The rapid expansion of telehealth services has transformed healthcare delivery, but it also introduces significant HIPAA compliance challenges. Virtual care requires the same level of privacy and security protection as in-person visits, with additional considerations for technology platforms, remote communications, and home-based care environments.
Many healthcare organizations rushed to implement telehealth during the COVID-19 pandemic using consumer video platforms. While enforcement discretion temporarily allowed this, those flexibilities have ended. Organizations must now ensure full HIPAA compliance for all telehealth operations.
Important: Enforcement Discretion Has Ended
OCR's pandemic-era enforcement discretion for telehealth platforms ended in 2023. Using non-compliant consumer platforms (standard Zoom, Skype, FaceTime, Google Meet) for telehealth visits now constitutes a HIPAA violation subject to penalties.
Your telehealth platform must meet these minimum HIPAA requirements before transmitting any patient health information.
Video, audio, and chat communications must be encrypted in transit using TLS 1.2 or higher.
Implement unique user authentication, automatic session timeouts, and role-based permissions.
Obtain a signed BAA from your telehealth platform vendor before transmitting any PHI.
Platform must maintain detailed logs of who accessed patient information and when.
Not all video platforms are HIPAA compliant. Here's what you need to know about common options.
| Platform | BAA Available | Encryption | Notes |
|---|---|---|---|
| Zoom for Healthcare | Yes | End-to-end available | Separate healthcare product required, not standard Zoom |
| Doxy.me | Yes | AES-256 encryption | Purpose-built for telehealth, simple setup |
| VSee | Yes | AES-256 encryption | Enterprise telehealth platform with full EMR integration |
| Microsoft Teams (Healthcare) | Yes | End-to-end encryption | Requires healthcare-specific configuration and licensing |
| Standard Zoom/Skype/FaceTime | No | Varies | NOT compliant - consumer versions cannot be used for PHI |
The Issue:
Zoom, Skype, FaceTime, and Google Meet consumer versions are NOT HIPAA compliant without a BAA.
The Solution:
Use healthcare-specific versions with signed BAAs (e.g., Zoom for Healthcare, Doxy.me, VSee).
The Issue:
Sending appointment links, instructions, or PHI via regular SMS or email exposes data.
The Solution:
Use patient portals or encrypted messaging systems for all communications containing PHI.
The Issue:
Failing to properly verify patient identity before virtual visits creates privacy risks.
The Solution:
Implement multi-factor identity verification using birthdates, unique PINs, or photo ID checks.
The Issue:
Recording telehealth sessions without explicit patient consent violates HIPAA Privacy Rule.
The Solution:
Obtain documented consent before recording, store recordings securely, and apply retention policies.
The Issue:
Providers accessing ePHI over public or unsecured Wi-Fi networks risk data interception.
The Solution:
Require VPN use for remote access, implement endpoint security, and train on safe network practices.
Remote patient monitoring devices and applications introduce additional HIPAA compliance requirements beyond basic telehealth visits.