Platforms for Telehealth: BAA, Plan, Waiting Room, and Price

The same six rows, scored on the room your client actually enters.

Prices and plans reflect provider pages read October 7, 2026. Educational only; confirm the live plan before you buy.

How to score platforms for telehealth

You are choosing a room for a therapy hour, not a logo. The platforms for telehealth that belong on a shortlist are the ones that will sign a business associate agreement for the plan you will pay for, hold a waiting room, and let the client join on the phone they already have.

Write six lines before the demo. BAA, yes or no. The plan that BAA requires. Waiting room. Recording, and where the file lives. What the client must install. Price, including the billing term. A pass is a screen or a signed agreement. A brochure line is not a pass.

If you already pay for an EHR, open that video room on a test client before you add a second subscription. SimplePractice lists telehealth under core features on every plan. TherapyNotes lists Basic Telehealth with every plan. A second tool is the right buy only when that room fails one of the six lines.

The wider stack, chart plus notes plus outcomes, sits in the behavioral health software shortlist. Come back here for the video room. Whether video belongs in the week at all is a different question, covered in benefits of telehealth. The chart under the call is a different buy again. Use telemedicine EHR for the record, not for the waiting room.

What the BAA is, and what a badge is not

A vendor badge that says HIPAA compliant is not a finding by the Office for Civil Rights. Zoom says the same thing on its healthcare pricing page: there is no official organization that certifies HIPAA compliance, and OCR at HHS is the federal body that enforces it. Google says HHS does not offer a certification program for HIPAA compliance. Microsoft says there is no certification standard HHS approves to demonstrate HIPAA compliance by a business associate.

What you can sign is a business associate agreement. If a vendor will create, receive, maintain, or transmit protected health information on your behalf, 45 CFR § 164.502(e) allows that only when you obtain satisfactory assurances, documented in a written contract or other written arrangement. 45 CFR § 164.308(b) and 45 CFR § 164.504(e) are the contract standards that agreement has to meet. HHS explains the business-associate relationship in its business associate guidance.

Read the agreement for the plan name, not for the logo. Doxy.me offers an individual BAA on Free, covering one user and one personal room, and a clinic-level BAA on paid plans. If you downgrade, the clinic-level BAA no longer applies. Zoom offers the BAA on Pro, Business, Business Plus, Enterprise, and other paid plans listed on its pricing page. The healthcare pricing page says you select a paid plan and establish the BAA. SimplePractice enters its BAA when the account is created. TherapyNotes describes HITRUST certification and HIPAA safeguards on its security page and does not name a BAA there. Ask sales for the signed agreement before a client name goes in that room.

A consumer Google account is not the Google Workspace BAA. The Google Workspace HIPAA help page tells customers who have not signed a BAA not to use protected health information in Workspace or Cloud Identity services, and to confirm the service is on the HIPAA included-functionality list. Open that list and confirm Meet is named before you use Meet for a session. A personal Microsoft account is not the Office 365 BAA. Microsoft’s HIPAA offering says Microsoft enters BAAs with covered-entity and business-associate customers for in-scope services, including Office 365. Confirm Teams is on the covered-services list for the plan you buy before you use it for a session.

The video tool does not tell you whether you may see a client who is in another state. Use the interstate telehealth rules for therapists for that question, then come back and score the room.

HIPAA compliant telehealth platforms that cost nothing

Free and covered are not the same sentence. Doxy.me Free is the row in this comparison that includes an individual BAA at $0. Patients do not need an account or an app. They open the link in Chrome, Safari, Firefox, or Edge, including a phone browser, and wait in the waiting room. Recording is not on Free. Audio record and transcript are Premium apps. Group calls, screen share, and the custom waiting room are Premium.

Zoom Basic is $0 and is not a BAA plan. Do not put a client name, a recording, or a chat about care in that account. If you want Zoom, buy Pro or another paid plan and sign the BAA at checkout or through plan management. Pro, read October 7, 2026 in US dollars, was $14.16 per user per month, billed annually as one upfront charge. Business, Business Plus, and Enterprise are contact-sales on that page.

Doxy.me Premium, read the same day in an Australia browser, was A$35 per user per month, billed annually, with a free plan still offered. Confirm the US dollar figure on the Doxy.me pricing page before you compare it with Zoom Pro. The page localizes currency.

If you searched for free HIPAA compliant video conferencing and landed on a consumer Meet or Teams link, stop. Those accounts are not the Workspace or Office 365 agreements above. A room that is free for the client can still be a paid plan for you. Doxy.me is free for the patient on every plan. That does not make Premium free for the practice.

EHR video versus a second subscription

SimplePractice lists telehealth with the core features on every plan, next to unlimited clients, progress notes, and the client portal. Starter was $49 per month, Essential $79, Plus $99, billed monthly, on the pricing page read October 7, 2026. Plus adds group telehealth and additional clinicians starting at $74. The client joins from the Client Portal app or from a browser with the video link emailed before the session. The BAA is part of account creation, so the trial account is not a logo-only promise. Waiting room is not named on the client-join page. Confirm it on the demo before you drop a separate video tool.

Note Taker, an add-on, can generate a note from a telehealth or in-person session whether you record the session or use dictation. That is the recording path the pricing page names. It is not a statement that core telehealth records by default. Price the add-on if you need the file.

TherapyNotes includes Basic Telehealth on every plan. Solo was $69 per month for one user. Group was $79 for the first clinician and $50 for each additional clinician. Premium Telehealth is $15 more per clinician and adds multi-client sessions up to 16 participants, custom backgrounds, and higher-definition video. The telehealth page describes a virtual waiting room before every appointment, a guest link that does not require a portal login, and sessions from a computer, tablet, or phone. Recording is not on that feature list. The security page names HITRUST certification, encryption, and an activity log. It does not name a BAA. Get the signed agreement in writing before the first session.

If the EHR room passes the six lines, do not buy a second subscription to feel covered. If it fails the waiting room, the phone test, or the BAA, Doxy.me or Zoom Pro is the add-on, not a replacement chart. Keep the record in the EHR you will defend.

What to click on the demo

Print the six lines for the platforms for telehealth still on your shortlist. Write the vendor and the date. Refuse the product tour until a test client is in the waiting room on a phone.

Run that sheet on two finalists, not on eight. The second tool is a cost, a login, and another agreement to keep current. Most solo weeks need one room.

If you record, confirm the file stays in the account the BAA covers. A recording that identifies the client is protected health information in that vendor relationship. Do not move it to a personal drive to “tidy up.” Follow your own consent practice before you hit record. This comparison does not set that practice for you.

Download the Vendor Due Diligence Pack

Take the six lines into the demo as a filled sheet, not as a memory. The Vendor Due Diligence Pack is the printable questionnaire with a pass/fail column for the BAA, retention, and who signs.

Score platforms for telehealth on the agreement and the room, then stop. A longer feature list will not fix a client who cannot get in.

References

• Doxy.me. (n.d.). Doxy.me basics: What patients and providers need to know. Retrieved October 7, 2026.
• Doxy.me. (n.d.). Doxy.me Pricing. Retrieved October 7, 2026.
• Doxy.me. (n.d.). How do I know if I need a BAA? Retrieved October 7, 2026.
• Doxy.me. (n.d.). Premium: Plan overview. Retrieved October 7, 2026.
• Google Workspace Help. (2026). HIPAA compliance with Google Workspace and Cloud Identity.
• Microsoft. (n.d.). HIPAA and the HITECH Act. Microsoft Learn.
• SimplePractice. (n.d.). Business Associate Agreement. Retrieved October 7, 2026.
• SimplePractice. (n.d.). Joining a Telehealth Call. Retrieved October 7, 2026.
• SimplePractice. (n.d.). SimplePractice EHR Pricing and Plans. Retrieved October 7, 2026.
• TherapyNotes. (n.d.). HIPAA-Compliant Telehealth. Retrieved October 7, 2026.
• TherapyNotes. (n.d.). Pricing Plans. Retrieved October 7, 2026.
• TherapyNotes. (n.d.). Security & HIPAA-Compliance. Retrieved October 7, 2026.
• U.S. Department of Health and Human Services. (n.d.). Business associates.
• U.S. Department of Health and Human Services. (2013). 45 C.F.R. § 164.308.
• U.S. Department of Health and Human Services. (2013). 45 C.F.R. § 164.502.
• U.S. Department of Health and Human Services. (2013). 45 C.F.R. § 164.504.
• Zoom. (n.d.). Healthcare Pricing. Retrieved October 7, 2026.
• Zoom. (n.d.). Zoom Workplace Pricing. Retrieved October 7, 2026.