Telemedicine requires a workable combination of privacy decisions, appropriate safeguards and staff procedures. A product described as HIPAA compliant does not establish that every feature, configuration or use by a provider is appropriate. Review how the service will actually operate and who is responsible at each step.
OCR’s pandemic telehealth enforcement-discretion transition ended on 9 August 2023. Routine services should therefore be assessed against the applicable HIPAA requirements, rather than relying on that temporary arrangement. Clinical suitability, professional licensing, payer rules and jurisdiction-specific consent questions need their own assessment alongside privacy and security.
Map what happens before and after the video call
Start with scheduling. Identify the information entered into forms, appointment reminders and support requests. Continue through joining the consultation, exchanging files, creating notes, arranging follow-up and closing the record. Include automated features that create data without a separate staff action.
For each step, record the system, recipient and purpose. Does a reminder reveal the clinic or treatment type on a shared device? Does a failed appointment leave information in a helpdesk ticket? Does a transcription option create a second copy of the conversation? These questions identify decisions that a platform checklist can overlook.
Agree which information belongs in the clinical record and which temporary copies should be managed separately. Assign an owner for each system and for the handover between them. Our HIPAA data-mapping guide provides a practical structure for tracing these flows.
Determine the vendor role from its actual service
Identify vendors that create, receive, maintain or transmit protected health information on behalf of the regulated organisation, and assess whether a business associate relationship exists. HHS distinguishes a telecommunications conduit with only transient access from a vendor that also stores or processes the information. A service description or familiar brand is not enough to make that decision.
For a business associate, address the required agreement and the operating responsibilities behind it. Review subcontractors, support access, data return or deletion, incident communications and the features included in the agreed service. A contract for basic video does not necessarily address a later transcription or analytics add-on.
Use our business associate agreement guide to organise the contractual review. Keep the related technical and workflow decisions together so a feature is not enabled before its responsibilities have been assessed.
Choose safeguards from the technology and risks
The current HIPAA Security Rule is technology neutral. Do not turn one encryption product, file-size limit or marketing label into a universal statutory specification. Assess the risks to electronic protected health information and implement reasonable and appropriate safeguards for the actual service.
In a platform review, examine staff authentication, participant admission, permissions, session settings, file exchange, logging and data storage. Check the deployed configuration, not just the vendor’s list of available features. Define how approved settings are maintained when accounts are added or product defaults change.
Audio-only care is not automatically prohibited. HHS distinguishes traditional telephone transmission from electronic technologies such as VoIP and apps, to which Security Rule obligations may apply. Confirm the provider’s actual technology and any recording or storage, rather than assuming every phone call has the same technical characteristics.
Make the start of the appointment understandable
Give patients clear joining instructions and a route for technical difficulty that does not require unnecessary medical detail. Staff should know how to establish the participant’s identity, manage an unexpected person joining and check whether the patient can speak privately. Build those steps into the appointment routine.
Discuss privacy in a practical, respectful way. A patient may be using shared accommodation, a work device or limited connectivity. Offer reasonable options through the clinical workflow rather than assuming everyone has a private room and a second device. Arrange appropriate accessibility and language support as required for the service.
Hypothetical example: a clinic sends appointment links through a shared family email address. During a workflow review, staff discover that reminder subjects reveal sensitive appointment details. The clinic changes the reminder content, confirms communication preferences and tests the revised journey with representative users. The improvement addresses a specific disclosure risk without promising that all patient environments can be controlled.
Make recording and transcription deliberate choices
Ask whether a recording is needed at all. If it is, determine the purpose, authority, appropriate patient communication, access, storage and retention before enabling the feature. A convenient default is not a reason to create another sensitive record. Apply the same review to transcripts, summaries and files uploaded during the appointment.
Check whether a new feature sends information to another supplier or uses it for an additional purpose. If AI-assisted transcription is proposed, review the actual data handling and applicable agreement rather than assuming the original video-service assessment covers it. Confirm the process for correcting clinical records through the appropriate clinical governance arrangements.
Hypothetical example: a practice’s platform update adds automatic summaries. The service owner keeps the feature disabled while reviewing where audio is processed, who can access outputs and how staff would verify them. After the relevant owners decide on the proposed use, the practice can configure and test an authorised workflow instead of discovering the new data flow after patient appointments.
Rehearse failure and keep the evidence useful
Decide how staff should respond to a failed connection, incorrect recipient, lost device or unexpected participant. Define who can pause the service, arrange an appropriate alternative and assess a possible disclosure. Technical support should receive the information needed to troubleshoot without becoming an uncontrolled copy of the clinical conversation.
Test one appointment from invitation through follow-up, including a failure scenario. Keep the agreed configuration, vendor-role decision, relevant agreements, staff instructions and the actions arising from the test. Revisit the review when the platform, delivery model or data use changes materially.
Our HIPAA cloud-services guide can help clarify shared responsibilities. For a planned review of the whole workflow, HIPAA assessment and implementation support can help turn unclear responsibilities into a prioritised action plan.
Reference basis
- HHS, HIPAA and Telehealth: expiry of the pandemic enforcement-discretion transition.
- HHS, Guidance on audio-only telehealth, reviewed June 2026.
- HHS, Summary of the HIPAA Security Rule currently in effect.
Questions and answers
Does choosing a HIPAA-labelled platform complete the work?
No. Review its actual configuration, vendor role, enabled features and use by staff. The appointment workflow, agreements, access decisions and continuing operation also need to fit the applicable requirements.
Can telehealth be provided by telephone?
Yes, audio-only telehealth can be provided consistently with HIPAA. The technology matters: traditional telephone transmission and electronic services such as VoIP or recording apps have different Security Rule implications. Review the actual arrangement and other applicable clinical or payer requirements.
Must every telehealth appointment be recorded?
No universal HIPAA requirement makes recording every appointment necessary. Decide whether a recording is justified, how it may be used and what permissions, safeguards and retention arrangements apply before enabling the feature.
Does every telecommunications supplier need a BAA?
The decision depends on the supplier's role. HHS distinguishes a mere transmission conduit from a vendor that also creates, receives or maintains PHI on the provider's behalf. Review the service and additional features rather than applying a blanket rule.
What should trigger another telehealth privacy review?
Review material changes such as a new recording or transcription feature, supplier, support arrangement, data use or delivery model. An incident, patient complaint or failed workflow test may also reveal a need to reassess the controls.
Review the appointment journey before expanding it
Bring the proposed platform, enabled features and one representative appointment flow. Discuss a scoped telehealth privacy and security review with clear responsibilities and practical follow-through.