An SFU (Selective Forwarding Unit) is a media server that receives each participant's audio and video stream and forwards selected streams to the other participants without decoding or re-encoding them. Because it only routes packets rather than processing the picture, its server CPU stays modest, and it scales group consults far better than a mesh peer-to-peer arrangement, where every participant would have to upload a separate copy of their video to every other participant. The SFU also pairs naturally with simulcast: each sender can publish several quality layers, and the SFU forwards to each receiver the layer that matches that receiver's available bandwidth.
For a telemedicine product, the SFU is the pragmatic default for any call beyond two people — a clinician, a patient, an interpreter, and a family member can share one consult without the connection collapsing. It is also the natural place to attach recording, to observe call quality (loss, jitter, bitrate), and to enforce who is allowed to subscribe to whose stream.
That central role carries a compliance consequence that teams sometimes miss. Because the SFU terminates the encrypted media and re-encrypts it onward, it can see the PHI-bearing audio and video in the clear inside the server. That means the SFU and its surrounding infrastructure must sit inside your HIPAA compliance boundary and be covered by a Business Associate Agreement (BAA) if a vendor operates it. Treating the SFU as "just plumbing" outside the compliance scope is a serious and common mistake.
