FaceTime is not HIPAA compliant for use with patients. Apple refuses to sign a Business Associate Agreement (BAA) for FaceTime, iCloud, or iMessage, and HIPAA requires that contract before any outside service can handle protected health information (PHI) on a covered entity’s behalf.1HIPAA Journal. FaceTime HIPAA Compliant2HIPAA Journal. iCloud HIPAA Compliant The temporary enforcement discretion that allowed FaceTime for telehealth during COVID-19 ended in 2023, and no similar waiver is currently in place.
Why the Missing BAA Is Disqualifying
A Business Associate Agreement is the contract that binds a vendor to safeguard PHI, report breaches, and share liability with the covered entity. Without one, a hospital, clinic, therapist, insurer, or contractor cannot lawfully route patient information through the vendor’s service. Apple declines to sign BAAs for its consumer services, and iCloud’s terms of service go further by explicitly prohibiting covered entities from using iCloud components in any way that would make Apple a business associate.3Compliancy Group. Is Apple iCloud HIPAA Compliant
FaceTime also lacks the operational features HIPAA’s Security Rule expects. The rule requires audit controls that record and examine activity in systems containing ePHI.4U.S. Department of Health and Human Services. HIPAA Security Rule Technical Safeguards FaceTime has no administrative dashboard, no immutable logging of call metadata tied to workforce identities, and no way to export records for a compliance audit. Access is tied to personal Apple IDs rather than centrally managed healthcare credentials, so an organization cannot enforce role-based access, least privilege, or secure offboarding when staff leave.5AccountableHQ. Is FaceTime HIPAA Compliant: Requirements, Risks, and Alternatives There is no native integration with electronic health record systems for scheduling, consent capture, or charting.
Encryption Is Not the Problem
FaceTime’s security is actually strong. Calls use end-to-end encryption with AES-256 via Secure Real Time Protocol, and Apple states it cannot access or decrypt call content and does not store it on its servers.6Apple. Privacy Features That protection covers one-on-one calls, group calls, SharePlay content during a call, and browser participants on non-Apple devices.
Apple does retain some metadata for up to 30 days: when a call was attempted, who was invited, and the device’s network configurations. It does not log whether a call was answered and states it never stores call content.7Apple. FaceTime Privacy Data For HIPAA purposes, metadata identifying who spoke to a provider and when can itself be PHI, and Apple retains it without a BAA in place. Encryption strength does not substitute for the contract and controls HIPAA requires.
The COVID Waiver Is Over
During the COVID-19 public health emergency, the HHS Office for Civil Rights issued a Notification of Enforcement Discretion allowing providers to use consumer video tools — FaceTime, Zoom, Skype, Google Hangouts, and Facebook Messenger video chat — for good-faith telehealth without penalty for lacking a BAA, whether or not the visit related to COVID-19.8U.S. Department of Health and Human Services. Notification of Enforcement Discretion for Telehealth
That discretion expired at 11:59 p.m. on May 11, 2023. OCR then allowed a 90-day transition period ending August 9, 2023.9U.S. Department of Health and Human Services. Telehealth and HIPAA10Federal Register. Notice of Expiration of Certain Notifications of Enforcement Discretion Since August 10, 2023, providers have been expected to comply with the full HIPAA Privacy, Security, and Breach Notification Rules for telehealth, including having BAAs with technology vendors. No current exception permits FaceTime for patient communications involving PHI.11HIPAA Journal. HIPAA Guidelines on Telemedicine
What You Risk by Using It Anyway
OCR enforces civil monetary penalties on a tiered scale based on culpability:
- Unknowing violations: $100 to $50,000 per violation, with a $25,000 annual cap for repeat violations of the same provision.
- Reasonable cause: $1,000 to $50,000 per violation, with a $100,000 annual cap.
- Willful neglect, corrected: $10,000 to $50,000 per violation, with a $250,000 annual cap.
- Willful neglect, not corrected: $50,000 per violation, with a $1.5 million annual cap.
Criminal penalties, brought by the Department of Justice, can reach $250,000 in fines and ten years in prison when PHI is obtained or disclosed with intent to sell or cause harm.12American Medical Association. HIPAA Violations Enforcement Organizations also face corrective action plans, mandatory breach notifications, and possible exclusion from Medicare.
Compliant Alternatives
Several platforms are built for healthcare, will sign a BAA, and include the administrative controls FaceTime lacks:
- Zoom for Healthcare, a healthcare-specific version of Zoom with a BAA, role-based access, and API integration for clinical workflows.
- Doxy.me, a browser-based telehealth platform with enterprise security that complies with HIPAA and GDPR.
- Microsoft Teams under a healthcare-eligible plan, for which Microsoft offers a BAA.
- Google Meet through Google Workspace for healthcare customers, which offers a BAA and uses a zero-trust security model.
- GoTo, which signs BAAs and offers video encryption, one-time passwords, and the ability to disable recording.
These options generally provide the audit logging, centralized identity management, EHR integration, and documented security controls the Security Rule requires.13Fortinet. HIPAA Compliant Video Conferencing Platforms The dividing line is not encryption quality; FaceTime’s encryption is comparable to or better than several of these. It is the willingness to sign a BAA and the presence of enterprise controls.
The Landline Exception Does Not Cover FaceTime Audio
One narrow carve-out is worth flagging so it isn’t confused with FaceTime. Audio-only telehealth over a traditional landline (the public switched telephone network) is not subject to the HIPAA Security Rule because the information transmitted is not considered electronic, and no BAA with the phone company is required.14U.S. Department of Health and Human Services. HIPAA Audio Telehealth This exception does not extend to VoIP services, smartphone apps, or any technology that transmits data over the internet or cellular networks. FaceTime Audio runs over the internet and does not qualify.
If you have been using FaceTime for patient visits since the waiver lapsed, move those visits to a platform whose vendor will sign a BAA, and document the switch. That is what current HIPAA enforcement expects.