Zoom Settings for Health Data

About Health Data on Zoom

As a user of the University Zoom service for teleconferencing, and as someone handling health information, it’s critical that you play your part in ensuring the privacy and security of patient/client health information.

Some key points to keep in mind:

Zoom can potentially be abused by hackers through a technique known as “Zoombombing”, which is possible if you run a public meeting and the meeting link becomes known to the attacker. Make sure to ensure that even if the attacker obtains a link, they cannot interfere with your meetings or observe client sessions.
Those using Zoom may not store Personal Health Information (PHI) on the Zoom cloud storage system: you must store the videos in a secure University location. Please work with your technical staff to ensure proper file protections are in place. Note that some groups are handling health information that does not qualify as HIPAA PHI: those groups are still required to store their videos locally. Operate as if your data also qualify as PHI.
By default, Zoom meeting hosts do not need to grant screen share access for another participant to share their screen. By default, any participant in a meeting can share their video, screen, and audio.

Required Accounts Settings

The key points above are present using the default settings in Zoom. Users who plan to discuss, provide, or interact with health data on Zoom are required to make the following account settings changes before using Zoom.

In your Zoom settings:

Automatically Generate a Meeting ID
Require Meeting Password
Enable the Waiting Room Feature
Disable “Join Before Host”
Limit Screen Sharing to Host

Zoom Support Documentation: Links, Resources, and FAQs

Zoom at Syracuse University

Frequently Asked Questions

Support during the COVID-19 pandemic

One Minute Video Tutorials

Live Training Webinars

Getting Help

For support on the information above, contact the ITS Help Desk.