HIPAACOMPLIANCE
GUIDE
HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) lays out privacy and security standards
that protect the confidentiality of patient health information. In terms of video conferencing, thesolution and security architecture must provide end-to-end encryption and meeting access controls
so data in transit cannot be intercepted.
The general requirements of HIPAA Security Standards state that covered entities must:
1. Ensure the confidentiality, integrity, and availability of all electronic protected health information
the covered entity creates, receives, maintains, or transmits.
2. Protect against any reasonably-anticipated threats or hazards to the security or integrity ofsuch information.
3. Protect against any reasonably-anticipated uses or disclosures of such information that are
not permitted or required under the privacy regulations.
4. Ensure compliance by its workforce.

How Zoom Enables HIPAA Compliance
We sign the HIPAA Business Associate Agreement (BAA) for our healthcare customers (minimum$200), meaning we are responsible for keeping your patient information secure and reporting
security breaches involving personal healthcare information. We do not have access to identifiable
health information and we protect and encrypt all audio, video, and screen sharing data.
The following table demonstrates how Zoom supports HIPAA compliance based on the HIPAA
Security Rule published in the Federal Register on February 20, 2003 (45 CFR Parts 160, 162, and164 Health Insurance Reform: Security Standards; Final Rule).
July 2017

HIPAA Compliance GuideZoom Video Communications, Inc.

HIPAA Standard

How Zoom Supports the Standard

Access Control:• Implement technical policies andprocedures for electronic informationsystems that maintain electronic protected
health information to allow access only toauthorized persons or software programs.
• Unique User Identification: Assign a uniquename and/or number for identifying andtracking user identity.
• Emergency Access Procedure: Establish(and implement as needed) proceduresfor obtaining necessary electronic healthinformation during an emergency.

• Meeting data transmitted across thenetwork is protected using a unique
Advanced Encryption Standard (AES) witha 256-bit key generated and securely
distributed to all participants at the start ofeach session.
• Multi-layered access control for owner,admin, and members.
• Web and application access are protectedby verified email address and password.
• Meeting access is password protected.
• Meetings are not listed publicly.

• Automatic Logoff: Implement electronic
procedures that terminate an electronic
session after a predetermined time ofinactivity.
• Encryption and Decryption: Implementa mechanism to encrypt and decrypt
electronic protected health information.

• Zoom leverages a redundant anddistributed architecture to offer a high levelof availability and redundancy. In addition,
Zoom regularly performs snapshots of ourdata and can quickly assist the customer
with data restoration and access totheir data kept in Zoom’s cloud.
• Meeting host can easily disconnect
attendees or terminate sessions inprogress.
• Host can lock a meeting in progress• Meeting ends automatically with timeouts.

Audit Controls:• Implement hardware, software, and/orprocedural mechanisms that record andexamine activity in information systems that
contain or use electronic protected healthinformation.

• Meeting connections traverse Zoom’ssecured and distributed infrastructure.
• Meeting connections are logged for audio
and quality-of-service purposes.
• Account admins have secured access tomeeting management and reports.

July 2017

HIPAA Compliance GuideZoom Video Communications, Inc.

Integrity:• Implement policies and proceduresto protect electronic protected healthinformation from improper alteration ordestruction.

• Multi-layer integrity protection is designed
to protect both data and service layers.
• Controls are in place and protect data inmotion and at-rest.

Integrity Mechanism:• Mechanism to authenticate electronic
protected health information.
• Implement methods to corroborate that
information has not been destroyed oraltered.

• Application executables are digitally signed.
• Data transmission is protected using HMACSHA-256 message authentication codes.

Person or Entity Authentication:• Verify that the person or entity seeking
access is the one claimed.

• Web and application access areprotected by verified email and password.
• Meeting host must log in to Zoom usinga unique email address and accountpassword.
• Access to desktop or window for screen
sharing is under the host’s control.

Transmission Security:• Protect electronic health information that isbeing transmitted over a network.
• Integrity controls: Ensure that protected
health information is not improperly
modified without detection.
• Encryption: Encrypt protected healthinformation.

• End-to-end data security protects
against passive and active attacks on
confidentiality.
• Data transmission is protected using HMACSHA-256 message authentication codes.
• Meeting data transmitted across thenetwork is protected using a unique
Advanced Encryption Standard (AES) witha 256-bit key generated and securely
distributed to all participants at the start ofeach session.

Security and Encryption
Only members invited by account administrators can host Zoom meetings in accounts with multiplemembers. The host controls meeting attendance through the use of meeting IDs and passwords.
Each meeting has only one host unless a co-host is purposefully added by the host. The host canJuly 2017

HIPAA Compliance Guide
Zoom Video Communications, Inc.

screen share or lock screen sharing. The host has complete control of the meeting and meeting
attendees, with features such as lock meeting, expel attendees, mute/unmute all, lock screen
sharing, and end meeting.
Zoom employs industry-standard end-to-end Advanced Encryption Standard (AES) encryption using
256-bit keys to protect meetings. Zoom encryption fully complies with HIPAA Security Standards toensure the security and privacy of patient data.
Screen Sharing in Healthcare
Medical professionals and authorized healthcare partners can use Zoom to meet with patients andother healthcare professionals to screen-share health records and other resources. Zoom does not
distribute the actual patient data. Screen sharing transmits encrypted screen capture along withmouse and keyboard strokes only, not the actual data. Zoom further protects data confidentiality
through a combination of encryption, strong access control, and other protection methods.

HIPAA Certification
Currently, the agencies that certify health technology – the Office of the National Coordinator for
Health Information Technology and the National Institute of Standards and Technology – do “notassume the task of certifying software and off-the-shelf products” (p. 8352 of the Security Rule),
nor accredit independent agencies to do HIPAA certifications. Additionally, the HITECH Act only
provides for testing and certification of Electronic Health Records (EHR) programs and modules.
Thus, as Zoom is not an EHR software or module, our type of technology is not certifiable by theseunregulated agencies.

Other Security Certifications
SOC2:
The SOC 2 report provides third-party assurance that the design of Zoom, and our internal processes and controls, meetthe strict audit requirements set forth by the American Institute of Certified Public Accountants (AICPA) standards for security,availability, confidentiality, and privacy. The SOC 2 report is the de facto assurance standard for cloud service providers.

TRUSTe:TRUSTe has certified the privacy practices and statements for Zoom and also will act as dispute resolution provider for
privacy complaints. Zoom is committed to respecting your privacy. If you have an unresolved privacy or data use concernthat we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free ofcharge) at https://feedback-form.truste.com/watchdog/request.

EU-US Privacy Shield:
Zoom participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework. Zoom has committed
to subjecting all personal data received from European Union (EU) member countries, in reliance on the Privacy Shield
Framework, to the Framework’s applicable principles. To learn more about the Privacy Shield Framework, visit the U.S.
Department of Commerce’s Privacy Shield List https://www.privacyshield.gov/list.

July 2017