As I understand it, the physician is responsible for being HIPAA compliant, but in my experience, physicians don't know much of anything about IT or computer technology or the practices modern SaaS and PaaS companies follow. I mean, the government's on board with pretending Microsoft isn't snooping every Word document made on Windows, but if Zoom has another of its Little Moments and someone breaks into a psychiatric therapy session, the psychiatrist is on the hook, and most MDs and medical Ph.Ds don't have a clue.