FedRAMP Telehealth Platforms: Who’s Authorized at Moderate vs. High? (2026 Buyer’s Guide)

For any federal healthcare program running on a cloud platform, the practical question is: Can this platform legally and securely handle federal health data — and at what impact level?

Very few telehealth platforms are cleared for High-impact federal health data. VSee holds a FedRAMP High (Class D) Authority to Operate (ATO) issued by HHS ASPR. 

CirrusMD, GTS VirtualHealth, RingMD, and Zoom for Government are telehealth and video conference platforms that are FedRAMP Certified at Moderate (Class C). 

Still others — GlobalMed, Amwell, Teladoc, Doximity, Doxy.me, MDLIVE — run on a DoD-network ATO or show no FedRAMP listing. 

Because HIPAA does not equal FedRAMP. SOC 2 does not equal FedRAMP. Hosting on AWS GovCloud or Azure Government does not give a telehealth application FedRAMP Authority to Operate (ATO). Thus, you should always confirm a telehealth vendor’s FedRAMP status on the FedRAMP Marketplace or by requesting the vendor’s ATO letter. 

A FedRAMP telehealth shortlist

As of September 2026. Re-confirm on the FedRAMP Marketplace before relying on any entry.

Cleared at High (Class D)

VSee is the only telehealth-specific platform cleared for High-impact federal health data.

FedRAMP Certified at Moderate (Class C) — Marketplace-listed

DoD-network ATO or no FedRAMP listing found

A quick word on “ATO” vs. “Marketplace certification.” Both are real authorizations — don’t treat one as lesser. 

A FedRAMP Marketplace certification is a packaged, published authorization any agency can find and reuse. 

An agency ATO is a federal agency’s own signed authorization to operate a system with real data. It is not automatically reusable by any other agency, but can significantly shorten the time it takes to meet FedRAMP requirements.

VSee holds an agency ATO assessed against the FedRAMP High (Class D) baseline — a live, in-production authorization that simply isn’t published as a Marketplace package (yet); the Moderate platforms above hold published Marketplace certifications. Same kind of underlying rigor; different publication path and impact level.

FedRAMP terminology that changed in 2026

FedRAMP’s Consolidated Rules for 2026 (CR26) retired “FedRAMP Authorized” in favor of “FedRAMP Certified,” and replaced Low/Moderate/High with Certification Classes A–D — where Class C = Moderate and Class D = High. FedRAMP’s security office has been explicit that this is a naming change, not a scope change. Existing authorizations carried over automatically. This guide uses the current terms; nothing changed meaning, only labels.

The three — and only three — designations FedRAMP recognizes are FedRAMP Ready, FedRAMP In Process, and FedRAMP Certified. Per FedRAMP’s Agency Authorization Playbook: “Terms such as ‘FedRAMP Compliant’ or ‘FedRAMP Equivalent’ or any other FedRAMP implied authorization is NOT recognized by the FedRAMP PMO.” Anything else on a vendor’s site is marketing language.

Reading a vendor’s claim: three questions

1. Status — FedRAMP Certified, or still In Process?
2. Impact level / Class — Moderate (Class C), or High (Class D)?
3. Scope — the full platform you’re buying, or a single agency, module, or network?

A platform that’s “FedRAMP Moderate, In Process” is a very different proposition from one holding a completed High authorization. Verify all three on the FedRAMP Marketplace or by requesting the vendor’s ATO letter.

Why federal telehealth needs FedRAMP

Telehealth is not just video. A real virtual care platform may handle identity, intake, consent, scheduling, chat, live video, provider notes, prescriptions, remote-monitoring data, care escalation, reporting, and integrations. That is a lot of sensitive federal health data moving through the cloud.

FedRAMP exists to give federal agencies a standardized way to assess cloud risk — how a system is secured, monitored, tested, patched, logged, and governed. Think of it like hospital privileges: a physician may be licensed, but that doesn’t mean they can walk into any hospital and start operating. The hospital still has to credential them for its environment. FedRAMP plays that role for cloud platforms serving federal agencies.

FedRAMP High vs. Moderate for virtual care

FedRAMP Moderate (Class C, ~325 controls) is rigorous and appropriate for many federal virtual-care workflows. FedRAMP High (Class D, ~410–421 controls) is the more demanding level, used when a breach could have severe or catastrophic impact. A low-acuity text-consult program doesn’t carry the same risk profile as virtual care for emergency response, high-sensitivity populations, complex care coordination, or longitudinal clinical records. So the question isn’t only “Is this vendor FedRAMP?” — it’s “Is this vendor authorized at the level our care model requires?”

Platform-by-platform: what each is actually for

VSee — FedRAMP High telehealth (Class D)

VSee holds a FedRAMP High ATO issued by HHS ASPR — an agency authorization assessed against the Class D baseline, live in federal production under continuous monitoring. Unlike platforms that began as messaging tools, video widgets, RPM dashboards, or EHRs, VSee is built around the full virtual-care encounter: intake before the visit, communication around it, documentation after it, and escalation when a patient needs more than a screen. Those pieces live together inside one High-authorized environment — the only combined telehealth and EHR platform cleared at High. Learn more about VSee FedRAMP status at vsee.com/fedramp. 

CirrusMD — FedRAMP Moderate, chat-first virtual care

The authorized product is “CirrusMD Virtual Health Chat for Government” (FedRAMP Certified · Moderate; certified 10/23/2024; Package FR2220549818), VA-sponsored, assessed by 3PAO A-LIGN against the 325-control Moderate baseline, and delivered to the VA through prime contractor Iron Bow. Its model is chat-first: sub-minute physician connect, a multi-day asynchronous window, AI risk-surfacing, and benefits routing — strong for access, triage, and low-acuity care. It can escalate to audio/HD video when a visual exam is needed, but the program is architected around asynchronous chat, and it is Moderate, not High. 

GTS VirtualHealth Platform (GTS-VP) — FedRAMP Moderate RPM + telehealth

GTS-VP (FedRAMP Certified · Moderate; VA path; certified 7/17/2024; Package FR2035860874 ) is a device-integrated remote patient monitoring platform with real-time telehealth — Bluetooth peripherals streaming vitals to VA care teams, used across VISNs for chronic and progressive conditions (ALS, spinal cord injury, hypertension, diabetes, COPD), with HL7/FHIR middleware and a “Circle of Care” family app. It’s procured via Carahsoft and a VA enterprise IDIQ. GTS publicly states it is “the only FedRAMP-authorized RPM SaaS.” The limitation for High-impact programs is impact level: Moderate, not High.

RingMD Telemedicine — FedRAMP Moderate, rural/low-bandwidth

RingMD (FedRAMP Certified · Moderate; certified Dec 2, 2025; Package FR2209555576) is positioned for rural, remote, and low-bandwidth care, sponsored via the Indian Health Service (IHS). For access-constrained federal programs it’s a serious option — the buyer questions are whether Moderate is sufficient and whether the specific workflows are inside the authorized boundary.

Zoom for Government — FedRAMP Moderate, but a communications tool, not a clinical platform

Zoom for Government (ZfG) — Marketplace Package FR1825941347A — has been FedRAMP Certified at Moderate (Class C) since July 2023 (Rev5, JAB path), and shows 44 ATO/ATU authorizations (broad federal reuse). It runs in AWS GovCloud. Its authorized boundary is Zoom’s unified-communications stack — video meetings, webinars, Team Chat, cloud recording, Zoom Phone, Contact Center, and AI Companion — and it supports FIPS 140-2 cryptography and can be covered under a HIPAA BAA.

That makes ZfG a legitimate option for secure federal video — but it is a general collaboration platform, not a purpose-built telehealth or clinical system. Zoom Meetings inside Zoom for Government gives you the video “room.” It does not provide the healthcare workflow around the visit: patient registration and intake, scheduling and queuing, a clinically designed waiting room, provider documentation, EHR, e-prescribing, remote patient monitoring, triage, role-based clinical access, or care coordination. Two limits matter for federal healthcare buyers:

• Impact level: Moderate (Class C), not High — not cleared for High-impact federal health data.
• Design intent: built for meetings and communication, not for clinical workflows and healthcare privacy requirements. Secure video ≠ a telehealth platform.

(Note: “Zoom for Healthcare” is a separate commercial, HIPAA-focused offering — not the FedRAMP-authorized Zoom for Government.)

Buyer takeaway: If you only need FedRAMP-authorized video for administrative or low-acuity use, ZfG may fit. If you need a clinical telehealth program — workflows, documentation, records, and High-impact authorization — a communications tool alone won’t cover it.

GlobalMed — DoD Med COI ATO, not FedRAMP

GlobalMed is a major federal telehealth name in hardware-enabled, connected-exam telemedicine. It publicly states the Defense Health Agency renewed its Med COI ATO — real and relevant for DoD. But a Med COI ATO is scoped to a specific DoD environment; it does not automatically transfer to civilian agencies and does not create a reusable FedRAMP Marketplace package. Like a badge for one secure building: it gets you through that door, not every federal door.

Amwell & Teladoc — commercial leaders, no public FedRAMP listing found

Amwell has announced DHA/Leidos work; Teladoc has vast commercial reach. Neither shows a public FedRAMP Marketplace listing as of this review. That doesn’t rule out a private pilot or a FISMA-level ATO we couldn’t find — but FedRAMP certification is the kind of milestone these companies would publicize. Ask for the Marketplace listing, ATO letter, boundary, impact level, and authorizing agency.

FedRAMP EHRs are different from FedRAMP telehealth platforms

Some FedRAMP health IT platforms are EHR-focused or communication-focused, not telehealth platforms — for example DSS Health Cloud (Juno EHR) (a full EHR/PaaS — FedRAMP Certified at High / Class D, Package FR2528336463, VA-sponsored, certified 7/27/2026), Koniag Government Services EHR (EHR), and Artera Harmony Federal Edition (a patient-communication suite — FedRAMP Certified at Moderate / Class C, certified 5/19/2026; not High, and not a telehealth or EHR platform). They matter in the broader federal health-IT market, but an EHR manages clinical records and a patient-communication tool handles messaging — neither delivers virtual-care encounters. VSee is the platform that spans telehealth + EHR + patient communication in one High-authorized environment. See our deeper FedRAMP EHR comparison → [FedRAMP EMR & EHR Platforms — ADD LINK WHEN LIVE]

In-depth comparison

Federally authorized telehealth platforms — only VSee is cleared at High (Class D)

Single-agency / DoD-network ATO — NOT a FedRAMP Marketplace certification

What to require for High-impact virtual care

Verification answers “Is the platform authorized?” This is the harder question: “Even if it’s authorized, can it run our care model?”

• A completed authorization at High / Class D — not In Process, not Moderate.
• The platform’s own application authorization — not inherited cloud hosting.
• A credible authorizing agency relevant to your health-data use case.
• The workflows you need inside the authorized boundary — video, async, remote exams, messaging, documentation, reporting, integrations — not bolted on later.
• Configurability to match the pace of federal operations (disaster response, public-health surges, rural access gaps can appear overnight). A rigid platform becomes a beautifully secured parking lot.
• A clear reuse path — how your agency can leverage the existing package under OMB’s presumption of adequacy.

The real buying standard isn’t “Do you have FedRAMP?” It’s: “Do you have the right level, for the right workflows, inside the right boundary, with a practical path for our agency to use it?”

Where VSee fits

In many virtual-care deployments the visit is only one step. Patients need routing to the right provider; staff need intake and consent; clinicians need documentation; care teams need follow-up; program leaders need reporting; some use cases need remote-exam data, RPM, AI documentation, or integrations. VSee brings those pieces together in one virtual-care environment — and its FedRAMP High ATO through HHS ASPR gives agencies a stronger starting point for high-sensitivity care than stitching together separate video, messaging, intake, EHR, and coordination tools.

Some platforms give you a secure room. VSee gives you the clinic. View VSee’s FedRAMP High details → https://vsee.com/fedramp

How to verify a telehealth vendor’s FedRAMP status

Start with the FedRAMP Marketplace. Search the exact product name, not just the company name. Confirm the status, level, authorizing agency, and whether the listing applies to the application you plan to use. If the vendor isn’t listed, ask for the ATO letter, then confirm the boundary — a vendor may hold authorization for one deployment, module, or network but not the full platform you’re buying.

Be careful with vague phrases — “FedRAMP compliant,” “FedRAMP equivalent,” “built on FedRAMP infrastructure,” “hosted in GovCloud,” “government ready.” Useful signals, maybe; a completed authorization for the application itself, no.

FedRAMP telehealth FAQs

What is a FedRAMP EHR? A FedRAMP EHR is a cloud-based electronic health record or telehealth platform authorized under FedRAMP — the government’s standardized cloud-security program — to handle federal health data, via an Authority to Operate (ATO) at a FedRAMP impact level (Moderate or High).

Is a FedRAMP EHR required for government agencies? Yes, if the EHR is cloud-based and handles federal data. FISMA, the FedRAMP Authorization Act of 2022, and OMB M-24-15 together make FedRAMP mandatory for cloud services processing federal information.

Are telehealth platforms required to be FedRAMP certified? If the platform is cloud-based and handles federal health data, yes — a FedRAMP certification, or an agency ATO meeting the same baseline, is required at the impact level the data demands.

Which telehealth platforms are FedRAMP High? As of September 2026, VSee is the only telehealth-specific platform cleared at FedRAMP High (Class D). DSS Health Cloud (Juno EHR) also holds a FedRAMP High (Class D) certification (VA-sponsored, certified 7/27/2026) — but it’s an EHR/PaaS, not a telehealth platform. Artera Harmony Federal Edition, sometimes grouped here, is FedRAMP Certified at Moderate (Class C) — a patient-communication tool, not High.

How do I verify a vendor’s FedRAMP status? Check the FedRAMP Marketplace; if a vendor isn’t listed, request its ATO letter, impact level, authorizing agency, and System Security Plan — and confirm it’s the platform’s own ATO, not just its hosting.

Is FedRAMP High the same as Class D? Yes. Under FedRAMP’s 2026 Consolidated Rules, the former “High” impact level maps directly to Class D — the same, most stringent tier. “Moderate” is now Class C, and “Low” is Class B.

Why do some FedRAMP-certified vendors show “0 authorizations” or “0 reuses” on the Marketplace? That count reflects how many agencies have formally issued an ATO against the package — not whether the certification itself is valid. A brand-new certification will show zero until an agency adopts it, which can take time even after certification is complete.

Does a DoD-network ATO (like GlobalMed’s) count as FedRAMP? No. A DoD Med COI ATO or similar network-specific authorization is real and rigorously assessed, but it’s scoped to that network — it doesn’t transfer to civilian agencies the way a FedRAMP certification does.

Does hosting on Azure Government or AWS GovCloud make my application FedRAMP authorized? No. It authorizes the infrastructure underneath the application, not the application itself. The application still has to implement and get authorized for its own application-layer controls.

What’s the difference between “FedRAMP-authorized infrastructure” and a “FedRAMP-authorized application”? Infrastructure authorization covers the data centers, hardware, and virtualization layer a cloud provider like Microsoft or AWS operates. Application authorization covers the application running on top of it — access control, logging, data handling — and requires its own ATO.

Does FedRAMP certification alone mean an agency can use a platform? Not by itself. Certification means the PMO has packaged a CSP’s security information — an individual agency still has to authorize that specific use case, typically by reusing the certified package rather than reassessing from scratch.

What’s the difference between an EHR, a telehealth platform, and a patient-communication platform? An EHR stores and manages clinical records. A telehealth platform delivers live or asynchronous virtual visits. A patient-communication platform handles messaging, reminders, and scheduling around care but isn’t a clinical record system or a visit platform itself. EHRs may offer telehealth or patient communication as an add-on capability, but usually these lack the workflows and functions specific to those uses. VSee is the only platform in this guide that combines all three: EHR, telehealth, and patient communication, in one rapidly customizable platform.

Is Teladoc, Amwell, MDLIVE, Doxy.me, or Doximity FedRAMP authorized? Not as of September 2026 — none of the three show a FedRAMP Marketplace listing or a public certification announcement. That’s worth noting because these are the brands buyers most often assume are federally authorized simply due to their size; scale in the commercial market doesn’t imply a federal authorization.

Is “FedRAMP Compliant” or “FedRAMP Equivalent” a real credential? No. FedRAMP’s own Agency Authorization Playbook states directly that no such designations exist and that they are “NOT recognized by the FedRAMP PMO.” The only real designations are FedRAMP Ready, FedRAMP In Process, and FedRAMP Certified. Treat any other phrasing as marketing language, not proof of authorization.

What does “FedRAMP compliance” actually mean? FedRAMP itself doesn’t use “compliant” as an official designation — a system is Ready, In Process, or Certified. Vendors often use “FedRAMP compliant” to mean their infrastructure meets FedRAMP standards, without necessarily having the application itself independently assessed and authorized. Treat “compliant” as a marketing term to ask follow-up questions about, not a credential on its own.

Is CirrusMD FedRAMP High? No. CirrusMD is FedRAMP Certified at Moderate (Class C) — its authorized product is “CirrusMD Virtual Health Chat for Government,” VA-sponsored. It is not cleared for High-impact data.

Is GTS VirtualHealth Platform FedRAMP High? No — GTS-VP (Package FR2035860874) is FedRAMP Certified at Moderate (Class C), sponsored via the VA — not High. It’s a device-integrated remote-patient-monitoring and real-time telehealth platform.

Is RingMD FedRAMP High? No — RingMD Telemedicine (Package FR2209555576) is FedRAMP Certified at Moderate (Class C), Agency path via the Indian Health Service (certified December 2025) — not High.

Is GlobalMed FedRAMP certified? No public FedRAMP Marketplace listing. GlobalMed publicly claims a renewed Defense Health Agency Med COI ATO — meaningful for certain DoD use cases, but not the same as a reusable FedRAMP certification.

Is Zoom for Government a FedRAMP telehealth platform? No. Zoom for Government (FedRAMP Certified · Moderate / Class C since July 2023, with 44 ATO/ATU authorizations) is a general communications and video-conferencing platform, not a clinical telehealth system. It provides secure video — not healthcare workflows like patient intake, scheduling, clinical documentation, EHR, or remote monitoring — and it is authorized at Moderate, not High. (“Zoom for Healthcare” is a separate commercial HIPAA offering, not the FedRAMP Government product.)

Sources

• FedRAMP Marketplace — Products: https://www.fedramp.gov/marketplace/
• VSee — HHS ASPR FedRAMP High ATO: https://vsee.com/blog/vsee-achieves-hhs-fedramp-high-ato
• CirrusMD — FedRAMP Marketplace listing (FR2220549818): https://www.fedramp.gov/marketplace/products/FR2220549818/
• CirrusMD — Receives FedRAMP Moderate Authorization (Nov. 20, 2024): https://www.globenewswire.com/news-release/2024/11/20/2984476/0/en/CirrusMD-Receives-FedRAMP-Moderate-Authorization-for-Virtual-Care-Solution.html
• CirrusMD / Quantum Health acquisition: https://quantum-health.com/newsroom/cirrusmd-redefines-the-point-of-care-immediate-physician-first-continuous-and-connected
• GTS VirtualHealth Platform — FedRAMP Marketplace listing (FR2035860874): https://www.fedramp.gov/marketplace/products/FR2035860874/
• GTS / Carahsoft — FedRAMP authorization announcement: https://finance.yahoo.com/news/global-telehealth-services-gts-carahsoft-130000022.html
• GTS VirtualHealth — FedRAMP page: https://www.globaltelehealthservices.com/fedramp/
• GTS-VP — VA OIT TRM entry: https://www.oit.va.gov/services/trm/ToolPage.aspx?tid=11762
• Carahsoft — Global Telehealth Services (procurement): https://www.carahsoft.com/global-telehealth-services
• RingMD Telemedicine — FedRAMP Marketplace listing (FR2209555576): https://www.fedramp.gov/marketplace/products/FR2209555576/
• RingMD — FedRAMP page: https://www.ring.md/fedramp/
• IHS — telehealth expansion (RingMD context): https://www.ihs.gov/newsroom/pressreleases/
• Zoom for Government — FedRAMP Marketplace listing (FR1825941347A): https://www.fedramp.gov/marketplace/products/FR1825941347A/
• Zoom — FedRAMP (trust/compliance): https://www.zoom.com/en/trust/legal-compliance/fedramp/
• Zoom — Achieves FedRAMP Moderate Authorization: https://www.zoom.com/en/blog/zoom-achieves-fedramp-moderate-authorization/
• Zoom for Government — FedRAMP authorization expansion: https://news.zoom.com/zoom-for-government-platform-expands-with-zoom-ai-companion-receives-fedramp-jab-authorization/
• GlobalMed — DHA Med COI ATO renewal (Dec. 2025): https://www.globalmed.com/resources/defense-health-agency-renews-med-coi-authority-to-operate-for-globalmed
• Amwell / DHA / Leidos — Digital First (Oct. 19, 2023): https://www.businesswire.com/
• Teladoc Health — Form 10-K (SEC EDGAR): https://www.sec.gov/
• DSS Health Cloud (DSSHC) — FedRAMP Marketplace, High / Class D (FR2528336463): https://www.fedramp.gov/marketplace/products/FR2528336463/
• Koniag Government Services EHR — FedRAMP Marketplace (FR2526240411): https://www.fedramp.gov/marketplace/products/FR2526240411/
• Artera Harmony Federal Edition — FedRAMP Marketplace (FR2503350987): https://www.fedramp.gov/marketplace/products/FR2503350987/
• FedRAMP.gov — Changelog (CR26 terminology): https://www.fedramp.gov/changelog/
• Federal News Network — FedRAMP’s Nicole Thompson on authorization confusion: https://federalnewsnetwork.com/
• FedRAMP.gov — Agency Authorization Playbook: https://www.fedramp.gov/
• OMB Memorandum M-24-15: https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf
• FIPS 199 — impact-level definitions: https://csrc.nist.gov/pubs/fips/199/final