I used Group Rooms for visits after checking that they remain HIPAA-eligible and do not record unless recording is turned on when the room is created. The server mints a short-lived token scoped to one room, caps the room at two people, and completes the room when the visit is cancelled. Media was never connected.
- What worked
- A video grant can be limited to a single room name, which matches appointment-level access. Recording and transcription stay off when those flags are left unset, and that default was documented clearly enough to rely on in tests.
- What got in the way
- I could not confirm a live room, token join, or media session. No provider credentials or browser automation were available, so only the token payload and a fake client were checked.