A HIPAA compliant video API is a real-time communication layer that encrypts video, audio, and signaling in transit, keeps no Protected Health Information by default, enforces session-scoped access controls with audit logging, and is backed by a signed Business Associate Agreement (BAA). VideoSDK provides this through TLS and SRTP encryption, JWT-based access, zero default storage, and a BAA add-on on Pay-As-You-Go and Enterprise plans.
Every month, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) adds to its list of healthcare organizations penalized for exposing Protected Health Information (PHI). According to HIPAA Journal's enforcement tracker, OCR imposed 21 financial penalties in 2025, and 789 large breaches affecting roughly 138.5 million people were reported that year. The developer building a telehealth product does not set out to appear on that list. They set out to ship a video consultation feature.
The problem is that a standard WebRTC video API does not make a product HIPAA compliant. Compliance requires a specific combination of encryption, access control, audit logging, contractual agreements, and data handling policies. Choosing the wrong API at the start means retrofitting security later, a process that typically costs more than doing it correctly at integration time.
This article explains what HIPAA actually requires of a video platform, what a BAA covers and what it does not, how encryption and recording rules apply to real-time video, how HIPAA compliant video conferencing platforms compare with building on an API, and what a compliant telehealth call looks like in architecture and code using VideoSDK.
What Is HIPAA?
HIPAA is the Health Insurance Portability and Accountability Act, a U.S. federal law enacted in 1996 that sets national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).
Three HIPAA rules matter for a video product. The Privacy Rule governs how PHI may be used and disclosed. The Security Rule (45 CFR Part 164, Subpart C) sets administrative, physical, and technical safeguards for electronic PHI (ePHI). The Breach Notification Rule (45 CFR Part 164, Subpart D) sets the timelines for reporting a breach. Any organization that handles PHI, including healthcare providers, health plans, and technology vendors acting on their behalf, must comply.
What Is a HIPAA Compliant Video API?
A HIPAA compliant video API is defined as a programmable communication layer that satisfies the administrative, physical, and technical safeguard requirements of the HIPAA Security Rule when handling Protected Health Information during video sessions.
A standard video API works by establishing a server-mediated WebRTC session, routing audio and video streams between participants, and handling session signaling. A HIPAA compliant video API works by adding three layers on top of that baseline: cryptographic protection of all streams and metadata, role-based access controls that enforce least-privilege session access, and formal legal accountability through a Business Associate Agreement between the API vendor and the healthcare organization.
HIPAA governs any organization that is a "covered entity" (healthcare providers, health plans, and healthcare clearinghouses) or a "business associate" (any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity). A video API vendor becomes a business associate the moment its infrastructure carries or stores any PHI, including session metadata that could identify a patient. VideoSDK operates as a business associate under its BAA, encrypts media with SRTP and signaling with TLS, and stores no audio, video, or screen-share data unless the customer explicitly turns on recording. See the VideoSDK HIPAA compliance documentation for the current control list.
The same requirements apply whether the product is described as HIPAA compliant video conferencing, HIPAA compliant video chat, or a HIPAA compliant video call inside a mobile app. The label changes with the interface; the safeguards do not.
What HIPAA Actually Requires of a Video Platform
HIPAA compliance is not a certification badge; it is a set of enforceable rules. Any video API used in a healthcare context must satisfy requirements across three domains of the Security Rule, and the checklist below maps each to the regulation.
Technical Safeguards (45 CFR 164.312)
The Security Rule's technical safeguards, at 45 CFR 164.312, specify what a system handling ePHI must do:
| Safeguard | What the regulation requires | What it means for a video API |
|---|---|---|
| Access control, 164.312(a) | Unique user identification, emergency access, automatic logoff, encryption and decryption | Per-participant tokens scoped to one session, expiring after it ends; roles that separate provider from patient permissions |
| Audit controls, 164.312(b) | Mechanisms that record and examine activity in systems containing ePHI | Session and participant event logs: who joined, when, from where, for how long, delivered by webhook to your own log store |
| Integrity, 164.312(c) | Protection of ePHI from improper alteration or destruction | SRTP authentication tags on every media packet; signed webhooks so your backend can verify events |
| Person or entity authentication, 164.312(d) | Verify that the person seeking access is who they claim to be | Your identity provider authenticates the user; the video token is minted only after that check |
| Transmission security, 164.312(e) | Integrity controls and encryption for ePHI in transit | TLS 1.2 or higher for signaling, DTLS-SRTP for media key exchange, SRTP for media |
A token-based system using JSON Web Tokens (JWT, defined in RFC 7519) satisfies the access-control specification when tokens are scoped to specific sessions and cannot be reused. VideoSDK issues session-scoped JWTs with role-based permissions, which is how least-privilege access is enforced.
Administrative Safeguards (45 CFR 164.308)
The most operationally significant administrative requirement, at 45 CFR 164.308(b), is the business associate contract. A covered entity may permit a business associate to handle ePHI only with satisfactory assurances, documented in a BAA, that the vendor will safeguard it. Operating a telehealth product without a signed BAA from every vendor in the data path is a HIPAA violation on its own, regardless of how strong the encryption is.
Section 164.308 also requires a documented risk analysis and risk management process. OCR's 2025 enforcement actions were dominated by risk-analysis failures, according to law-firm summaries of the year's settlements, so a video vendor's security documentation should feed directly into your own risk analysis file.
Physical Safeguards (45 CFR 164.310)
For a cloud-based video API, the physical safeguards at 45 CFR 164.310 translate to data-center controls: restricted physical access, network isolation between customers, and secure disposal of storage media. Healthcare organizations cannot audit these directly, which is why SOC 2 Type II and ISO 27001 reports serve as the accepted proxy. VideoSDK publishes SOC 2 Type II, ISO 27001, GDPR, HIPAA, and CERT-In on its security page.
What HHS says about telehealth technology specifically
HHS's own guidance at telehealth.hhs.gov states that providers must use vendors that comply with the HIPAA Rules and will sign a BAA for their video communication products. The COVID-era enforcement discretion that allowed FaceTime, Skype, and consumer Zoom for telehealth ended on May 11, 2023. Public-facing tools such as Facebook Live and TikTok were never permitted.
The 2025 proposed Security Rule update
On January 6, 2025, HHS published a proposed rule that would make encryption of ePHI at rest and in transit a required specification rather than an addressable one, mandate multi-factor authentication, and remove the required-versus-addressable distinction almost entirely. As of September 2026 no final rule has been issued, and OMB's regulatory agenda targets July 2027 for final action. A video API that already encrypts everything and supports MFA-gated token issuance is positioned for the change; one that treats encryption as optional is not.
What a BAA Covers and What It Does Not
A Business Associate Agreement makes the video vendor legally accountable for the PHI it touches, but it does not make your application compliant on its own.
A BAA is a legally binding contract between a covered entity and its technology vendor. Under 45 CFR 164.504(e), it must define the permitted uses and disclosures of PHI, require the vendor to implement Security Rule safeguards, require breach reporting to the covered entity, flow the same obligations down to the vendor's subcontractors, and require return or destruction of PHI at termination.
What a video API BAA covers: the vendor's media servers, signaling, session metadata, recording pipeline, and support staff access. It commits the vendor to the technical safeguards above and to notifying you of a breach.
What a video API BAA does not cover: your application code, your database, your identity provider, your cloud storage bucket, patient consent capture, your own staff's access to recordings, and any other vendor in the data path (EHR, scheduling, analytics, error tracking). Each of those needs its own BAA or must be kept out of the PHI path entirely.
Who signs and at what price: vendors differ sharply on BAA availability, and this is where evaluations go wrong. VideoSDK offers HIPAA compliance and a BAA as an add-on on Pay-As-You-Go and Enterprise plans, activated from the Dashboard under Billing -> Add-ons; pricing is custom and quoted by sales, and BAA requests and security documentation go to security@videosdk.live. Daily charges $500 per month for its healthcare add-on. Whereby Embedded lists a $16.99 per month HIPAA add-on on its Build plan and includes it on Enterprise. Twilio signs a BAA only for Security Edition or Enterprise Edition accounts. Zoom Video SDK requires a qualifying paid plan and a signed BAA on request. Vonage has a long-standing HIPAA tier priced through sales. Confirm each figure on the vendor's page before budgeting; the point is that a BAA is rarely free and sometimes unavailable at the tier you planned to use.
Encryption: In Transit, at Rest, and the End-to-End Question
Encryption in transit is required for a HIPAA compliant video API; end-to-end encryption is not required by HIPAA, and most multi-party video is not end-to-end encrypted.
In transit
WebRTC media is protected by SRTP, the Secure Real-time Transport Protocol defined in RFC 3711, with keys negotiated over DTLS as specified in RFC 5764. Signaling, the session setup and join and leave messages, travels over TLS. The W3C WebRTC specification makes this encryption mandatory; a WebRTC endpoint cannot send unencrypted media. VideoSDK encrypts media with SRTP and signaling with TLS, using AES-128 and AES-256 cipher suites. What differs between vendors is whether metadata and chat are also encrypted and whether the vendor publishes its cipher configuration.
At rest
Live video that is never recorded is never at rest. The moment recording is enabled, the file is PHI at rest and must be encrypted. With VideoSDK, recordings are written directly to the customer's own AWS S3, Azure Blob, or GCP bucket using write-only credentials, so at-rest encryption is enforced by the bucket's server-side encryption (AES-256 on S3 SSE) and the customer's key management, not by a shared vendor store.
The end-to-end question
Multi-party calls routed through a Selective Forwarding Unit (SFU) are not end-to-end encrypted by default. The SFU terminates each participant's SRTP session and re-encrypts media toward the other participants, which means the media server can, in principle, access decrypted frames. This is true of every SFU-based provider, including VideoSDK, Zoom, Daily, and Agora, and it is why the BAA and the vendor's access controls matter as much as the cipher.
HIPAA does not require end-to-end encryption. The Security Rule requires transmission security and treats the encryption mechanism as addressable, which under the 2025 proposed rule would become required but still without a mandate for E2EE. VideoSDK offers optional end-to-end encryption using WebRTC insertable frames, in shared-key or per-participant-key modes, documented in the E2EE guide. When E2EE is enabled, server-side recording and transcription are not available, because the server cannot decrypt the media to process it. Choose E2EE when the threat model requires that the vendor never hold plaintext; choose SFU encryption with a BAA when you need recording. For a deeper treatment, see What is end-to-end encryption and how it secures video calls.
HIPAA Compliant Video Recording Rules
Recording a telehealth session is permitted under HIPAA when four conditions are met: consent, encryption, restricted access, and a retention policy.
- Consent. HIPAA itself does not mandate consent for a provider to record a session as part of treatment, but state wiretap and recording laws do, and eleven U.S. states require all-party consent. Capture consent in the application before recording starts and log it.
- Bring your own bucket. Recordings should land in storage you control. VideoSDK's recording API accepts a storage configuration for AWS S3, Azure Blob, or GCP Cloud Storage; VideoSDK uploads with write-only access and cannot read the bucket. See Record a meeting and Configure recording storage.
- Encryption and access. Enable server-side encryption, block public access, restrict IAM roles to the clinical application, and turn on access logging so that every read of a recording is auditable under 164.312(b).
- Retention and disposal. HIPAA requires that documentation be retained for six years, but that applies to policies and compliance records, not automatically to session video. State medical-record laws set retention for clinical content. Define a retention period, enforce it with a bucket lifecycle rule, and document the disposal method.
Individual-track recording and composite recording both remain available in VideoSDK's HIPAA mode. Post-call transcription and AI-generated summaries do not, because they route audio to additional processors; if you need transcripts, generate them in your own HIPAA-aligned pipeline from the recording in your bucket.
GDPR Compliant Video Conferencing
If any patient or clinician is in the European Union, the same video product must also satisfy the General Data Protection Regulation, and the controls overlap with HIPAA but are not identical.
Lawful basis. Under GDPR Article 6 and, for health data, Article 9, processing needs a lawful basis such as the provision of healthcare under Article 9(2)(h) or explicit consent. Record the basis in your records of processing.
Data Processing Agreement. GDPR Article 28 requires a DPA between controller and processor, the GDPR analog of the BAA. VideoSDK provides a DPA on request through security@videosdk.live, and offers GDPR compliance as a Dashboard add-on with custom pricing.
Data residency. VideoSDK's geo-fencing restricts media routing to a chosen region; the documented regions are USA, Europe, India, UAE, Singapore, and Australia, and the feature is available on Enterprise plans. Pinning EU sessions to the Europe region keeps media inside the EU, which simplifies the transfer analysis under Chapter V. The docs note that pinning a region far from the user degrades call quality, so use it for compliance rather than as a default.
Retention and rights. GDPR adds data-subject rights (access, erasure, portability) and storage limitation. Because VideoSDK stores no media by default and recordings sit in your bucket, erasure requests are handled in your own storage rather than through a vendor ticket.
HIPAA Compliant Video Conferencing Platforms vs Building on an API
Finished HIPAA compliant video conferencing platforms suit practices that need a room today; a HIPAA compliant video API suits companies whose product is the telehealth experience.
| Option | Type | BAA availability | Published cost | Best for |
|---|---|---|---|---|
| Doxy.me | Finished telehealth platform | Signed on all plans, including free | Free; Professional $35 and Clinic $50 per user per month | Solo practitioners and small clinics |
| Zoom for Healthcare | Finished meeting platform | On paid healthcare tier, on request | Per-host, from roughly $15 to $20 per month, quotes above | Practices already standardized on Zoom |
| Google Meet (Workspace) | Suite-bundled meeting tool | Business Associate Addendum on paid Workspace | Included in paid Workspace plans | Organizations on Google Workspace |
| Apple FaceTime | Consumer app | No BAA offered | Free | Not permitted for PHI |
| VideoSDK | Video API and SDKs | Add-on on Pay-As-You-Go and Enterprise | Custom-priced add-on plus usage from $0.004 per participant-minute HD | Telehealth products across web and mobile needing recording, whiteboard, SIP |
| Daily | Video API | Healthcare add-on | $500 per month plus $0.004 per participant-minute | Prototypes and web-first telehealth |
| Whereby Embedded | Iframe video API | Add-on on Build, included on Enterprise | $16.99 per month add-on plus $0.004 per participant-minute | Small teams embedding a simple room |
| Twilio Video | Video API | Security or Enterprise Edition only | Enterprise contract plus $0.004 per participant-minute | Existing Twilio customers |
| Vonage Video API | Video API | HIPAA tier via sales | $0.0041 per participant-minute up to 25 publishers | Regulated enterprises already on Vonage |
Prices and BAA terms from each vendor's pricing or compliance page, September 2026. All are subject to change.
Choose a finished platform when clinicians need a link that works today, the video session is not your product, and you can live inside the vendor's interface and feature set.
Choose an API when the consultation must happen inside your own app under your brand, you need to control the waiting room, the intake flow, and the recording pipeline, you integrate with an EHR or scheduling system programmatically, or you serve web and mobile from one backend. The trade is engineering time: with an API you own the compliance configuration described in the next section.
Reference Architecture for a Compliant Telehealth Call
A compliant telehealth call on VideoSDK has four components you build and one you rent: an authenticated token server, role-scoped access, an audit log fed by webhooks, recording to your own bucket, and VideoSDK's encrypted media infrastructure under a BAA.
The flow: your identity provider authenticates the clinician or patient (with MFA for clinicians). Your backend mints a short-lived, role-scoped VideoSDK token and creates a room for the appointment. Both clients join over TLS and SRTP. VideoSDK sends session events to your webhook endpoint, where you write an audit record. If the clinician starts recording, the file uploads directly to your encrypted bucket. VideoSDK retains nothing after the session.
Step 1: authenticate, then mint a role-scoped token on the server
Token generation never happens in the browser. Your backend holds the VideoSDK API secret, and it issues a token only after your identity provider has authenticated the user, with multi-factor authentication for clinicians. The clinician's token carries moderator permissions so they can start recording and remove a participant; the patient's token carries join-only permission. Each token is bound to a single visit's room and expires shortly after the scheduled appointment ends, which satisfies the automatic-logoff and unique-identification points of 164.312(a).
Step 2: create a room per appointment
Your backend creates a VideoSDK room through the REST API for each scheduled visit and stores the room ID against the appointment record. Keep patient names out of room identifiers and out of your application logs; the join between room and patient lives in your own database, not in anything that leaves your system.
Step 3: join the room and record only to your own bucket
Both clients join over TLS signaling and SRTP media using the tokens from Step 1. If the clinician starts a recording, the request names your webhook endpoint and your own storage path, configured once in the VideoSDK dashboard for AWS S3, Azure Blob, or GCP Cloud Storage. VideoSDK uploads with write-only credentials and retains no copy. Capture and log the patient's consent in your application before exposing the record control.
Step 4: build the audit log from webhooks
Subscribe your endpoint to VideoSDK's session and participant events, verify each event, and store it with a timestamp, the room ID, the participant identifier from your own identity system, and the source IP. That table is your 164.312(b) audit control. It should live in your logging store with the same access restrictions as the recordings.
For the room setup and the SDK methods behind each step, see the React quickstart and the React video chat tutorial; recording parameters and storage configuration are documented in Record a meeting and Configure recording storage.
Features that change in HIPAA mode
When the HIPAA add-on is active, VideoSDK disables live transcription, closed captions, post-call transcription, AI-generated summaries, and HLS and RTMP live streaming, because those paths route media to processors not covered by the HIPAA control set. Composite and individual recording, client-side noise cancellation, whiteboard, polls, quizzes, SIP audio and video, and session-only chat remain available. Map these against your feature list before integration, not after.
How to Evaluate Any HIPAA Compliant Video API: A Decision Checklist
Use this checklist before signing a contract with any video API vendor for a healthcare use case.
| Requirement | Questions to ask the vendor |
|---|---|
| BAA availability | Is the BAA available on the pricing tier I intend to use, and what does it cost? |
| Encryption protocols | Do you use TLS 1.2 or higher for signaling and SRTP for media? Do you publish cipher suites? Is E2EE optional, and what does enabling it disable? |
| Storage defaults | Does the platform store any session data by default? Where do recordings go, and can your staff read them? |
| Third-party certifications | Do you hold a current SOC 2 Type II or ISO 27001 report? Can you provide it under NDA? |
| Geo-fencing | Can media routing be restricted to specific regions, and on which plan? |
| Feature restrictions | Which features are disabled in HIPAA mode? |
| Audit events | Which session and participant events are delivered by webhook, and are they signed? |
| Breach notification | What are your incident response and notification timelines, in writing? |
| Sub-processor list | Who are your sub-processors, and are they under downstream BAAs? |
A vendor that cannot answer these questions specifically and in writing is not ready for healthcare production deployments.
Healthcare Teams Building on VideoSDK
Two healthcare and therapy companies have published their results on VideoSDK, and their words are quoted verbatim below.
Examedi, a Y Combinator S21 healthcare-at-home marketplace in Latin America that connects patients with lab tests and telehealth consultations, moved its video to VideoSDK after call failures on a previous provider. Rafael Toro, Head of New Business at Examedi, said: "The speed of implementation, personalized support, and reduced 50% call failures have greatly benefited our telehealth platform." The Examedi case study reports a 50 percent reduction in call failures and a 4.8 out of 5 user experience rating.
Talk Your Heart Out (TYHO), an online therapy platform, migrated from Twilio. Shilpa Jain, CEO and Co-Founder, said: "We switched from a major international player to Video SDK due to their responsiveness to feedback, superior product, and better service." The TYHO case study reports an 88 percent referral rate and 70 percent repeat clients after migration.
Neither case study is a compliance attestation; they document reliability and support outcomes for healthcare and therapy workloads. Compliance evidence comes from the BAA, the SOC 2 Type II report, and the control list in the HIPAA documentation.
Definitions Glossary
HIPAA (Health Insurance Portability and Accountability Act): A U.S. federal law enacted in 1996 that establishes national standards for protecting Protected Health Information and governs how covered entities and business associates collect, store, and transmit patient data.
PHI (Protected Health Information): Any individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate, including names, diagnoses, appointment dates, medical record numbers, and any data that could identify a patient.
BAA (Business Associate Agreement): A legally binding contract between a covered entity and a vendor that defines how PHI will be protected, the vendor's security obligations, breach notification procedures, and permissible uses of the data. VideoSDK provides one under its HIPAA add-on.
SRTP (Secure Real-time Transport Protocol): The encryption protocol, defined in RFC 3711, that protects audio and video media in WebRTC, providing confidentiality, integrity verification, and replay protection.
SFU (Selective Forwarding Unit): A media server that receives each participant's stream and forwards it to the others. SFU-based calls are encrypted hop by hop, not end to end, unless an additional E2EE layer is enabled.
Covered Entity: Under HIPAA, a healthcare provider, health plan, or healthcare clearinghouse that electronically transmits health information in connection with specific transactions.
Geo-fencing: The ability to restrict media routing to specific geographic regions, used to enforce data residency requirements. VideoSDK documents USA, Europe, India, UAE, Singapore, and Australia.
Key Takeaways
- A HIPAA compliant video API requires four elements at minimum: a signed BAA, encryption in transit (SRTP for media, TLS for signaling), session-scoped access controls with audit logging, and no default PHI storage.
- HIPAA does not require end-to-end encryption, and multi-party calls through an SFU are not end-to-end encrypted; the BAA and the vendor's access controls carry the weight that E2EE would otherwise carry.
- OCR imposed 21 financial penalties in 2025 and 789 large breaches were reported, per HIPAA Journal; a missing BAA with a video vendor is a standalone violation.
- VideoSDK provides TLS plus SRTP encryption, JWT-based role-scoped access, zero storage by default, recordings written to the customer's own bucket, geo-fencing across six regions, and a custom-priced BAA add-on on Pay-As-You-Go and Enterprise plans.
- Compliance is shared: the API vendor provides infrastructure controls; the developer owns configuration, consent capture, identity, audit storage, and retention policy.
Conclusion
A HIPAA compliant video API is not a feature toggle. It is a combination of cryptographic controls, a contractual BAA, infrastructure architecture, and configuration discipline, all of which must be in place before the first patient session. Fortune Business Insights valued the global telehealth market at $186.41 billion in 2025, and OCR's proposed Security Rule would make encryption and MFA mandatory rather than addressable. Building on infrastructure that already meets that bar is cheaper than remediating after launch.
VideoSDK's HIPAA-aligned API provides TLS plus SRTP encryption, JWT-based access controls, zero default PHI storage, recording to your own bucket, and a BAA add-on for Pay-As-You-Go and Enterprise accounts. Start with the $20 free credit, no credit card required, at VideoSDK, follow the React quickstart, and activate the HIPAA add-on from Billing -> Add-ons when your telehealth product is ready for production.
Compliance questions go to security@videosdk.live.
Frequently Asked Questions
What is a HIPAA compliant video API?
A HIPAA compliant video API is a programmable real-time communication layer that satisfies the administrative, physical, and technical safeguards of the HIPAA Security Rule. It encrypts all media and signaling in transit, enforces role-based and session-scoped access controls, logs session activity, signs a Business Associate Agreement with the healthcare organization, and does not retain PHI beyond the session unless the customer enables recording into their own storage.
Is Zoom HIPAA compliant?
Zoom can be HIPAA compliant only on Zoom for Healthcare or another eligible paid plan with a signed BAA and HIPAA settings enabled. Free and standard Pro Zoom accounts do not qualify. The same applies to Zoom Video SDK for developers: a qualifying plan and a signed BAA are required before PHI can flow through it.
Is FaceTime HIPAA compliant?
No. Apple does not sign a Business Associate Agreement for FaceTime, so it cannot be used for telehealth involving PHI. The COVID-era enforcement discretion that tolerated FaceTime for telehealth ended on May 11, 2023.
Is Google Meet HIPAA compliant?
Google Meet can be used for PHI only under a paid Google Workspace plan where the organization has accepted Google's Business Associate Addendum and configured the HIPAA-relevant settings. Free Google accounts and consumer Meet are not covered.
Does HIPAA require end-to-end encryption for video calls?
No. The HIPAA Security Rule requires transmission security and treats the encryption mechanism as an addressable specification, which the 2025 proposed rule would make required but still without mandating end-to-end encryption. Hop-by-hop SRTP encryption through an SFU under a BAA meets the rule. VideoSDK offers optional E2EE for cases where the vendor must never hold plaintext, at the cost of server-side recording and transcription.
Does using a HIPAA compliant video API make my entire app HIPAA compliant?
No. The API handles the infrastructure layer. The covered entity remains responsible for patient consent, identity and access configuration, audit log storage, data retention, and ensuring no PHI leaks through other parts of the application or other vendors. HIPAA compliance is a shared responsibility between the API vendor and the developer.
What is a Business Associate Agreement and why is it required?
A Business Associate Agreement is the contract, required by 45 CFR 164.308(b) and 164.504(e), between a covered entity and a vendor that handles PHI on its behalf. It specifies how PHI will be protected, the vendor's security obligations, breach notification duties, and permitted uses. Operating a telehealth product without a signed BAA from every vendor in the data path is a standalone HIPAA violation.
Which video features are disabled in VideoSDK's HIPAA mode?
Live transcription, closed captions, post-call transcription, AI-generated summaries, and HLS and RTMP live streaming are disabled under the HIPAA add-on because they route media to additional processors. Composite and individual recording, client-side noise cancellation, whiteboard, polls, quizzes, SIP audio and video, and session-only chat remain available.
How much does VideoSDK's HIPAA compliance add-on cost?
VideoSDK's HIPAA compliance add-on is custom priced and quoted by sales. It is available on Pay-As-You-Go and Enterprise accounts, activated from the Dashboard under Billing > Add-ons, and includes the BAA and HIPAA-aligned media handling. Usage is billed separately at the standard participant-minute rates.
Can session recordings be HIPAA compliant?
Yes, when the patient has consented, the recording is encrypted at rest, access is restricted and logged, and a retention policy is enforced. With VideoSDK, recordings upload directly to the customer's own S3, Azure, or GCP bucket with write-only access; the customer's bucket must have server-side encryption, blocked public access, and access logging enabled.
What happens if my video API vendor has a data breach?
Under the HIPAA Breach Notification Rule (45 CFR 164.410), a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. The covered entity then notifies affected individuals and, for breaches affecting 500 or more people, HHS and the media. Your BAA should set a shorter contractual notification window than the regulatory maximum.