If you've read our guide to video tools for therapy, you know the whole game comes down to one question: will the vendor sign a Business Associate Agreement? For Zoom the answer is yes — but only on eligible paid plans, and only if you actually complete the process. This article covers exactly that: who qualifies, how to get the agreement signed, and the mistakes that leave therapists exposed while believing they're covered.
Quick refresher: what a BAA is
A Business Associate Agreement is the contract HIPAA requires between you and any company that handles your clients' protected health information on your behalf. A video platform carrying your sessions is squarely in that category. The BAA makes the vendor legally responsible for safeguarding PHI and for notifying you of breaches. Without it, even a perfectly secure call leaves you non-compliant — the agreement, not the encryption, is what the rule requires.
Which Zoom plans can get a BAA
- Free Zoom: never. No free plan qualifies, full stop. If you're seeing clients on free Zoom, you have no BAA and no path to one without upgrading.
- Healthcare plans: yes. Zoom's healthcare offering (currently "Zoom Workplace for Healthcare") is built around the BAA and adjusts features that would otherwise handle data unsafely.
- Business/enterprise tiers: generally yes, on request. Zoom signs BAAs on eligible paid business plans — but it isn't automatic. Buying the plan doesn't create the agreement; you have to request and execute it.
How to actually get it signed
The process is straightforward but has to be completed, not just started: choose an eligible paid plan, then request the BAA — depending on your plan that happens through the admin portal or through Zoom's sales team. Review what it covers, execute it electronically, and save the countersigned copy with its effective date. That signed document is your evidence; "we're on the healthcare plan" without a signed agreement on file is exactly the kind of gap that turns an audit into a finding.
What the BAA does not do
The agreement covers Zoom's responsibilities — it doesn't configure your account. You're still expected to use the platform in a compliant way:
- Meeting security: waiting rooms on, passcodes on, and a unique link per session — never one reusable personal meeting room for all clients.
- Recording: off unless you have a specific, consented reason — recordings create storage and retention obligations most solo practices don't want.
- Invites and reminders: nothing clinical in calendar entries or reminder emails; a time and a link is all a client-facing message should carry.
- Access: strong authentication on your account — the BAA doesn't help if the account itself is easy to break into.
Is it worth it for a solo practice?
It can be — if you're happy managing the plan, the signed agreement, and the settings checklist yourself, and paying video-tool money for it. The alternative worth weighing: a practice platform where telehealth is one feature among the scheduling, notes, reminders, and billing you also need. Theraflow includes HIPAA-conscious telehealth with a BAA included by default — no separate request, no settings audit, one agreement covering your whole practice — as part of the flat $29.99/month plan. (Deciding between the two approaches? Our telehealth guide walks through the checklist.)
Bottom line
Does Zoom sign a BAA? Yes — on eligible paid plans, through a request-and-execute process that you must actually finish, never on the free plan. If you use Zoom for sessions: right plan, signed agreement saved, settings locked down. If that list sounds like a part-time job, that's the argument for keeping telehealth inside your practice software instead.
Related reading: Is Zoom HIPAA-compliant for therapy?, Is Google Meet HIPAA-compliant for therapy? and Is FaceTime HIPAA-compliant for therapy?.