For about three years, federal regulators looked the other way.
During the COVID-19 public health emergency, the HHS Office for Civil Rights (OCR) said it would not penalize providers for using everyday video apps for telehealth. Practices across the country took the shortcut, because FaceTime was free, fast, and already installed on most patients' phones.
That grace period is over. The public health emergency ended on May 11, 2023, and OCR's transition period closed on August 9, 2023. Since then, the full HIPAA rules have applied to every virtual visit your practice conducts.
So the question matters again: is FaceTime HIPAA compliant?
It's a reasonable thing to ask. FaceTime is Apple's built-in video and audio calling app, available on iPhones, iPads, Macs, and even the Apple Watch. Your patients already understand how to use it, and your staff probably uses it every day with friends and family, so it feels like the obvious answer.
It isn't.
FaceTime is not HIPAA compliant, and using it for patient care can put protected health information at risk. That exposure can lead to financial penalties, a required breach notification, and lasting damage to the trust your patients place in your practice.
But the reasons behind that answer matter just as much as the answer itself. Some come from the law, while others come from how a real practice operates on a busy day, with patients waiting, staff juggling phone calls, and physicians running behind.
In this guide, you'll learn why FaceTime is so tempting for telehealth and where it breaks down once you depend on it.
You'll discover what HIPAA requires from a video platform and why encryption alone doesn't satisfy those requirements. You'll also see how a platform designed for healthcare compares, feature by feature, so you know exactly what to look for.
It's no surprise that so many providers have considered FaceTime for virtual visits, because on the surface it checks a lot of boxes. Here are the three biggest reasons it seems like such a convenient solution for busy medical practices.
If you own an Apple device, FaceTime is already included at no extra cost. Skipping a monthly subscription can look like smart budgeting, especially since most telehealth platforms charge a recurring fee.
But free doesn't always mean cheaper. FaceTime lacks the tools a healthcare practice depends on, so your team ends up filling the gaps with phone calls, text messages, and additional apps, and that lost time accumulates quickly.
Here's a simple example.
If your staff spends 5 extra minutes per visit on workarounds, and you hold 20 virtual visits a day, that's 100 minutes lost daily. Over a five-day week, it comes to more than 8 hours, or about one full workday, spent on tasks a proper platform would handle for you.
Most Apple users have made at least one FaceTime call, whether to catch up with family or check in with a friend. You might assume that familiarity puts patients at ease, especially those who aren't comfortable with technology.
The catch is how it appears to your patients. A personal chat app can make your practice seem less professional, and it may blur the line between a medical appointment and a casual call. The better choice is a tool that feels just as simple for patients but was designed specifically for clinical care.
FaceTime is genuinely easy to use: you open the app, choose a contact, and tap the video or audio button. Even older patients can usually manage it without assistance.
Still, it requires some setup first. Patients need to be signed in with an Apple ID, and they need your number saved or shared, which is enough to cause a missed appointment for some seniors. A better option lets patients join from a simple text link, with nothing to download or configure.
FaceTime may be free and familiar, but it has many downsides when considering it for telemedicine use. And that’s before we break down whether it is HIPAA compliant or can be.
This is a major downside of FaceTime. You won’t have to worry about exchanging medical documents in a HIPAA-secure way because you can’t send any files at all. That means you have to use another platform for document exchange.
For example,
If a doctor needs to share a patient’s lab results or any other kind of medical report during the appointment, they have to juggle between different communication channels.
The same goes for patients.
If you want your online patient visits to be as efficient as your in-person visits, you have to replicate your workflows online.
During a patient’s in-person visit, a medical staff member checks them into their room, and the doctor comes in when the patient is ready. After the appointment, they check out with the medical staff and may receive a prescription, instructions, or necessary paperwork. They also pay for the appointment.
With FaceTime, it’s impossible to mimic this process. The doctor has no way of knowing when the patient is ready for the virtual visit. The medical staff would have to let the doctor know in one of the following ways:
That is impractical and can be frustrating for the patient and medical staff. Choosing a telemedicine platform with a virtual waiting room is the solution to this problem. In a virtual waiting room, doctors and staff can see which patients are waiting and when they are ready for the consultation.
A proper telemedicine platform has a feature that allows healthcare providers collect payments and share sensitive documents securely to medical staff.
If more than two people have to be present during an appointment, that can be a problem with FaceTime. Some appointments require the presence of several medical personnel, and sometimes, doctors like to have assistants taking notes for them.
FaceTime allows for group video calls but not for all Apple devices. That imposes yet another restriction on what patients can have a virtual visit with you.
A massive issue with considering FaceTime for telemedicine is that some of your patients won’t own an Apple product. They may have an Android phone or PC computer. That would make them ineligible for telemedicine visits, or you would have to find a second platform to use for those patients.
This is undoubtedly a serious issue. Many patients will be left out, which may lead to patient and revenue loss. It may even result in a bunch of negative reviews for your practice, which damages your reputation.
Even with the disadvantages of FaceTime, if you’re still considering using it for telemedicine, you have to address the most significant issue: HIPAA compliance. Does FaceTime adhere to the HIPAA regulations, making it HIPAA compliant?
As a HIPAA-covered entity, if you need to communicate protected health information (PHI) for telemedicine purposes (when electronically, ePHI), the software or app you use must be HIPAA compliant, and the company that owns it your business associate (BA).
The BA needs to enter into a business associate agreement (BAA) with you. The contract guarantees that your HIPAA-defined responsibilities for protecting and securing ePHI transfer to your BA as well. In other words, the agreement guarantees that your BA adheres to HIPAA rules to protect sensitive patient data.
Apple doesn’t state anywhere that it would enter into a BAA for FaceTime with anyone. That may be because FaceTime is a consumer app; enterprise apps are different since they market to business entities rather than individuals.
FaceTime has end-to-end encryption, meaning only end-users of the app have access to it, and all data is secure during transit. That is one of the HIPAA requirements, but there’s also a rule that requires a BA to have access controls in place.
Once you set up FaceTime, there are no access and authentication controls. Anyone can open the app on your device since FaceTime does not require a password. HIPAA requires restricted access as a safeguard for PHI, so that makes FaceTime a non-HIPAA-compliant platform for telemedicine use.
Even if FaceTime satisfied all the HIPAA requirements and had the required safeguards in place, it still couldn’t be HIPAA-compliant if Apple is unwilling to sign a BAA.
Now that you know FaceTime is not HIPAA compliant, you need to find a telemedicine solution that meets all of the regulations while providing features that every healthcare practice requires.
|
Key Takeaway: Encryption Is Not the Same as Compliance Many apps advertise strong encryption, which can make them sound safe for patient care. But HIPAA compliance depends on three things working together: a signed BAA, the right safeguards (access controls, audit logs, and encryption), and a vendor that stands behind both in writing. Before you use any app for telehealth, ask the vendor one question first: "Will you sign a business associate agreement with us?" If the answer is no, the conversation is over, no matter how secure the app claims to be. |
FaceTime isn't a telehealth platform. It lacks HIPAA compliance and the features a medical practice needs to run virtual care every day. Curogram is a fully HIPAA-compliant platform designed from the ground up for healthcare providers.
Key features of Curogram include:
You can also share medical documents with patients in a simple way that keeps PHI protected. Patients join visits from a text link, so there's no app to download and no Apple ID required.
The results reach beyond telehealth. Practices that use Curogram see no-show rates 53% below the industry average. For your team, that means fewer empty slots, fewer follow-up calls, and more time spent on care.
Here's how Curogram and FaceTime compare:
| Feature | Curogram | FaceTime |
|---|---|---|
| EHR Integration | Yes | No |
| Advanced Waiting Room Management Tools | Yes | No |
| Secure Document Transfer | Yes | No |
| In-Person Workflows | Yes | No |
| Multi-Provider Appointments | Yes | Limited |
| Works for Android and Windows Patients | Yes | Join-only via link |
| Business Associate Agreement (BAA) | Yes | No |
| HIPAA Compliance | Yes | No |
FaceTime is a great app. It's just not a healthcare app.
It's easy to understand why so many providers turned to it during the pandemic, when it was free, familiar, and ready to use while practices scrambled to adapt. For a while, regulators permitted it because practices had few alternatives.
That time has passed. Since the COVID-era relief ended on August 9, 2023, every virtual visit you conduct must satisfy HIPAA's requirements, and FaceTime doesn't. Apple won't sign a BAA for it, and the app lacks the access controls and audit logs HIPAA expects.
The practical problems matter just as much as the legal ones. You can't send files during a call, check patients in, or see who's waiting, and group visits depend on each patient's device. Every gap forces your staff to patch things together with phone calls, text messages, and additional tools, and every workaround introduces more risk.
The good news is that you don't have to choose between convenient and compliant. The right telehealth platform gives patients the same simple experience they expect from FaceTime: they tap a link and join the visit. Behind the scenes, your practice gets the safeguards, workflows, and documentation HIPAA demands.
When you evaluate options, start with the basics. Will the vendor sign a BAA, and does the platform offer a virtual waiting room, secure file sharing, and payments? Does it integrate with your EHR so your staff isn't entering the same information twice? Can every patient join, regardless of their device?
Curogram checks every one of those boxes, combining telehealth, two-way texting, reminders, and payments in one HIPAA-compliant platform built for busy practices.
Ready to leave the workarounds behind? Book a demo to see Curogram's HIPAA-compliant telehealth in action and discover how simple secure virtual care can be for your practice.
Frequently Asked Question