Is Loom HIPAA-Compliant for Recording EHR Training Videos?

No. Loom says it cannot currently sign a HIPAA Business Associate Agreement (BAA) and is not HIPAA-compliant. If recording an electronic health record (EHR) could capture protected health information (PHI), don’t use Loom for that recording. Instead, use a training environment with synthetic data or an approved recording service with the appropriate safeguards and agreement in place.

Can Loom sign a HIPAA Business Associate Agreement?

No. Loom’s current guidance says it cannot sign Business Associate Agreements to support customers’ HIPAA compliance, and advises customers not to send it personal health information if doing so would violate their HIPAA obligations. Loom’s HIPAA guidance is the clearest source for its current position.

A BAA is a contract that sets out a business associate’s responsibilities for protecting PHI. If a vendor handles PHI on behalf of a covered entity or business associate, your organization should determine whether a BAA is required and confirm that the specific service is covered before using it with PHI. A vendor’s security features or certifications do not replace that agreement or make the customer’s use HIPAA-compliant by themselves.

Why is Loom not suitable for recording EHR screens with PHI?

An EHR recording can capture protected health information (PHI) in the video, audio, captions, transcript, or other parts of the recording. Because Loom says it cannot sign a BAA and is not HIPAA-compliant, recording a live EHR screen that exposes PHI may send or store information with a service that has not agreed to handle it under a BAA.

Use a non-production training environment with synthetic data instead. If a real-patient workflow must be recorded, consult your privacy or compliance team and use only a recording solution your organization has approved for that use, with any required BAA and safeguards in place.

What patient information can screen recordings expose?

PHI is not limited to a patient’s name. It can include identifying details connected to health, care, or payment information. A recording might expose:

• Names, dates of birth, addresses, phone numbers, email addresses, or medical record numbers.
• Diagnoses, medications, allergies, laboratory results, clinical notes, appointment details, or billing information.
• Patient photos, unique case details, or combinations of age, dates, location, and clinical events that could identify someone.
• Information in browser tabs, notifications, search results, pop-ups, window titles, or another open application.
• Details spoken aloud, shown in captions or transcripts, or revealed through screen sharing beyond the intended EHR window.

HHS explains that identifiable health information can be PHI and that identifiers may appear in structured fields or free text. Its guidance on de-identification describes the HIPAA Privacy Rule’s methods and identifier requirements.

How can you create EHR training videos without PHI?

Build the demonstration around a training or sandbox environment that contains synthetic patient data rather than copied patient records. If the EHR vendor provides a demo system, confirm with your organization that the environment is approved for recording and that its data is not drawn from identifiable patient records.

• Use fictional names, dates, contact details, record numbers, and clinical histories.
• Keep the recording focused on the required workflow; close unrelated apps, tabs, and patient charts.
• Disable desktop notifications and avoid capturing system audio, camera video, or other content that is not needed.
• Review the finished recording, audio, captions, transcript, thumbnail, title, and sharing settings before distributing it.
• Ask your privacy or compliance team to approve the training workflow and the recording and storage tools.

The minimum necessary standard generally calls for reasonable efforts to limit PHI use or disclosure to what is needed for the purpose, where that standard applies. It is not a substitute for avoiding PHI when a training video can be made with synthetic data. See HHS guidance on the minimum necessary requirement.

How do synthetic and de-identified data differ?

Synthetic patient data is created to represent realistic records without intentionally using a real person’s information. It can be useful for training, but check that it does not reproduce or reveal details from real patient records. “Synthetic” by itself is not a HIPAA de-identification method.

De-identified health information is information that meets the HIPAA Privacy Rule’s de-identification standard. HHS describes two methods: Safe Harbor, which removes specified identifiers and requires no actual knowledge that remaining details could identify someone, and Expert Determination, which uses a qualified expert to determine that identification risk is very small and document the analysis. Simply hiding names or replacing them with initials does not establish that information is de-identified.

HHS notes that properly de-identified information may still carry some risk of re-identification. For a specific dataset, have your organization assess whether it meets the applicable standard before using it in a recording. See HHS de-identification guidance.

What screen details should you check before recording?

Before you press record, inspect the entire screen—not just the main EHR panel. Confirm that the environment contains no real patient information and check for:

• Patient names, initials, photos, medical record numbers, and account or insurance identifiers.
• Dates, locations, diagnoses, medications, notes, test results, and appointment details.
• Browser tabs, bookmarks, URLs, open windows, and patient records in the background.
• Desktop or EHR notifications, chat messages, email previews, and pop-up alerts.
• Microphone audio, video thumbnails, captions, transcripts, filenames, and generated summaries that could reveal sensitive information.

HHS recognizes that incidental uses or disclosures can occur as a by-product of an otherwise permissible use or disclosure, but its guidance describes safeguards and the minimum necessary standard where applicable. Treat incidental disclosure as a risk to prevent—not as permission to record an exposed patient screen. See HHS guidance on incidental uses and disclosures.

What are the limits of using Loom for EHR training?

Loom can be used for training videos that do not contain PHI, provided its use also follows your organization’s policies. But privacy settings, a restricted link, or hiding a patient’s name do not turn Loom into a HIPAA-compliant service or replace a BAA. Loom’s own guidance says it cannot currently sign a BAA and is not HIPAA-compliant.

For EHR training, the practical approach is to keep PHI out of Loom entirely: use a properly prepared training environment, check the complete recording for exposed information, and have your organization approve the tools and sharing process. When a workflow requires real patient information, consult your privacy or compliance team before recording and use a solution approved for that PHI.

FAQs

Can Loom sign a Business Associate Agreement?

No. Loom currently says it cannot sign a HIPAA Business Associate Agreement and is not HIPAA-compliant. Check Loom’s current HIPAA guidance and do not record PHI in Loom if doing so would violate your organization’s obligations.

Can I record an EHR in Loom if patient names are hidden?

Hiding names alone does not ensure a recording is free of PHI or properly de-identified. Medical record numbers, dates, diagnoses, notes, photos, and other details—or combinations of details—may identify a patient. Use a synthetic-data environment instead, or ask your privacy or compliance team to review the specific use.

Is synthetic data safe to use in EHR training videos?

Synthetic data is generally a safer training choice when it is genuinely fictional and does not reproduce identifiable details from real records. Confirm how the data was created and have your organization approve the training environment before recording.

What should I check for PHI before recording an EHR training video?

Check the full screen, open windows and tabs, notifications, audio, captions, transcript, title, and other generated or shared content. Look for identifiers and health details, including names, record numbers, dates, diagnoses, medications, notes, and test results. Use synthetic data and have your organization’s privacy or compliance team review the recording process.