HIPAA IT Services
HIPAA Video Conferencing
Self-hosted video conferencing that keeps patient discussions off third-party servers. Powered by Jitsi Meet with JWT authentication, role-based access, and identity-locked participants — deployed on infrastructure you control.
All video and audio streams are encrypted in transit. Your meetings stay on your server — no data passes through third-party infrastructure, and no vendor has access to your call content.
Every meeting link contains a signed JWT token that the server validates before granting access. No token, no entry. Unauthorized users cannot join even if they have the room URL.
Each participant gets a unique link with their name and role embedded in the token. Display names are locked at join time — no one can impersonate another participant mid-session.
Schedule one-off or recurring meetings with automatic calendar exports. Participants receive ICS files with timezone-aware scheduling and meeting links that expire after the session window.
Runs entirely on servers you own or lease. No third-party data processors, no BAA negotiations with video vendors, and no ambiguity about where ePHI resides during a call.
Staff authenticate through your existing identity provider — Keycloak, Authentik, Okta, Azure AD, or Google Workspace. Admin roles assigned automatically from OIDC group claims.
How a typical engagement works
1. Configure your instance
We set up a Jitsi Meet server on your infrastructure with JWT authentication, your branding, and your security policies baked in from the start.
2. Connect your identity
We integrate the admin panel with your existing SSO provider so staff can log in and start scheduling meetings with the same credentials they already use.
3. Start meeting securely
Your team schedules meetings, generates participant links, and shares calendar invites. We stay on for ongoing management or hand you the keys.
Frequently asked questions
Why self-hosted instead of Zoom or Teams?+
With Zoom or Teams, your meeting data passes through third-party servers, which means signing BAAs, trusting vendor controls, and hoping their next breach doesn't include your patient discussions. Self-hosted Jitsi keeps all video, audio, and metadata on infrastructure you control. No third-party data processors, no BAA negotiations, and no ambiguity about where ePHI lives.
What makes this HIPAA compliant?+
Every meeting is protected by signed JWT tokens that authenticate participants before they can join. Video and audio are encrypted in transit. The server runs on your infrastructure with no data leaving your network. Role-based access controls ensure only authorized staff can create and moderate meetings. Combined with audit-ready logging, this satisfies the HIPAA Security Rule's technical safeguards for access control, transmission security, and audit controls.
Can patients or external participants join without an account?+
Yes. Each participant receives a unique, time-limited link with their identity embedded in the token. They click the link and join directly — no account creation, no app download. Their display name is locked to prevent impersonation, and the link expires after the scheduled meeting window.
Does it integrate with our existing identity provider?+
Yes. The admin panel supports SSO via any OIDC-compliant provider including Keycloak, Authentik, Okta, Azure AD, and Google Workspace. Staff authenticate through your existing IdP, and admin roles can be assigned automatically based on group claims.