Conducting HIPAA-Compliant Zoom Meetings

Zoom technology alone does not make a meeting HIPAA compliant. A meeting involving protected health information (PHI) is HIPAA compliant only when the host:

1. Uses a WJC Zoom account that has been added to the HIPAA-compliant group; and
2. Configures and conducts the meeting according to WJC privacy and security requirements.

HIPAA compliance depends on both the technology configuration and the behavior of everyone participating in the meeting.

Before Using Zoom for PHI

1. Request HIPAA Group Membership

Standard WJC Zoom accounts are not configured for HIPAA-compliant use by default. Before discussing, displaying, or recording PHI, contact support@williamjames.edu and request that your WJC Zoom account be added to the HIPAA-compliant group.

Membership in this group applies additional privacy and security restrictions to the account. Some Zoom features may be limited or unavailable as a result.

2. Review Your Meeting Configuration

Group-level controls reduce risk, but certain settings may still be selected or changed by the host. Review the following checklist before hosting any meeting involving PHI.

HIPAA-Compliant Zoom Meeting Checklist

Meeting Access and Participant Management

• Schedule and host the meeting using your assigned WJC Zoom account.

• Require a meeting passcode and share it only through an appropriate, secure communication channel.

• Enable the Waiting Room and admit only expected participants.

• Disable Join Before Host.

• Do not publish the meeting link, passcode, or dial-in information on a public website, calendar, or social-media page.

• Confirm participant identities before discussing or displaying PHI.

• Lock the meeting after all expected participants have joined, when appropriate.

• Remove any unrecognized or unauthorized participant immediately.

When appropriate: Restrict the meeting to authenticated users. Do not enable this setting when authorized patients, clients, or external providers cannot reasonably sign in with an approved Zoom account. In those cases, use the Waiting Room and verify each participant's identity before admission.

Privacy and Data Protection

• Use the current, WJC-managed Zoom application and do not bypass required Zoom security settings.

• Conduct the meeting from a private location where unauthorized individuals cannot see or hear PHI.

• Use a headset when conversations could otherwise be overheard.

• Position the camera so documents, screens, whiteboards, and other sensitive information are not unintentionally visible.

• Share only the application or window needed for the meeting rather than the entire desktop.

• Limit screen sharing to the host unless another participant specifically needs permission.

• Disable file transfer, remote control, and auto-saving of meeting chat unless there is an approved business or clinical need.

• Do not use unapproved third-party applications, integrations, transcription services, AI assistants, or AI note-taking tools during the meeting.

• Do not copy PHI into meeting chat unless necessary and authorized.

Encryption

WJC Zoom meetings use Zoom's supported encryption protections. Do not weaken or bypass those protections.

Zoom's optional End-to-End Encryption (E2EE) is different from its standard meeting encryption and may disable features needed for a meeting. Enable E2EE only when required by WJC or appropriate for the specific meeting. Contact the IT Helpdesk or Educational Technology if you are unsure which option to use.

Recording

• Do not record a meeting involving PHI unless the recording is necessary, authorized, and permitted under applicable WJC policy and law.

• Inform participants and obtain any required consent before recording.

• Use only WJC-approved recording and storage locations.

• Do not save recordings containing PHI to a personal device, personal cloud-storage account, or other unapproved location.

• Confirm that retention and deletion settings meet the requirements for the information being recorded.

WJC Zoom cloud recordings are automatically copied to the host's YuJa account and deleted from Zoom after seven days. Before recording PHI, confirm that the applicable YuJa account, folder permissions, sharing settings, and retention arrangements are approved for that information. If you are uncertain, do not record the meeting and contact IT or the appropriate WJC privacy/compliance representative.

During and After the Meeting

• Use only your assigned Zoom account; never share account credentials.

• Discuss and display only the minimum PHI necessary for the meeting's purpose.

• Monitor the participant list throughout the meeting.

• Stop screen sharing as soon as it is no longer needed.

• End the meeting for all participants when the session is complete.

• Securely dispose of or store any chat, notes, screenshots, transcripts, or recordings created during the meeting.

• Report suspected unauthorized access, disclosure, recording, or other privacy incident immediately through WJC's established incident-reporting process.

User Responsibilities

Being added to the HIPAA-compliant Zoom group does not automatically make every meeting HIPAA compliant. Hosts are responsible for:

• Completing required HIPAA awareness and privacy training;
• Reviewing meeting settings before each session involving PHI;
• Verifying participant identities and controlling meeting access;
• Following WJC policies governing PHI, recording, retention, and incident reporting; and
• Contacting IT or the appropriate privacy/compliance representative when uncertain.

Operational and Contingency Planning

Departments using Zoom for clinical or other time-sensitive activities involving PHI should establish approved procedures for service interruptions, emergency communications, and authorized access to necessary information. PHI must not be moved to personal accounts, consumer applications, or other unapproved systems when Zoom is unavailable.

Need Assistance?

For HIPAA-group membership, account configuration, or technical assistance, contact support@williamjames.edu.

For questions about whether a meeting, recording, workflow, or use of PHI is permitted, contact the appropriate WJC privacy or compliance representative before proceeding.