HIPAA Compliant Videoconferencing Cost in 2026

This is the healthcare software category with the widest gap between how much pricing gets quoted and how much of it the vendors actually publish. Two of the most-recommended platforms in HIPAA telehealth, Zoom and Doxy.me, publish no citable amount at all. Microsoft, Google and VSee do. This page separates them, states each vendor's own unit, and gives you the drivers to price the rest.

Every figure below is read off the vendor's own pricing surface and checked July 2026. Where a vendor publishes nothing, this page says nothing rather than estimating.

Who publishes what

What the published cards work out to

Note what these examples do not include: Microsoft 365 is a whole productivity suite rather than a telehealth product, so counting its licence as a telehealth cost only makes sense if you would not otherwise buy it. That is a judgement about your own estate, which is why this site does not roll these into a category total.

The post-discretion reality

From March 2020 through August 2023, OCR announced enforcement discretion that did not impose penalties on covered entities using non-public-facing remote communication products for telehealth, which in practice covered consumer-grade tools with no BAA behind them. This was the Notification of Enforcement Discretion for Telehealth, and it was wound down effective 11 August 2023.

Practices that adopted consumer-grade platforms during the pandemic and never migrated are outside 45 CFR 164.312(e)(1) transmission security with no discretion to fall back on. The realistic exposure is enforcement by patient complaint rather than a proactive sweep, but the defence that existed until August 2023 does not exist now.

The unusual thing about this particular gap is how cheap it is to close. Both Doxy.me and VSee publish a $0 tier that carries a BAA, so for a low-volume solo practitioner the licence cost of moving onto a BAA-eligible platform can be nothing at all. The cost that remains is the part nobody publishes: updating your risk analysis to cover the platform, executing the BAA, and training the workforce on the new workflow. See telehealth and digital health for the layers around the video itself.

What decides this, where no price exists

• BAA availability, which is binary. A platform either offers one or it is not a candidate. No rate rescues a platform that will not sign. Doxy.me, VSee, Microsoft, Google and the EHR-embedded options all execute BAAs through self-service or standard contract terms; consumer FaceTime and Skype consumer do not offer one at all.
• The seat unit. Per user, per provider and per host are three different meters. Work out your clinician-to-workforce ratio before comparing any two rates, because that ratio decides which meter is cheaper for you.
• Session volume and group sessions. Behavioural health running group, family or peer-support sessions needs multi-participant video. Some EHR-embedded telehealth is one-to-one only, which rules it out regardless of price.
• EHR integration. Usually the real decision. If the visit is scheduled, conducted and charted in one workflow, the time saved outweighs a better standalone video product for most practices. If your EHR embeds telehealth, confirm in writing what is included rather than assuming.
• Recording, if you do it. A recorded session is ePHI and inherits the whole Security Rule: storage, access control, audit logging and the six-year documentation retention at 45 CFR 164.316(b)(2)(i). Recording is permitted for treatment, payment or operations with reasonable safeguards, and patient authorisation is required beyond that. Most practices decide the cheapest recording policy is not to record.

HIPAA video cost FAQ

Related cost guides