The short answer
WebRTC is the open standard that lets a video or voice call run directly in a web browser with nothing to install. For telemedicine that means patients click a link instead of downloading an app, which raises show rates and lowers IT overhead. WebRTC encrypts media in transit by default, but encryption alone is not HIPAA compliance. If you handle protected health information, you need a HIPAA-certified vendor and a signed BAA. FreeCallMe is a lightweight browser calling tool, useful for non-PHI wellness and coaching calls, not a certified telehealth platform.
What WebRTC actually is
WebRTC, short for Web Real-Time Communication, is an open standard maintained jointly by the W3C and the IETF. It has shipped in browsers since 2013 and now works in Chrome, Firefox, Safari, and Edge. It lets two browsers exchange audio, video, and data directly, without a plugin and without an app.
Under the hood it does three things. It captures media from the camera and microphone. It sets up a peer-to-peer transport so the two browsers can send that media to each other. And it relies on a separate signaling step to let the two sides discover each other and agree on connection details before the call begins.
When a direct connection is blocked by a strict NAT or firewall, WebRTC falls back to a TURN relay so the call still connects. For media it uses the Opus codec for audio and VP8 or H.264 for video, all of which are well supported across modern browsers.
For a fuller walkthrough of the moving parts, see our full explainer on WebRTC →
Why this matters for telemedicine
The single biggest barrier to a telehealth appointment is not the call itself, it is everything the patient has to do before the call. Download an app. Create an account. Grant permissions. Find the right meeting link. Every one of those steps is a place where a patient gives up.
That matters most for the patients telemedicine is supposed to help. Elderly and non-technical patients are exactly the group most likely to abandon a visit at the app-store step. When the call is just a link that opens in the browser they already have, the dropout risk falls sharply and show rates go up.
There is an operational benefit too. Browser-based calling is easier to audit and support than a fleet of installed apps across every device and operating system a patient might own. Less to install means less to break and less to explain over the phone.
HIPAA and WebRTC: what the protocol protects (and what it does not)
WebRTC encrypts media in transit by default. It uses DTLS to secure the signaling handshake and SRTP to encrypt the actual audio and video streams. That is a real, meaningful protection, and it is on by default rather than something you have to configure.
Here is the part vendors gloss over: encryption is necessary but not sufficient for HIPAA. Compliance is about far more than the bytes on the wire. It also requires a signed Business Associate Agreement, access controls, audit logs, and a clear data retention policy. A perfectly encrypted call on a platform with no BAA and no audit trail is still not HIPAA compliant.
So the honest framing is this: WebRTC is a protocol. It is neither HIPAA compliant nor non-compliant on its own. Compliance is a property of the whole platform and the agreements around it, not of the calling technology underneath. Two products can both use WebRTC and land on opposite sides of the compliance line.
FreeCallMe is deliberately positioned as a lightweight browser calling tool, not a HIPAA-certified telehealth platform. It does not offer a BAA. If your work involves protected health information or a covered entity, use a dedicated telehealth vendor built and certified for that.
Browser-based WebRTC vs app-based telehealth
| Factor | Browser-based WebRTC | App-based telehealth |
|---|---|---|
| Patient setup required | Click a link | Download and install app |
| Device compatibility | Any modern browser | Must match app platform |
| Appointment show rate | Higher (less friction) | Lower for new patients |
| Provider IT overhead | Lower | App management required |
| Session data retained | Minimal (depends on platform) | Varies, often more |
| HIPAA BAA availability | Depends on vendor | Usually available |
| Offline functionality | No | Sometimes |
| Custom branding | Depends on plan | Usually yes |
App-based telehealth is not worse across the board. It can offer offline features, deeper branding, and mature BAA coverage. The trade is friction, and for many patient populations that friction is the deciding factor.
Try a browser call with no download
Browser-to-browser calls are free and end-to-end encrypted, and the session ends when the tab closes.
Call any phone number in 220+ countries from your browser. Your first call is free, up to $0.25, then pay-as-you-go by the minute.
Use cases where browser calling fits
Mental health and therapy sessions
Therapy is largely a conversation, which makes it a natural fit for browser video. A patient clicks a link from a reminder email and joins from a laptop or phone, with no app store detour and no account to remember between sessions.
The lower the friction, the more likely a nervous or first-time patient actually shows up. For providers who work with PHI, this still needs a HIPAA-certified platform with a signed BAA. The point is that the underlying calling technology can be browser-based WebRTC either way.
Follow-up and check-in appointments
A quick post-procedure follow-up or medication check-in does not need a full in-person visit. A short browser video call lets a provider confirm how a patient is doing, review symptoms, and decide whether an in-person visit is warranted.
Because there is nothing to install, these calls are easy to schedule at short notice, which is exactly when a check-in is most useful.
Health coaching and wellness (non-covered-entity)
Not every health conversation involves protected health information or a covered entity. Health coaches, nutritionists, personal trainers, and wellness practitioners often operate outside HIPAA entirely.
For these use cases, a lightweight browser calling tool is often all that is needed. There is no PHI, no BAA requirement, and no reason to stand up a heavy telehealth suite.
International patient calls
Providers who serve patients or clients abroad can use browser-to-browser video for free when both sides are online, or dial a real phone number when a patient cannot get to a browser.
Pay-as-you-go rates are shown before you dial: the UK and Canada run about $0.02/min, and Mexico runs about $0.03/min. There is no subscription, and the first call is free up to $0.25. You can try the dialer here →
What to ask before choosing a platform
- Is a BAA available and signed?
- If you handle protected health information, a signed Business Associate Agreement is not optional. Ask directly, get it in writing, and do not assume that encryption alone makes a platform HIPAA compliant.
- Is media encrypted in transit?
- WebRTC encrypts media by default with DTLS for the handshake and SRTP for the audio and video streams. Confirm the platform has not weakened or bypassed that, and ask how signaling is secured.
- What is retained after a session?
- Ask what happens to the call. Are sessions recorded by default, stored, or transcribed? For many use cases the safest answer is that nothing is retained unless you explicitly turn it on.
- Are there access controls and audit logs?
- Encryption protects data in transit. Access controls and audit logs protect it at rest and prove who did what. Both are part of HIPAA compliance, not just the call itself.
- Does it work on any modern browser?
- A telehealth call that only works in one browser or one operating system defeats the no-install advantage. Confirm support across Chrome, Firefox, Safari, and Edge on desktop and mobile.
- Who is on the hook if it breaks mid-call?
- Ask about support, uptime, and what fallback exists (a phone number to dial, for instance) when a patient's connection is too weak for video.
The pattern across these questions is simple: do not let a vendor point at "encrypted calls" and call it compliance. The encryption is table stakes. The BAA, the access controls, the audit logs, and the retention policy are what actually put you on the right side of HIPAA.
Building your own WebRTC infrastructure
If you are considering building rather than buying, it helps to know the pieces you would be responsible for. WebRTC gives you the media layer, but a working product needs several supporting services around it.
Signaling server
WebRTC handles the media, but the two browsers still need a way to find each other and exchange connection details before the call starts. That coordination is signaling, and it is not part of the WebRTC spec itself, so you build it.
Most teams use WebSockets for this, often with a library like Socket.IO, to pass the session descriptions and connection candidates between the two participants.
STUN server
To connect directly, each browser needs to discover its public-facing address. A STUN server does that lookup. Google runs a free public one at stun.l.google.com:19302, which is fine for testing.
For anything real, run your own so you are not depending on a free third-party endpoint that can change or disappear.
TURN server
When a patient is behind a strict corporate firewall or a difficult NAT, a direct peer-to-peer connection can fail. A TURN server relays the media so the call still connects.
Coturn is the common open-source choice. TURN uses real bandwidth because it relays traffic, so it costs more to run than STUN, but it is what keeps calls from silently failing for a subset of patients.
Media server (optional)
Simple one-to-one calls can stay peer-to-peer. Once you need multi-party calls, recording, or transcoding, a media server sits in the middle and manages the streams.
Mediasoup, Janus, and Jitsi Videobridge are common open-source options. This is where a build-your-own project stops being a weekend task and starts being real infrastructure.
None of this is exotic, but all of it is real infrastructure to run, secure, and keep online. For a healthcare product, add HIPAA controls on top and the build-versus-buy math usually tilts toward a certified vendor unless calling is your core product.
Where FreeCallMe fits
FreeCallMe is an honest fit for a narrow slice of this space. It is a lightweight, browser-based calling tool. Browser-to-browser video and voice calls are free and end-to-end encrypted, the session ends when the tab closes, and there are no recordings. If you also need to reach someone on a real phone number, the dialer is pay-as-you-go, with the rate shown before you dial, the first call free up to $0.25, and no subscription.
That makes it a reasonable choice for wellness coaching, general health conversations, and any client-facing call that does not involve protected health information or a covered entity.
It is just as important to be clear about what FreeCallMe is not. It is not a HIPAA-certified telehealth platform. It does not offer a Business Associate Agreement. It has no appointment scheduling, no EHR integration, and no waiting rooms. For anything involving PHI or a covered entity, the right tool is a dedicated telehealth vendor with HIPAA certification and a signed BAA. If you want to see what browser calling feels like for the use cases it does fit, see how businesses use FreeCallMe →
Frequently asked questions
- Is WebRTC HIPAA compliant?
- WebRTC is a protocol, not a product, so it is neither HIPAA compliant nor non-compliant on its own. Compliance depends on the platform built on top of it: whether the vendor signs a Business Associate Agreement, enforces access controls, keeps audit logs, and sets a clear data retention policy. WebRTC encrypts media in transit by default, which is necessary but not sufficient. If you handle protected health information, use a dedicated telehealth vendor with HIPAA certification and a signed BAA.
- Do patients need to install an app?
- No. That is the whole point of browser-based WebRTC. The patient clicks a link and the call runs in a modern browser like Chrome, Firefox, Safari, or Edge, with nothing to download and no account to create. Removing the install step is one of the biggest drivers of higher appointment show rates, especially for elderly or non-technical patients.
- Can FreeCallMe be used for telehealth?
- Only for non-PHI, non-covered-entity uses such as wellness coaching, general health conversations, or reaching a client who is not covered by HIPAA. FreeCallMe is a lightweight browser calling tool. It is not a HIPAA-certified telehealth platform, it does not offer a Business Associate Agreement, and it has no appointment scheduling, EHR integration, or waiting rooms. For protected health information or covered-entity work, use a dedicated telehealth vendor with HIPAA certification and a signed BAA.
- What happens to the call data after the session?
- With FreeCallMe's browser-to-browser calls, the session ends when the tab closes. There are no recordings, and the call is end-to-end encrypted. Other platforms vary, so always ask a vendor directly what is retained, whether sessions are recorded or transcribed by default, and where any stored data lives. Minimal retention is a good default for any health-related call. More on how private VoIP calls really are →
Call from the browser, no download required
Free, end-to-end encrypted browser calls with nothing to install. Or dial a real number, pay-as-you-go, with the rate shown before you dial.
Call any phone number in 220+ countries from your browser. Your first call is free, up to $0.25, then pay-as-you-go by the minute.