Is Doximity HIPAA Compliant for Medical Clinics?

Verdict: Yes — purpose-built with a BAA

Doximity is one of a small number of clinical communication tools designed from the ground up for healthcare professionals. It offers a Business Associate Agreement and is built to meet HIPAA transmission-security requirements for clinical messaging, fax, and telehealth.

This is a different starting point from most software categories covered in these guides. The question for Doximity is not whether a BAA exists — it does — but whether the clinic has it executed and whether Doximity use fits within a functioning compliance program.

BAA availability

Doximity provides a BAA for covered entities and business associates. The BAA is a standard part of organizational onboarding. Clinics should ensure the BAA is executed under the appropriate organizational account, not simply through an individual clinician’s profile.

What Doximity covers

Secure messaging. Doximity’s encrypted messaging between verified clinicians is designed to meet the HIPAA Security Rule’s transmission-security standard. Messages are not transmitted via standard SMS or email infrastructure.

Digital fax. Doximity Fax provides digital fax that routes through secure infrastructure. The clinic’s staff can send and receive PHI by fax through the platform under the BAA.

Doximity Dialer. Doximity’s Dialer feature allows clinicians to call patients from a clinic or mobile phone while displaying the clinic’s phone number — protecting the clinician’s personal number and keeping the call record on the clinical side. Dialer is designed for HIPAA-compliant telehealth under the BAA.

Getting started: BAA execution and organizational setup

Doximity’s BAA availability does not mean the BAA is automatically in place. Covered entities must:

1. Create an organizational account. Individual clinician accounts are not sufficient for covered-entity compliance. The clinic must establish a Doximity organizational account that can be governed under the BAA.
2. Execute the BAA. Contact Doximity’s healthcare organization team to execute the BAA for the organizational account. Keep a signed copy in the clinic’s vendor records.
3. Provision staff access through the organizational account. Staff with access to Doximity organization features should be provisioned through the organizational account, not through personal clinician profiles, to ensure access is revocable at the organizational level.
4. Set a deprovisioning procedure. Document how the clinic will remove access when staff leave, including a specific person responsible for executing deprovisioning in Doximity when an employee departs.

Access control considerations

Doximity’s verification requirement — that users must be licensed clinicians — provides a meaningful baseline for access control within the clinical messaging network. However:

• The clinic’s broader workforce may include non-clinician staff (front desk, billing, administration) who may have access to certain Doximity organization features
• Staff turnover requires prompt deprovisioning of Doximity access at the organizational account level
• Shared devices at a clinic workstation require a policy to ensure Doximity sessions are not left accessible to unauthorized users

Doximity Dialer: HIPAA-compliant patient calls

Doximity Dialer allows a clinician to call a patient from a mobile device while displaying the clinic’s main phone number rather than the clinician’s personal number. This is designed specifically for HIPAA-compliant telehealth under the BAA. The call record stays on the clinical side, and the patient’s callback destination is the clinic’s published line.

This is a meaningful compliance advantage over using a personal cell phone, where the call record exists only on the clinician’s personal device and the patient may call back on a non-clinical line. Clinics using Doximity Dialer should confirm that call logs are accessible through the organizational account and reviewed as part of the clinic’s audit routine.

What Doximity does not replace

Doximity handles secure clinical communication. It does not provide:

• a risk analysis under 45 CFR § 164.308(a)(1)
• workforce training records and attestations
• incident response tracking and documentation
• written policies and procedures

For comparison with communication tools that do not have a BAA, see Is WhatsApp HIPAA compliant? and Is FaceTime HIPAA compliant?. For the broader vendor evaluation framework, see PHI tools and vendor management.