The video call is the only part of your clinic most patients ever see, and it is also the one piece of technology that can quietly break HIPAA. Practitioners tend to over-think the compliance checklist and under-think the operational one. Both matter, and the good news is that in 2026 the compliant options are cheap; the real decision is where video should live inside your workflow.
What “HIPAA-compliant” means for video
No software is HIPAA-certified; there is no such certification. A platform is usable for PHI when the vendor will sign a Business Associate Agreement and the product is configured so that your use follows the Security Rule. Three requirements are non-negotiable:
- A signed BAA that names your entity. Consumer tiers of popular tools generally do not include one; the business or healthcare tier does. Keep the executed PDF in your compliance folder.
- Encryption in transit and at rest for any recordings, chat transcripts or shared files. If you do not record, make sure recording is disabled by policy and by setting.
- Access controls and audit logs: unique logins per staff member, two-factor authentication, and the ability to see who joined which session.
The COVID-era enforcement discretion that allowed non-compliant consumer apps ended in 2023. A clinic using a tool without a BAA today is simply out of compliance, which is why the Institute’s compliance guide for telemedicine hormone clinics lists the BAA inventory as a launch gate.
Built-in EHR video versus a standalone platform
Most practice-management and EHR systems aimed at cash-pay clinics now include native video. Standalone platforms built for healthcare also exist, and a few general-purpose video tools offer healthcare tiers with a BAA. Here is how the trade-off looks in practice:
| Factor | Built-in EHR video | Standalone healthcare video | General video tool (healthcare tier) |
|---|---|---|---|
| BAA | Covered under the EHR BAA | Separate BAA | Separate BAA, business tier only |
| Patient join experience | From the portal; may require login | Usually one tap, no download | Often requires app or account |
| Chart access during visit | Same screen | Second window | Second window |
| Reliability on weak mobile data | Varies by vendor | Typically strong | Strong |
| Group visits / staff training | Limited | Limited | Excellent |
| Typical added cost | $0–$30 per provider per month | $35–$75 per provider per month | $15–$25 per user per month |
Our clinics default to the EHR’s built-in video for patient visits when its join experience is clean, and keep a general tool with a BAA for team meetings, group education and as a fallback when the EHR’s video has an outage. The costs above are reasonable 2026 estimates, not quotes.
The seven things that actually matter
- No-download, no-account join for patients. Every extra step before the visit raises no-shows. A link in the appointment text that opens in a browser is the standard.
- Works on a phone over cellular. Test it from a parking lot, not your office Wi-Fi. A large share of hormone patients join from a car on a lunch break.
- Waiting room with a check-in signal, so staff can verify identity and location before the clinician joins.
- Screen share for lab review. Walking a patient through their estradiol and hematocrit on screen is a retention tool.
- Audio quality over video quality. Patients forgive a blurry picture; they do not forgive missing half of their dosing instructions.
- Automated reminders with the join link, text and email, at 24 hours and 1 hour.
- Clear recording policy. Most hormone clinics do not record. If you do, consent, storage and retention need to be written down.
Configuration checklist before your first visit
- Sign and file the BAA; note the renewal date.
- Enable two-factor authentication for all staff accounts.
- Disable recording and cloud transcription unless your policy allows them.
- Turn on the waiting room and disable “join before host.”
- Set the clinic name and logo on the join page; patients trust what looks like the website they booked from.
- Run a test visit with a friend on a phone, in a car, on cellular. Fix whatever broke.
- Write a two-line fallback script: if video fails, the clinician calls the patient’s verified phone number and documents the switch to audio and the reason.
Where video sits in the visit workflow
The best platform still fails if the visit around it is sloppy. Intake completed and labs resulted before the call, identity and location confirmed in the waiting room, a visit template open during the call, and a text summary sent within the hour — that sequence is what makes a 20-minute hormone visit feel premium. The Institute’s telemedicine hormone clinic operations playbook maps the full visit so the video tool is one step, not the whole experience.
FAQ
Is a consumer video app with end-to-end encryption HIPAA-compliant?
Encryption alone is not enough. Without a signed BAA and the administrative safeguards around it, the app is not compliant for patient visits regardless of its encryption. Use the business or healthcare tier that includes a BAA.
Do I need a separate platform for audio-only visits?
No, but audio-only has limits: it generally does not qualify for an initial controlled-substance visit, and some states restrict it. Use it for established-patient follow-ups where allowed, and document why.
Should I record visits for documentation?
Most cash-pay hormone clinics do not. Recordings add storage, retention and breach exposure with little clinical benefit when the note is thorough. If you record, obtain explicit consent and set a retention policy.
CLINIC IN A BOX™
Build your telemedicine clinic in 12 weeks — with an operator beside you
Clinic In A Box™ is a private, 1-on-1, done-with-you build: entity, licensing, EHR, labs, pharmacy, pricing, patient acquisition — and your first patients seen by week 12. Limited spots per quarter.