The short answer
Yes. Doxy.me is HIPAA-compliant, with a Business Associate Agreement (BAA) available at no extra cost on Free and Premium plans.
Free plans
An individual BAA covers you and your Personal Room, where you meet with patients.
Premium plans
A clinic-level BAA covers everyone within your clinic account, including solo providers.
Generate and download yours in Settings using the BAA guide.
02
Protection behind your appointments
Doxy.me encrypts audio and video communications, connections to the platform, and stored server data. Encryption makes information unreadable without the keys needed to access it.
Doxy.me has also undergone an independent SOC 2 Type 2 audit, which examines security controls over a period of time.
Optional recording and appointment-note tools have their own data-handling details and consent requirements. Review these before use, and protect any information you download.
03
Privacy in everyday practice
Encryption can protect a call in transit, but it can’t stop someone nearby from overhearing an appointment.
Your practice still needs individual staff logins, appropriate access, protected devices, private appointment spaces, and secure record storage. Include telehealth in your risk assessment and train staff to handle privacy concerns.
To review the supporting documentation, visit the Doxy.me Trust Center and read the privacy policy.