Is Zoom compliant for telehealth? Consumer video vs purpose-built

There’s no simple yes-or-no answer, because “compliant” isn’t a badge a video app carries. Whether any tool is acceptable for telehealth depends on how patient information is handled from end to end — security, where data is stored, consent, and record-keeping. A general-purpose consumer video app can sometimes be used in narrow situations, but it isn’t built for clinical care, which is why most Australian clinics use purpose-built telehealth software.

Here’s how to think it through. This is general information, not legal advice — check the current OAIC and RACGP guidance and your own indemnity provider before you decide.

“Compliant” isn’t a property of the app

Privacy law doesn’t certify individual video products. Your obligations attach to you — the health service provider handling the information — and the question is whether your whole process meets the Australian Privacy Principles and professional standards. A tool can make that easy or hard, but it can’t discharge the duty for you.

The RACGP frames the practical test well: whatever system you use must be fit for clinical purposes, with sound and image quality suitable for clinical use, and it’s on the practitioner to ensure the solution meets their clinical requirements and satisfies privacy laws (RACGP). So the real question isn’t “is Zoom compliant?” — it’s “does the way we run telehealth meet our obligations, using this tool?”

A video call being encrypted doesn’t make your telehealth compliant, any more than a locked filing cabinet makes a paper practice compliant. Compliance is about the whole handling of patient information — collection, storage, access, disclosure and records — not one feature of one app.

What clinical video actually needs

Line up the obligations and a specification emerges. Clinical telehealth needs:

• Security — you must take reasonable steps to protect health information from unauthorised access, loss and misuse, which for video means encrypted connections and proper access controls (OAIC).
• Appropriate data handling and residency — you need to know where consult data goes and who can reach it, including whether anything is stored or accessible overseas (see health data residency in Australia).
• Consent and privacy — a private setting, clear consent to the format, and no surprise recording.
• Records that stay in your system — clinical notes belong in your practice software, not stranded in a meeting tool.

The OAIC’s guide to health privacy sets out the underlying obligations, and its guide to securing personal information covers the security side — including ICT controls, access management and the handling of third-party and cloud services.

Where consumer video tools tend to fall short

General-purpose video apps are designed for meetings and webinars, and their defaults reflect that. Common gaps for clinical use:

• Recording defaults and cloud storage — meeting tools often make recording easy and store it in the vendor’s cloud, creating health records you didn’t intend to keep and may not control.
• Data residency — consumer platforms are frequently hosted overseas or spread across global regions, which raises the APP 8 cross-border issues covered in our data residency guide.
• Accounts and friction — requiring patients to install an app or create an account adds barriers and, sometimes, another party collecting their data.
• Meeting-link hygiene — reusable links, weak waiting-room controls and the risk of the wrong person joining aren’t clinical-grade by default.
• Records — nothing flows into your clinical system, so documentation lives elsewhere unless you re-enter it.

None of this means a consumer tool is automatically unlawful — it means using one shifts a lot of configuration, risk assessment and ongoing management onto you, and leaves more room to get it wrong.

A fair word on vendor “healthcare” versions

Some vendors, including Zoom, offer healthcare-oriented products or configurations with additional protections. If you’re considering one, the onus is on you to verify the specifics for the Australian context: where data is stored, whether recordings are made or retained, who can access the data, what the contract says about APP compliance and cross-border handling, and whether the whole setup is fit for clinical purpose. Don’t assume a “for healthcare” label settles the question — check it against your obligations and, where relevant, your indemnity provider’s advice.

It’s also worth remembering that a healthcare tier usually costs more and still leaves configuration in your hands: the paid plan may enable stronger controls, but someone has to turn them on, keep them on, and check them as the product changes. Much of the appeal of purpose-built telehealth is that the safe settings are the defaults, not options you have to maintain.

What purpose-built telehealth changes

Dedicated telehealth software starts from the clinical requirements instead of retrofitting them. The design choices that matter are made for you: encrypted 1:1 video, no recording by default, onshore data handling, and a patient join flow that doesn’t demand an app or account.

MedCall is built exactly this way. It’s made for Australian clinicians, Australian-hosted and never records, with 1:1 calls end-to-end encrypted; the patient joins by tapping a texted link — no app, no account — and your booking, notes and billing stay in your existing practice software. That last point matters for compliance: the video tool does the video, and your clinical record stays where it belongs. For a structured way to compare options, see how to choose telehealth software.

So — is Zoom compliant for telehealth?

The honest answer is that it depends on the exact product, configuration and how your practice uses it — and that’s precisely why the question is hard to answer with a consumer tool and easy to answer with a purpose-built one. If you have to spend effort making a meeting app safe for clinical use, and then keep managing that risk, you’re doing work that dedicated telehealth software does by design. That’s the calculation most Australian clinics have made.

The bottom line

Compliance for telehealth isn’t a feature of a video app; it’s a property of how you handle patient information overall. Consumer video tools can sometimes be pressed into service, but their defaults — recording, offshore storage, extra accounts, no clinical records — pull against your obligations, so most clinics choose purpose-built software instead. Judge any tool against the OAIC’s guide to health privacy and the RACGP’s principles for conducting telehealth consultations, and confirm the specifics with your indemnity provider.