As a HIPAA-sensitive practice, which VoIP solutions are willing to sign BAAs and offer documented security compliance?
Data as of Sep 21, 2026 · Based on 317 AI responses from ChatGPT Search and Google AI Mode · See how Parse measures this
Data as of Sep 21, 2026 · Based on 317 AI responses from ChatGPT Search and Google AI Mode · See how Parse measures this
Multiple reputable VoIP providers offer HIPAA-compliant plans with signed Business Associate Agreements and robust security measures. Top recommendations like 
Brands AI recommends here
Named in 80% of answers
A highly recommended enterprise choice offering robust HIPAA-compliant plans with end-to-end encryption, regular audit trails, and signed Business Associate Agreements for secure data management.
Named in 77% of answers
Named in 67% of answers
Named in 58% of answers
Provides specialized healthcare features such as secure on-call scheduling, patient texting, and automated inbound faxing, making it ideal for practices prioritizing patient workflow integration.
Source | Citation share |
|---|---|
 VoIP Providers and HIPAA Compliance: The Ultimate Guidehttps://hipaatimes.com/hipaa-compliant-voip-services | 7% |
 Top 10 Best HIPAA Compliant VOIP Providers | Atlantic.Nethttps://www.atlantic.net/hipaa-compliant-hosting/top-10-best-hipaa-compliant-voip-providers/ | 6% |
 Best HIPAA-Compliant Phone Services for Healthcare Providershttps://www.fax.plus/hipaa-compliant-fax/best-hipaa-compliant-phone-service | 6% |
HIPAA Compliant VoIP: An Ultimate Guide For Healthcare Proshttps://www.ringcentral.com/us/en/blog/hipaa-compliant-voip/ | 4% |
The Top VoIP Providers for the Healthcare Industryhttps://evernetco.com/top-voip-providers-healthcare-industry/ | 4% |
 6 Best HIPAA-Compliant VoIP Services - iFaxhttps://www.ifaxapp.com/hipaa/hipaa-compliant-voip-service/ | 3% |
 Is VoIP HIPAA Compliant? | 360Connecthttps://www.360connect.com/product-blog/is-voip-hipaa-compliant/ | 3% |
5 Best HIPAA-Compliant VoIP Solutionshttps://www.ifaxapp.com/hipaa/best-hipaa-compliant-voip-solutions/ | 2% |
 Best HIPAA compliant VoIP providers February 2026 | FitGaphttps://us.fitgap.com/search/voip-providers/hipaa-compliant | 2% |
Best HIPAA-Compliant Call Center Software + Security Tips - You Concludehttps://www.youconclude.com/hipaa-compliant-call-center-software | 2% |
For a HIPAA-sensitive healthcare practice, utilizing a standard business VoIP configuration is a liability unless the provider explicitly agrees to act as a Business Associate. The following prominent VoIP and unified communication (UCaaS) providers are willing to **sign a Business Associate Agreement (BAA)** and…
For a HIPAA-sensitive healthcare practice, utilizing a standard business VoIP configuration is a liability unless the provider explicitly agrees to act as a Business Associate.
The following prominent VoIP and unified communication (UCaaS) providers are willing to sign a Business Associate Agreement (BAA) and maintain documented security compliance (such as SOC 2 Type II, ISO/IEC certifications, and end-to-end transport encryption like TLS/SRTP):
Crucial Implementation Note: A signed BAA alone does not make your practice compliant. You must ensure that administrative settings (such as turning off unencrypted SMS/voicemail forwarding to unsecured personal devices, enforcing strong password/MFA policies, and securely handling cloud call recordings) are activated within the platform.
To help narrow down the best fit, could you share:
For a HIPAA-sensitive practice, shortlist VoIP vendors that will execute a **Business Associate Agreement (BAA)** and can document safeguards such as encryption, access controls, audit logs, and data handling practices. HIPAA does not provide an official “HIPAA-certified VoIP” badge; compliance depends on the vendor…
For a HIPAA-sensitive practice, shortlist VoIP vendors that will execute a Business Associate Agreement (BAA) and can document safeguards such as encryption, access controls, audit logs, and data handling practices. HIPAA does not provide an official “HIPAA-certified VoIP” badge; compliance depends on the vendor agreement, configuration, and your practice controls.
Commonly considered options:
Before signing, verify:
Avoid relying only on a marketing page saying “HIPAA compliant”; obtain the signed BAA and security documentation as part of vendor due diligence.
Yes. For a HIPAA-sensitive medical practice, I’d put these near the top of the shortlist based on **current vendor documentation for BAAs plus independently documented security/compliance controls**: Provider | BAA | Security/compliance evidence | My take --- | --- | --- | ---
Yes. For a HIPAA-sensitive medical practice, I’d put these near the top of the shortlist based on current vendor documentation for BAAs plus independently documented security/compliance controls:
| Provider | BAA | Security/compliance evidence | My take |
|---|---|---|---|
| RingCentral | Yes, for paying Covered Entity customers | HITRUST CSF; annual SOC 2+ HIPAA Security Rule audit; ISO 27001/27017/27018 | Excellent choice for a full-featured practice phone system |
| 8x8 | Yes | SOC 2 Type II, ISO 27001/27017, HITRUST mapping, HIPAA mapping, NIST alignment | Excellent choice, particularly for larger/multi-site practices |
| Zoom Phone | Yes | SOC 2 + HITRUST report; documented HIPAA program | Very good if you want phone + video/telehealth in one ecosystem |
| Dialpad | Yes, directly through the platform | SOC 2 Type II; ISO 27001/27017/27018; documented HIPAA risk-assessment controls | Strong choice for a modern, relatively easy-to-administer practice |
| Vonage | Yes, particularly for its healthcare/API offerings | Independent HIPAA security audits and BAA documentation | Worth considering, especially for customized communications |
RingCentral is one of the strongest candidates if you want a conventional business VoIP system.
RingCentral says its BAA is available to paying Covered Entity customers, and its HIPAA documentation specifically covers RingEX and other services. It also reports HITRUST CSF certification and an annual third-party SOC 2+ HIPAA Security Rule audit.
Why I'd shortlist it: mature VoIP features, call queues, recordings, administrative controls, integrations, and unusually strong third-party compliance documentation.
8x8 explicitly advertises HIPAA compliance and signed BAAs. Its current security documentation lists SOC 2 Type II, ISO 27001:2022/27017, HITRUST alignment, PCI DSS, and NIST alignment.
Why I'd shortlist it: particularly attractive if you're growing into multiple locations, need contact-center functionality, or want a more enterprise-oriented platform.
Zoom is worth considering if your practice already uses Zoom for telehealth.
Zoom explicitly says it will execute a BAA and makes a SOC 2 + HITRUST report available to healthcare customers. Zoom Phone is included in its healthcare-oriented offering.
One important distinction: HIPAA isn't a certification that a VoIP company simply "has." Zoom itself notes that there is no regulatory-backed HIPAA certification; the important pieces are the BAA, appropriate safeguards, configuration, and your own HIPAA compliance program.
Dialpad is another particularly compelling option for a smaller practice.
Dialpad states that once a BAA is signed, all Dialpad products can be used compliantly by healthcare customers. It documents SOC 2 Type II and ISO 27001/27017/27018 certifications, TLS/SRTP, AES-256 encryption at rest, monitoring, and configurable retention policies. It also says the BAA can be signed directly through the Dialpad application.
Why I'd shortlist it: good combination of HIPAA documentation, modern interface, AI/call-transcription capabilities, and relatively straightforward administration.
Vonage has HIPAA-focused communications offerings and states that its healthcare platform undergoes independent third-party HIPAA security audits and uses BAAs with healthcare customers.
I would put it behind the four above for a straightforward practice phone-system purchase, but it becomes more interesting if you need programmable voice/video/SMS or custom patient communications.
Don't stop at "HIPAA compliant" on the sales page. Ask the vendor for these in writing:
For a typical outpatient practice, I'd start demos with:
1. RingCentral → 2. 8x8 → 3. Dialpad → 4. Zoom Phone
If telehealth/video is as important as traditional telephone service, I'd move Zoom much higher.
And one important caveat: a BAA doesn't make the practice HIPAA-compliant by itself. Your configuration and policies still matter—for example, whether staff record calls, where recordings are retained, who can access voicemail/transcripts, and whether SMS is being used to communicate PHI.
If you tell me your practice size (solo/2–10/10+), whether you need SMS, call recording, fax, telehealth, and your approximate monthly budget, I can narrow these down to the best 2–3 options and compare their HIPAA/security tradeoffs.
Why I'd shortlist it: particularly attractive if you're growing into multiple locations, need contact-center functionality, or want a more enterprise-oriented platform.
Zoom is worth considering if your practice already uses Zoom for telehealth.
Zoom explicitly says it will execute a BAA and makes a SOC 2 + HITRUST report available to healthcare customers. Zoom Phone is included in its healthcare-oriented offering.
One important distinction: HIPAA isn't a certification that a VoIP company simply "has." Zoom itself notes that there is no regulatory-backed HIPAA certification; the important pieces are the BAA, appropriate safeguards, configuration, and your own HIPAA compliance program.
Dialpad is another particularly compelling option for a smaller practice.
Dialpad states that once a BAA is signed, all Dialpad products can be used compliantly by healthcare customers. It documents SOC 2 Type II and ISO 27001/27017/27018 certifications, TLS/SRTP, AES-256 encryption at rest, monitoring, and configurable retention policies. It also says the BAA can be signed directly through the Dialpad application.
Why I'd shortlist it: good combination of HIPAA documentation, modern interface, AI/call-transcription capabilities, and relatively straightforward administration.
Vonage has HIPAA-focused communications offerings and states that its healthcare platform undergoes independent third-party HIPAA security audits and uses BAAs with healthcare customers.
I would put it behind the four above for a straightforward practice phone-system purchase, but it becomes more interesting if you need programmable voice/video/SMS or custom patient communications.
When operating a HIPAA-sensitive practice, finding a VoIP provider that will actually execute a Business Associate Agreement (BAA) and back it up with documented security controls (such as SOC 2 compliance, end-to-end TLS/SRTP encryption, and access controls) is…
When operating a HIPAA-sensitive practice, finding a VoIP provider that will actually execute a Business Associate Agreement (BAA) and back it up with documented security controls (such as SOC 2 compliance, end-to-end TLS/SRTP encryption, and access controls) is critical.
The following prominent VoIP and unified communications solutions are willing to sign BAAs and offer documented compliance frameworks for healthcare organizations, along with important caveats to keep in mind regarding plan tiers and feature limitations:
To help narrow down the ideal provider for your workflow, let me know:
For a HIPAA-sensitive practice, finding a VoIP provider that willingly executes a Business Associate Agreement (BAA) and provides documented infrastructure security (such as `SOC 2 Type II, TLS/SRTP encryption, and audit logs` ) is non-negotiable.[](https://www.ringcentral.com/us/en/blog/hipaa-compliant-voip/)…
For a HIPAA-sensitive practice, finding a VoIP provider that willingly executes a Business Associate Agreement (BAA) and provides documented infrastructure security (such as SOC 2 Type II, TLS/SRTP encryption, and audit logs ) is non-negotiable.
Keep in mind that enabling HIPAA compliance often requires choosing specific healthcare/enterprise tiers and turning off certain unencrypted convenience features (like email transcriptions or portal voicemail playback).
The top VoIP solutions that explicitly sign BAAs and outline documented security compliance include:
To help narrow down the ideal fit for your practice, let me know:
For a HIPAA-sensitive practice, the key question is not whether a VoIP vendor markets itself as “HIPAA compliant.” There is no official HHS “HIPAA-certified VoIP” designation. The practical requirements are that the vendor will execute a **Business Associate Agreement (BAA)** and can provide documented safeguards…
For a HIPAA-sensitive practice, the key question is not whether a VoIP vendor markets itself as “HIPAA compliant.” There is no official HHS “HIPAA-certified VoIP” designation. The practical requirements are that the vendor will execute a Business Associate Agreement (BAA) and can provide documented safeguards (encryption, access controls, audit logs, retention controls, breach procedures, etc.).
The following VoIP/UCaaS providers are commonly considered for healthcare environments because they offer BAAs and publish security/compliance information:
| Provider | BAA availability | Documented security/compliance posture | Good fit for |
|---|---|---|---|
| RingCentral | Yes (typically through eligible business plans) | Publishes HIPAA-related documentation; supports security controls such as encryption, access management, and administrative controls. HipaaKit | Practices wanting a mature all-in-one phone/SMS/video/fax platform |
| 8x8 | Yes | Enterprise UCaaS platform with healthcare use cases and security documentation. Penterra Networks Blog | Larger practices and organizations needing contact-center features |
| Zoom (Zoom Phone / healthcare configurations) | Yes on eligible services | Provides HIPAA support through a BAA and security documentation; configuration matters. JCC Association | Practices already using Zoom ecosystems |
| Microsoft Teams Phone | Yes through Microsoft agreements for eligible services | Requires correct tenant configuration, security settings, and administrative controls. Penterra Networks Blog | Practices already standardized on Microsoft 365 |
| Nextiva | Yes | Listed among UCaaS vendors offering BAA-supported HIPAA configurations. Penterra Networks Blog | Small and mid-sized practices wanting managed communications |
| Dialpad | Yes for eligible healthcare offerings | Provides HIPAA-oriented communications features and security documentation. Penterra Networks Blog | Practices interested in AI-assisted workflows |
| Intermedia Unite | Yes | Offers HIPAA-ready communications with controls around encryption, messaging, archiving, and access. Ringover | Clinics needing unified voice, messaging, and collaboration |
Additional healthcare-focused or smaller vendors that advertise BAA availability include SpectrumVoIP, which documents that customers handling PHI can request a BAA and describes encryption/security practices.
Ask each vendor for:
A final compliance note: even with a signed BAA, the practice remains responsible for configuration, workforce training, access policies, and appropriate handling of PHI.
Yes. For a HIPAA-sensitive practice, I’d focus on vendors that **explicitly offer a BAA plus independently documented security/compliance controls**, rather than providers that merely advertise themselves as “HIPAA compliant.” ### Strong candidates Provider | BAA | Security/compliance documentation | VoIP/phone | My…
Yes. For a HIPAA-sensitive practice, I’d focus on vendors that explicitly offer a BAA plus independently documented security/compliance controls, rather than providers that merely advertise themselves as “HIPAA compliant.”
| Provider | BAA | Security/compliance documentation | VoIP/phone | My take |
|---|---|---|---|---|
| Zoom | Yes | SOC 2 + HITRUST documentation; HIPAA compliance materials | Zoom Phone | Best overall for many practices |
| Nextiva | Yes | SOC 2, ISO 27001, encryption/security documentation | Yes | Very strong traditional business-phone option |
| Dialpad | Yes, for eligible healthcare customers | SOC 2 Type II + security/compliance documentation | Yes | Good modern AI/contact-center option |
zoom.com is unusually clear about the contractual and technical side. Zoom says it executes BAAs with healthcare customers and makes a SOC 2 + HITRUST report available to provide assurance around its controls.
Importantly for your question, Zoom Phone is specifically included under its healthcare/BAA framework. Zoom's healthcare offering describes Zoom Phone as supporting HIPAA requirements, with a signed BAA covering communications such as calls, texts and voicemail.
support.zoom.com also explain how customers execute the BAA; paid plans are eligible, while the free Basic plan isn't.
Why I'd shortlist it: excellent documentation, mature security program, and the phone system can live alongside telehealth/video without introducing another communications vendor.
nextiva.com explicitly states that its healthcare communications platform is HIPAA-compliant with a signed BAA, SOC 2 certified, and uses encryption, role-based access controls and automatic redaction.
Nextiva also documents TLS/SRTP encryption, SOC 2 auditing and ISO/IEC 27001-certified data centers in its enterprise security materials.
One interesting caveat: Nextiva deliberately disables some functionality on HIPAA-configured accounts—for example, certain voicemail transcription and fax-related features—to reduce PHI exposure.
Why I'd shortlist it: particularly attractive if you want a conventional business phone/contact-center system rather than a telehealth-centric platform.
dialpad.com says eligible healthcare customers can obtain a BAA, and describes its HIPAA approach as a shared-responsibility model rather than simply claiming that the product is intrinsically “HIPAA certified.”
Dialpad also reports SOC 2 Type II audits and completion of the Cloud Security Alliance CAIQ, alongside controls addressing encryption, access and handling of ePHI.
Why I'd shortlist it: compelling if AI-assisted call handling, transcription, contact-center features or a modern unified communications interface are priorities—but I'd scrutinize exactly which AI/transcription features are covered by your BAA before enabling them.
Don't stop at “HIPAA compliant” on the sales page. I'd ask each vendor for:
One important distinction: HIPAA doesn't award a general “HIPAA certification” to VoIP vendors. What matters is whether the vendor will enter into the required BAA and whether its technical/administrative safeguards and your configuration support your HIPAA obligations. Zoom explicitly makes this distinction as well.
My starting shortlist: Zoom Phone if you want the strongest combination of documentation + phone + telehealth; Nextiva if phone/contact-center functionality is the priority; Dialpad if AI/unified communications is particularly important.
If you tell me your approximate practice size (e.g. 1–5, 5–25, or 25+ users) and whether you need SMS, call recording, fax, EHR integration, or AI transcription, I can narrow these down and compare pricing, BAA scope, security certifications, and HIPAA-specific feature limitations.
support.zoom.com also explain how customers execute the BAA; paid plans are eligible, while the free Basic plan isn't.
Why I'd shortlist it: excellent documentation, mature security program, and the phone system can live alongside telehealth/video without introducing another communications vendor.
nextiva.com explicitly states that its healthcare communications platform is HIPAA-compliant with a signed BAA, SOC 2 certified, and uses encryption, role-based access controls and automatic redaction.
Nextiva also documents TLS/SRTP encryption, SOC 2 auditing and ISO/IEC 27001-certified data centers in its enterprise security materials.
One interesting caveat: Nextiva deliberately disables some functionality on HIPAA-configured accounts—for example, certain voicemail transcription and fax-related features—to reduce PHI exposure.
Why I'd shortlist it: particularly attractive if you want a conventional business phone/contact-center system rather than a telehealth-centric platform.
dialpad.com says eligible healthcare customers can obtain a BAA, and describes its HIPAA approach as a shared-responsibility model rather than simply claiming that the product is intrinsically “HIPAA certified.”
Dialpad also reports SOC 2 Type II audits and completion of the Cloud Security Alliance CAIQ, alongside controls addressing encryption, access and handling of ePHI.
Why I'd shortlist it: compelling if AI-assisted call handling, transcription, contact-center features or a modern unified communications interface are priorities—but I'd scrutinize exactly which AI/transcription features are covered by your BAA before enabling them.
**Several major business VoIP providers explicitly sign Business Associate Agreements (BAAs) and offer robust, documented security frameworks (such as TLS/SRTP encryption, audit logs, and access controls) tailored for HIPAA-covered entities** **.** [](https://www.ringcentral.com/us/en/blog/hipaa-compliant-voip/)…
Several major business VoIP providers explicitly sign Business Associate Agreements (BAAs) and offer robust, documented security frameworks (such as TLS/SRTP encryption, audit logs, and access controls) tailored for HIPAA-covered entities .
Top VoIP Solutions Supporting BAAs and HIPAA Compliance
| Provider | Core Security & Compliance Highlights | BAA Availability | Best Suited For |
|---|---|---|---|
| RingCentral MVP | HITRUST CSF certified, robust TLS/SRTP encryption, advanced audit trails. | Available on upper-tier plans | Enterprise healthcare & multi-site practices |
| Nextiva | Encrypted data paths, secure voicemail-to-email, strict user access controls. | Available upon request/enterprise plans | Small-to-medium single or multi-site clinics |
| Zoom Phone | AES 256-bit GCM encryption, role-based access control, secure call recording. | Available on paid healthcare accounts | Practices heavily utilizing telehealth/video |
| Phone.com | HIPAA-enabled extensions, TLS encryption, dedicated compliance protocols. | Available with HIPAA-enabled upgrade | Budget-conscious or smaller independent practices |
Essential Implementation Steps
If you'd like, I can:
For a HIPAA-sensitive practice, finding a VoIP or Unified Communications as a Service (UCaaS) provider comes down to a non-negotiable requirement: **they must sign a Business Associate Agreement (BAA)** because features like cloud voicemails, call recordings, and message logs mean they store Protected Health…
For a HIPAA-sensitive practice, finding a VoIP or Unified Communications as a Service (UCaaS) provider comes down to a non-negotiable requirement: they must sign a Business Associate Agreement (BAA) because features like cloud voicemails, call recordings, and message logs mean they store Protected Health Information (PHI).
Below are the prominent VoIP solutions that explicitly execute BAAs and provide documented security compliance (such as SOC 2 Type II and ISO certifications), along with how they handle compliance:
[email protected]).Crucial Best Practices for Implementation
If you'd like to narrow this down further, let me know:
Epic
epic.com
Yes. For a HIPAA-sensitive medical practice, I’d put **RingCentral, Nextiva, and Zoom Phone** near the top of the shortlist because they publicly document both the BAA relationship and substantive security/compliance controls. Provider | BAA | Documented security/compliance | My take --- | --- | --- | ---
Yes. For a HIPAA-sensitive medical practice, I’d put RingCentral, Nextiva, and Zoom Phone near the top of the shortlist because they publicly document both the BAA relationship and substantive security/compliance controls.
| Provider | BAA | Documented security/compliance | My take |
|---|---|---|---|
| RingCentral | Yes — available to paying covered-entity customers | HITRUST-certified applications; security addendum; HIPAA documentation | Strongest overall choice for a conventional business phone system |
| Nextiva | Yes — for its covered HIPAA services | SOC 2, ISO 27001, PCI-DSS, HIPAA/BAA; TLS/SRTP; penetration testing | Very good practice-friendly option |
| Zoom / Zoom Phone | Yes | SOC 2 + HITRUST reporting; HIPAA compliance attestation; encryption and extensive security controls | Excellent if you also want video/telehealth |
| 8x8 | Appears to support HIPAA programs | SOC 2 Type II, ISO 27001, CSA, and HIPAA compliance programs documented | Worth getting a written BAA confirmation before purchase |
RingCentral is particularly compelling if you're primarily looking for a phone/PBX replacement. Its HIPAA documentation says its BAA is available to paying covered-entity customers, covers the RingCentral services that may process PHI, and extends BAA requirements to relevant subcontractors. It also reports HITRUST CSF Certified status for RingEX, RingCX and the RingCentral App.
Nextiva is another strong candidate for a medical practice. Its healthcare offering explicitly describes HIPAA compliance with a signed BAA, SOC 2 certification, encryption, role-based access controls and automatic redaction. Its security documentation also identifies ISO 27001, SOC 2, PCI-DSS and HIPAA programs.
Zoom Phone makes sense if your practice wants phone + video/telehealth in one ecosystem. Zoom says it signs BAAs with healthcare customers and provides a SOC 2 + HITRUST report; its healthcare materials also describe a third-party compliance attestation.
8x8 publicly lists HIPAA alongside SOC 2 Type II and ISO 27001 among its compliance programs. I'd nevertheless have its sales/legal team explicitly confirm which exact 8x8 products are covered by the BAA before signing.
A vendor saying "HIPAA compliant" isn't enough. HIPAA doesn't provide a simple vendor certification that makes your practice compliant. Your practice remains responsible for configuring and using the system appropriately. Zoom itself explicitly notes that there is no regulatory-backed "HIPAA certification."
Before selecting one, I'd ask each vendor for:
If this were my shortlist for a typical outpatient practice: RingCentral first, Nextiva second, Zoom Phone third, with 8x8 as a serious fourth option. The deciding factor would then be whether your workflow needs SMS, voicemail transcription, call recording, fax, EHR integration, or telehealth, because HIPAA restrictions can differ substantially by feature.
RingCentral is particularly compelling if you're primarily looking for a phone/PBX replacement. Its HIPAA documentation says its BAA is available to paying covered-entity customers, covers the RingCentral services that may process PHI, and extends BAA requirements to relevant subcontractors. It also reports HITRUST CSF Certified status for RingEX, RingCX and the RingCentral App.
Nextiva is another strong candidate for a medical practice. Its healthcare offering explicitly describes HIPAA compliance with a signed BAA, SOC 2 certification, encryption, role-based access controls and automatic redaction. Its security documentation also identifies ISO 27001, SOC 2, PCI-DSS and HIPAA programs.
Zoom Phone makes sense if your practice wants phone + video/telehealth in one ecosystem. Zoom says it signs BAAs with healthcare customers and provides a SOC 2 + HITRUST report; its healthcare materials also describe a third-party compliance attestation.
8x8 publicly lists HIPAA alongside SOC 2 Type II and ISO 27001 among its compliance programs. I'd nevertheless have its sales/legal team explicitly confirm which exact 8x8 products are covered by the BAA before signing.
A vendor saying "HIPAA compliant" isn't enough. HIPAA doesn't provide a simple vendor certification that makes your practice compliant. Your practice remains responsible for configuring and using the system appropriately. Zoom itself explicitly notes that there is no regulatory-backed "HIPAA certification."
Before selecting one, I'd ask each vendor for:
