HIPAA compliance for telehealth means every virtual visit follows the HIPAA Privacy, Security, and Breach Notification Rules. The COVID-era grace period ended in 2023. Your platform vendor must sign a business associate agreement (BAA). That is a contract to protect patient data. You also need encryption, access controls like unique logins, policies, training, and a telehealth risk analysis.
The pandemic-era free pass is gone. OCR’s enforcement discretion for telehealth ended on May 11, 2023, with a 90-day transition period that expired August 9, 2023. Since that date, every virtual visit your practice conducts is held to the full weight of the HIPAA Privacy, Security, and Breach Notification Rules.
If you are still running telehealth the way you did in 2020, you have a compliance problem. Here is how to fix it.
The Enforcement Landscape Has Changed
During COVID, OCR stated it would not penalize providers using non-compliant platforms for telehealth in good faith. That led many providers to use FaceTime, Skype, and consumer-grade Zoom.
That era is over. OCR kept announcing enforcement actions all through 2024. In December 2024, OCR imposed a $548,265 penalty on Children’s Hospital Colorado. The reason was HIPAA Privacy and Security Rule violations. That same week, OCR imposed a $1.19 million penalty on Gulf Coast Pain Consultants for Security Rule violations. Telehealth providers face penalties like these when they skip security basics.
Platform Requirements: Three Non-Negotiables
Meeting HIPAA telehealth requirements starts with your platform. Every telehealth tool that touches ePHI (electronic protected health information, meaning patient health information in digital form) must meet three basic conditions:
1. A Signed Business Associate Agreement
Your telehealth vendor is a business associate. If they will not sign a BAA, you cannot use them for patient care. Consumer versions of Zoom, Google Meet, Microsoft Teams, WhatsApp, and FaceTime do not offer BAAs. Using any of them for patient care means you have no signed agreement with the vendor to protect your patients’ data.
2. Encryption in Transit and at Rest
When ePHI travels over a network, you must protect it from people who should not see it. That rule is 45 CFR 164.312(e)(1). Under today’s rule, encryption is “addressable.” That means you decide if it is reasonable and appropriate for your practice.
If it is, you use it. If it is not, you write down why. Then you use an equal alternative if one is reasonable. The proposed Security Rule changes would make encryption mandatory, with no addressable option.
A common benchmark is TLS 1.2 or higher for data in transit (moving over a network) and AES-256 for data at rest (stored). If your platform cannot confirm how it encrypts both, find one that can.
3. Access Controls
Only authorized users should join a session or access recorded visit data. 45 CFR 164.312(a)(1) requires a unique user ID for each person and a plan for emergency access. Automatic logoff and encryption are addressable (see above). In practice: unique logins per staff member, session timeouts, and multi-factor authentication.
The Security Rule Applies to Every Virtual Visit
Telehealth is not exempt from the 45 CFR 164.312 technical safeguards. The same standards that govern your EHR govern your video visits:
- Access controls (45 CFR 164.312(a)(1)): Only people you have given access rights can get in. Unique user IDs and an emergency access plan are required. Automatic logoff is addressable.
- Audit controls (45 CFR 164.312(b)): Logs showing who accessed what, when, and from where.
- Integrity controls (45 CFR 164.312(c)(1)): Policies and procedures that keep ePHI from being changed or destroyed in ways it should not be.
- Transmission security (45 CFR 164.312(e)(1)): Protect ePHI from people who should not see it while it moves over a network. For telehealth, that means video, audio, chat, and shared files. Encryption here is addressable.
A proper risk assessment will identify where your telehealth workflows fall short.
Patient Consent and Privacy Considerations
The Privacy Rule does not disappear because a visit happens over video. Patients should know how their information will be used during virtual visits. Think about who can see or hear the visit, including staff in the room and anything shared on screen. Session recordings can be part of the designated record set. That is the set of records a practice keeps and uses to make decisions about patients. States with stricter privacy laws (California’s CMIA, for example) may require additional consent.
Document your telehealth consent process. If OCR investigates, “we told them verbally” is not a defensible answer.
Common Mistakes That Create Real Liability
After working with medical practices on HIPAA compliance, these are the mistakes we see repeatedly:
- Using consumer apps without BAAs. If your vendor will not sign a BAA, the platform is off limits for clinical use.
- No risk analysis covering telehealth. Many practices never updated their risk assessment to include telehealth workflows and vendors added during COVID.
- Shared login credentials. Multiple staff using one account eliminates audit trail integrity and violates access control requirements.
- Ignoring the waiting room. Unmonitored virtual waiting rooms can let patients overhear or see other patients’ information.
- Recording sessions without safeguards. Visits stored on local drives, unencrypted cloud storage, or personal devices create breach exposure.
What the Proposed Security Rule Means for Telehealth
On January 6, 2025, HHS published a proposed rule (called an NPRM). It includes changes that directly affect telehealth. It is not law. It has not been finalized, and OCR is not enforcing it. As of August 2026, HHS’s target date for a final rule is July 2027. If finalized:
- “Addressable” goes away. Encryption, MFA, and other controls would become mandatory. You could no longer just write down why you skipped one.
- Asset inventory required. You would have to list every device and system that touches ePHI, including the devices used for telehealth.
- Mandatory testing. Vulnerability scans (checks for security weak spots) at least every six months. Penetration testing (a controlled attempt to break in) at least every 12 months.
- 72-hour restoration. Plans to get lost systems and data back within 72 hours.
Read our full breakdown of the proposed Security Rule changes for details on timelines and preparation steps.
Compliant Telehealth Platforms Worth Evaluating
Several vendors sell platforms built for clinical use and say they will sign BAAs. These include Doxy.me, Zoom for Healthcare (separate from consumer Zoom), Microsoft Teams for Healthcare, and smaller options like Updox, VSee, and TheraNest. Plans and terms change. Get a signed BAA for the exact plan you use before your first patient visit.
A compliant platform alone is not enough. You still need policies, training, risk analysis, and proper configuration to meet HIPAA telehealth requirements.
Get Your Telehealth Program Compliant
If your practice adopted telehealth during COVID and never formalized compliance, now is the time. OCR is actively enforcing, the proposed Security Rule would raise the bar further if finalized, and “we started during the pandemic” is not a defense.
We help practices close telehealth compliance gaps and build programs that hold up under scrutiny. Talk to our HIPAA consulting team to get started.
Key stat: The HHS enforcement discretion for telehealth during COVID-19 expired in May 2023. Since then, OCR has resumed full enforcement of HIPAA requirements for telehealth platforms, including the requirement for signed Business Associate Agreements with video conferencing vendors.
Sources
Related Reading
Try three of our 3D staff training courses free →
Frequently Asked Questions
Is telehealth still covered by HIPAA enforcement discretion?
No. OCR's COVID-era enforcement discretion for telehealth ended on May 11, 2023, and the 90-day transition period expired on August 9, 2023. Since then, every virtual visit is held to the full HIPAA Privacy, Security, and Breach Notification Rules.
Can I use FaceTime, consumer Zoom, or WhatsApp for telehealth visits?
No. Consumer versions of Zoom, Google Meet, Microsoft Teams, WhatsApp, and FaceTime do not offer Business Associate Agreements. Using them for patient care means you have no signed agreement with the vendor to protect your patients' data.
What does a telehealth platform need for HIPAA compliance?
Three basic conditions: first, a signed Business Associate Agreement; second, encryption of patient data in transit (moving over a network) and at rest (stored); a common benchmark is TLS 1.2 or higher in transit and AES-256 at rest. Third, access controls, such as a unique login for each staff member, session timeouts, and multi-factor authentication. Under the current Security Rule, encryption is addressable, which means you must use it if it is reasonable and appropriate. If it is not, you write down why and use an equal alternative if one is reasonable. A proposed rule, not yet final, would make encryption mandatory.
Do telehealth session recordings fall under HIPAA?
Yes. A recording that contains patient information is ePHI. It can also be part of the designated record set. That is the set of records a practice keeps and uses to make decisions about patients. Recordings stored on local drives, unencrypted cloud storage, or personal devices create breach exposure and should be protected by the same safeguards as any other ePHI.
Do I need patient consent for telehealth visits?
Patients should know how their information will be used during virtual visits. You should also write down your telehealth consent process. States with stricter privacy laws, such as California under the CMIA, may require additional consent beyond what HIPAA calls for.