zoom is not HIPAA-compliant no matter how much encryption is on. Clinicians using personal Zoom accounts for consults is a common finding in HHS enforcement actions.
What is the difference between FedRAMP Moderate and FedRAMP High?
Both build on NIST SP 800-53, but High adds controls for workloads whose compromise could be catastrophic — defence, intelligence, some law-enforcement data. High requires FIPS 140-3 validated cryptography across the board, stricter incident response, and US-person operations for the provider’s support team. Moderate is the common baseline for federal civilian and most healthcare cloud deployments.
Can a facility run facial recognition on video in Europe?
Only with a lawful basis under GDPR Article 9, a Data Protection Impact Assessment, and increasingly the EU AI Act. Real-time remote biometric identification in public spaces has been prohibited under Article 5 since February 2025 (narrow law-enforcement exceptions), and full penalties — up to €35M or 7% of global turnover — apply from August 2026. Other high-risk biometric uses were pushed to December 2027 by the July 2026 Digital Omnibus. For staff or visitor identification inside a private facility, explicit consent plus a non-biometric alternative is the workable path.
Is Twilio Video shutting down?
No. Twilio announced an end-of-life for Programmable Video in 2024, then reversed the decision in October 2024 — Video remains a standalone product and existing customers need not migrate. That said, single-vendor risk is real for any regulated build, so weigh a self-hostable path (LiveKit, Jitsi, or custom WebRTC) alongside any managed SDK.
Do I need true end-to-end encryption or is DTLS-SRTP enough?
It depends on the threat model. DTLS-SRTP with AES-256-GCM protects media in flight, so network attackers and cloud-path eavesdroppers see nothing. True E2EE additionally protects against a hostile cloud insider or a server compromise at the provider. Most HIPAA deployments are fine with DTLS-SRTP plus strong provider attestations; classified deployments, sensitive legal matters, and some financial workloads warrant true E2EE, accepting the trade-off in recording and analytics.
How do I keep video working when the cloud fails?
Use a hybrid split-media topology and cache authentication and access tokens at the edge, so the facility can keep running 1:1 and small-group calls for a defined offline window (24–72 hours is typical). Scheduling and recording degrade to local, then sync back when the cloud recovers. A fully cloud-native deployment with no offline mode fits only where a brief outage of the video system is acceptable.
What does NDAA Section 889 mean for a facility’s cameras?
Section 889 bans federal agencies and their contractors from using specific Chinese brands — Dahua, Hikvision, Hytera, Huawei, ZTE — as a substantial or essential component of any system, and the FCC has blocked new US equipment authorizations for Hikvision and Dahua since 2022. Even private facilities that serve federal clients now treat NDAA-clean as a procurement baseline. Audit the camera SKUs and firmware in your existing fleet; you may be closer to non-compliance than you think.
How much does a HIPAA-compliant telehealth video platform cost to build?
For a greenfield build with EHR integration, SSO, recording, and production-grade operations, expect first-year cost in the $300K–$1.5M range, with annual run-rate of $150K–$400K. Integration depth is the single biggest driver. An Agent-Engineering-accelerated team compresses the integration months, which lowers cost; we benchmark specific projects on request.
What to read next
Security
Secure Intercom Systems: The 2026 Hardening Playbook
The intercom-specific side of facility video: threat model, five layers, standards.
Security
Secure Cloud Video Management in 2026
The recording and VMS tier that sits behind facility surveillance.
Services
Custom Video & Audio Processing Development
Our engineering service for building facility-grade video platforms.
Healthcare
AI Telehealth Video Platform Development
Purpose-built HIPAA video development for healthcare facilities.
Ready to lock down your facility’s video?
Secure video communication software for facilities comes down to five interlocking layers — topology, encryption, identity, integration, and lifecycle — inside a compliance envelope shaped by HIPAA, FedRAMP, CJIS, FERPA, GDPR, and NDAA. None of the pieces is exotic. What makes facility video hard is operating all of them together, wiring them into the EHR, LMS, PBX, and access systems that already exist, and keeping the whole thing patched.
Apply this playbook and three things happen. Audit failures drop because controls are designed in, not bolted on. Operational incidents drop because identity and segmentation take the common attack paths off the table. And your clinicians, officers, teachers, or operators get a video system that just works — which, for a facility, is the entire point.
Need a facility-grade video stack that passes the audit?
We build WebRTC, LiveKit, Agora, and custom video platforms for healthcare, government, education, and enterprise facilities. Thirty minutes and you leave with an architecture sketch and a delivery plan.
