NETRC

Telehealth and HIPAA

Home Navigate Telehealth Telehealth and HIPAA

Telehealth 101


Telehealth Policy


Telehealth Clinical Settings & Specialties

Telehealth and HIPAA: An Overview

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a foundational federal law that protects the privacy and security of individuals' Protected Health Information (PHI). HIPAA's Privacy, Security, and Breach Notification Rules apply to health care services regardless of whether they are delivered in person or through telehealth. Telehealth providers must safeguard PHI when it is created, transmitted, stored, or accessed electronically as part of virtual care delivery.

In telehealth settings, HIPAA requirements mean that any electronic communication technologies used to deliver services - such as secure video conferencing, remote patient monitoring, messaging platforms, or integrated clinical systems - must include appropriate safeguards to protect patient privacy and security consistent with the HIPAA Rules.

Core HIPAA Requirements for Telehealth

HIPAA compliance in telehealth is built on three pillars:

  1. Privacy Rule
    • Defines how PHI may be used and disclosed.
    • Requires providers to limit uses and disclosures to the minimum necessary for treatment, payment, and health care operations.
    • Patients must be informed of their privacy rights and how their information will be used.
  2. Security Rule
    • Requires covered entities, including healthcare providers, health plans and healthcare clearinghouses, to implement administrative, technical, and physical safeguards to protect electronic PHI (ePHI) against unauthorized access, use, or disclosure.
    • Examples include strong access controls, encryption of data in transit and at rest, and audit controls that log access and changes to ePHI.
  3. Breach Notification Rule
    • Requires covered entities to notify affected individuals, the Department of Health and Human Services (HHS), and in some cases the media if a breach of unsecured PHI occurs.
    • Applies equally to breaches involving telehealth platforms and devices.

Telehealth services do not have special HIPAA carve-outs—providers must meet the same HIPAA standards they would for in-person care when handling PHI during virtual encounters.

Technology and Telehealth Platforms

Choosing appropriate technology is central to HIPAA compliance:

  • HIPAA-compliant platforms: Telehealth technology vendors that support encryption, controlled access, secure authentication, and logging features help health care organizations protect ePHI.
  • Business Associate Agreements (BAAs): Covered entities must enter into BAAs with vendors (including telehealth platform providers, cloud storage, and communication services) that will handle PHI on their behalf. BAAs formally bind those vendors to the same HIPAA protections required of the covered entity.
  • Secure configurations: Simply having a platform that can operate securely does not ensure HIPAA compliance; organizations must configure settings (e.g., encryption, access controls) and integrate the platform into their privacy and security policies.

Providers should also assess technology regularly, including updates, patches, and testing cybersecurity functions to ensure they continue to meet HIPAA requirements.

Administrative and Operational Safeguards

Telehealth providers and organizations should implement formal policies and procedures around telehealth to fulfill HIPAA obligations:

Risk Analysis and Management

  • Conduct a comprehensive risk assessment that includes telehealth technologies, workflows, and points of PHI access.
  • Document vulnerabilities and mitigation strategies.

Workforce Training

  • Train clinicians, administrative staff, and IT teams on HIPAA privacy and security rules as they apply to telehealth interactions and documentation.

Patient Identity Verification and Consent

  • Confirm patient identity before exchanging PHI during telehealth encounters.
  • Obtain and document appropriate patient consent and inform patients about privacy and security aspects of telehealth communications.

Incident Response and Business Continuity

  • Establish procedures for responding to privacy and security incidents involving telehealth systems, including breach notification and remediation activities.
  • Maintain records and documentation related to telehealth compliance measures.

HIPAA in Telehealth - Northeast Context

Providers operating in the Northeast (e.g., Connecticut, Massachusetts, Maine, New Hampshire, New York, Rhode Island, Vermont) can draw on regional technical assistance and resources to support HIPAA compliance within telehealth programs:

  • Northeast Telehealth Resource Center (NETRC) Telehealth Classroom - Here you'll find courses and toolkits which include a foundational introduction to key telehealth considerations, such as privacy and technology aspects relevant to HIPAA compliance, and links to additional resources tailored for Northeast providers.
  • Center for Connected Health Policy (CCHP) National Telehealth Policy Resource Center - A national telehealth policy resource that includes state policy summaries and guidance where HIPAA interacts with state telehealth regulations (e.g., data access laws that may supplement HIPAA protections).
  • Many Northeast states also have state privacy and data protection laws that may impose additional requirements beyond HIPAA (e.g., broader definitions of personal data or shorter breach notification deadlines). Organizations should consult state regulatory guidance in addition to HIPAA standards.

Practical Examples of Compliance in Telehealth Operations

Here are concrete scenarios showing how organizations can operationalize HIPAA requirements within telehealth:

Example 1: Choosing and Configuring a Telehealth Platform

A clinic selects a HIPAA-compliant telehealth vendor and negotiates a Business Associate Agreement with them. Tech specialists configure the platform to enforce encryption, unique user authentication, and audit logging. The clinic's compliance officer reviews all security settings and incorporates the platform into written privacy policies.

Example 2: Training and Workflow Integration

A health system rolls out regular training for clinicians and support staff on secure telehealth workflows, including verifying patient identities, safeguarding session links, and documenting consent. Training materials are updated annually and after any significant telehealth policy changes.

Example 3: Risk Assessment and Continuous Monitoring

An organization conducts an annual HIPAA risk analysis that includes telehealth communication tools and remote monitoring devices. The IT team identifies a vulnerability in remote access protocols and implements multi-factor authentication and network access controls to mitigate risk.

NETRC Developed Resources


Additional Reputable Resources

These links provide guidance to help health care organizations and providers support HIPAA compliance in telehealth programs:


Conclusion

HIPAA compliance is central to the safe and lawful delivery of telehealth services. It requires a combination of secure technology, documented policies, workforce training, risk assessments, and patient awareness. Telehealth providers and organizations - including those serving the Northeast region - can leverage federal guidance and regional telehealth resources to develop robust HIPAA compliance programs that protect patient privacy and support high-quality care.

Need more guidance? Contact us