Navigating HIPAA Compliance in Telemedicine: A Guide

Telehealth has become a standard model of care delivery, offering patients access to medical services regardless of their location or time zone. All they need is an internet connection.

However, with increased accessibility of medical services comes the need for safeguarding patient data and protection against unauthorized access. That's where HIPAA, the Health Insurance Portability and Accountability Act, steps in. Understanding HIPAA and telemedicine together is essential for any provider delivering virtual care in 2026, especially following the public health emergency expiration telehealth rules that took effect in 2023.

In our guide, we delve into essential topics related to HIPAA compliance for healthcare professionals:

• What is HIPAA?
• How do I choose the right telemedicine platform?
• What practices are included in HIPAA compliance?
• What measures are taken for violations?
• How does secure messaging between patient and physician occur?

Stay tuned.

Key Aspects of HIPAA: What You Need to Know

HIPAA is a federal law designed to safeguard protected health information. The United States Department of Health and Human Services (HHS) has established a set of rules regulating the confidentiality of patients' medical records. Unauthorized disclosure of private medical information is illegal.

This applies to:

• Healthcare service Providers
• Insurance companies
• Information platforms
• Cloud services.

In other words, to all companies and individuals with access to medical information.

The End of COVID-19 PHE Enforcement Discretion

During the pandemic, the HHS Office for Civil Rights (OCR) exercised enforcement discretion, relaxing certain HIPAA requirements to make telemedicine more accessible. Those flexibilities are no longer in effect. On April 12, 2023, OCR announced that its COVID-19 Notifications of Enforcement Discretion would expire on May 11, 2023, when the Public Health Emergency officially ended. OCR provided a 90-day transition period running from May 12, 2023 through August 9, 2023, during which covered providers were not penalized for good-faith telehealth noncompliance. That transition period has now fully expired. As of August 9, 2023, all covered entities must comply with HIPAA Rules in full when providing telehealth services.

A key practical consequence is that platforms previously permitted under enforcement discretion, such as standard consumer versions of Skype or FaceTime, are no longer acceptable for telehealth visits. Providers must use only HIPAA-compliant platforms and must have a valid Business Associate Agreement (BAA) in place. Organizations like AAAAI explicitly identify tools such as Zoom for Healthcare and Doxy.me as examples of compliant options.

The HIPAA Privacy Rule establishes national standards for protecting medical records and applies to health plans, clearinghouses, and certain electronic healthcare transactions dealing with PHI.

The HIPAA Security Rule ensures the safety of electronic Protected Health Information (ePHI), which includes any PHI created, stored, transmitted, or received electronically.

The Importance of Telehealth Risk Assessments

Before adopting any virtual care platform, providers must conduct a telehealth risk assessment. This is a core requirement of the HIPAA Security Rule. It involves identifying where ePHI is created, received, maintained, or transmitted across your telehealth workflow. A thorough assessment evaluates potential vulnerabilities, from software gaps to the physical environment where calls take place.

Healthcare organizations must perform this analysis regularly. It should be updated whenever new telehealth technologies are introduced. Documenting your risk assessment helps outline targeted security measures to reduce identified threats. Skipping this critical first step leaves the practice exposed to data breaches and immediate OCR penalties.

How to Choose a HIPAA-Compliant Telehealth Platform

Since the PHE transition period ended on August 9, 2023, providers can no longer rely on enforcement discretion to justify using non-compliant tools. Even if a BAA is signed, the underlying platform must itself meet HIPAA technical safeguard requirements. (See the risk assessment section above for the required first step before selecting any platform.) A platform that securely guards your data should have:

• Secure messaging system
• Data encryption
• Staff training
• BAA (Business associate agreement)
• Integrations
• Security audits

Approved HIPAA-Compliant Telehealth Platforms

The following platforms are widely recognized as HIPAA-compliant and suitable for telehealth use in 2026. Each offers BAA execution and meets the technical safeguard requirements under the HIPAA Security Rule:

• Zoom for Healthcare. A healthcare-specific configuration of Zoom with encryption, access controls, and BAA availability. Providers must configure it correctly to maintain compliance.
• Doxy.me. A browser-based platform designed specifically for healthcare, requiring no app download from the patient. BAAs are available on paid tiers.
• Teladoc Health. An enterprise telehealth platform with built-in HIPAA compliance and EHR integration capabilities.
• Updox. Offers HIPAA-compliant video visits alongside secure messaging and patient communication tools.
• Vsee. A clinical-grade video platform with end-to-end encryption and BAA support.

Standard consumer tools, including the non-healthcare version of Skype and personal Zoom accounts, do not qualify, regardless of whether a BAA is attempted.

Secure Messaging

Secure messaging pertains to ePHI (electronic Protected Health Information). According to HIPAA guidelines, both covered entities and their business associates must implement measures to protect messages. A compliant system requires end-to-end encryption for all ePHI in transit, strict access controls with unique user identifiers, and strong authentication to verify sender and recipient identity. Access permissions must be limited to authorized personnel only, as shown in the screenshot below. Systems must also enforce message retention and disposal policies, support encrypted file transfer for attachments such as medical images, and be governed by written organizational policies covering acceptable use, password management, and incident reporting.

Secure file transfer

In healthcare, files such as medical images or documents often need to be shared securely. Secure messaging systems should allow the secure transfer of files, ensuring that attachments containing ePHI are encrypted and protected during transmission.

Secure messaging policies

Organizations should establish clear policies for secure messaging, outlining guidelines for employees on how to use messaging systems appropriately, including password management, handling sensitive information, and reporting security incidents.

Staff Training

Staff training ensures that every healthcare professional understands their responsibilities and the unique challenges that arise in virtual care settings. Telehealth introduces risks that do not exist in a clinic setting. Staff must be trained to conduct sessions from a private, secure location where conversations cannot be overheard. Providers must also understand the rules around bystander consent. If a colleague, student, or family member is present on either side of the call, informed consent must be obtained from the patient and documented.

Employees should be trained to recognize potential risks and take necessary precautions to prevent breaches, such as using a VPN when working remotely. Regular refreshers keep employees up-to-date with the latest requirements for handling electronic devices and reporting security incidents promptly.

Business Associate Agreement

The telehealth services provider should be willing to sign a business associate agreement with covered entities, outlining their responsibilities regarding the protection of patient data. This legal contract ensures that the platform provider shares the responsibility for HIPAA compliance.

Integration capabilities

The platform should be able to integrate with Electronic Health Records (EHR) systems securely. It ensures that medical history is accurately recorded and securely shared between healthcare providers. Seamless integration enhances the overall quality of care you give.

Regular security audits

The platform provider should conduct regular security audits and assessments to identify and address vulnerabilities, ensuring continuous HIPAA compliance and a high level of security.

Informed Consent Requirements for Telemedicine

Obtaining informed consent before a virtual visit is both an ethical obligation and, in many states, a legal requirement. For telehealth specifically, informed consent must go beyond standard consent to address the technology itself. Providers should explain the format of the visit (video or phone), describe the privacy limitations inherent in remote delivery, confirm whether the session will be recorded and obtain explicit consent if so, and inform the patient of their right to withdraw consent and continue care through in-person alternatives. Patients should understand that no digital platform is entirely without risk and that steps on their end, such as using a private network and a personal device, can reduce exposure.

Requirements vary by state, so providers must verify what their jurisdiction mandates. Some states require written consent specifically for telehealth, while others accept verbal consent documented in the medical record.

State-Specific Informed Consent Requirements

State laws governing telehealth informed consent vary significantly. Some states mandate explicit written or verbal consent specifically for virtual visits. Others integrate telehealth consent into general medical consent statutes. Organizations like AAAAI recommend verifying these regulations through resources like the Center for Connected Health Policy.

Practices operating across multiple states must track differing requirements. Failing to adhere to state-specific mandates is a common compliance gap. Providers should verify what their jurisdiction mandates and keep a log of state consent requirements, updating it annually as telehealth laws continue to evolve. State medical boards are the authoritative source for jurisdiction-specific rules, and consulting them directly before expanding to a new state is strongly recommended.

Best practices for obtaining informed consent prior to a virtual visit include:

• Disclose the telehealth format. Inform the patient that the visit will be conducted via video or phone, and explain the technology being used.
• Explain privacy limitations. Patients should understand that no digital platform is entirely without risk and that they should take steps to protect their own privacy (see the patient section below).
• Address recording. Clarify whether the session will be recorded and obtain explicit consent if so.
• Document consent. Record that consent was obtained in the patient's chart before the session begins, noting the date, method, and scope.
• Obtain fresh consent when needed. If the patient changes, the technology changes, or a new clinician joins the care team, re-consent may be required.

Providers operating across multiple states should review state telehealth consent laws annually, as these requirements continue to evolve.

Interstate Licensure and Telehealth: What Providers Need to Know

HIPAA compliance is not the only legal obligation providers must satisfy before delivering virtual care. Licensure is a separate and equally important requirement. A provider delivering telehealth to a patient in another state must hold a valid license in the state where the patient is located at the time of the visit, regardless of where the provider is based. This is frequently the first practical barrier small practices encounter when expanding telehealth services.

To simplify multi-state practice, licensure compacts have been established. The Interstate Medical Licensure Compact (IMLC), for example, offers an expedited pathway for physicians to obtain licenses in multiple participating states through a single application process. Similar compacts exist for other licensed health professions. Providers planning to treat patients across state lines should verify compact participation in each relevant state and confirm licensure requirements with the appropriate state medical board before seeing out-of-state patients via telehealth.

Guidance on HIPAA and Audio-Only Telehealth

Audio-only telehealth, meaning visits conducted by telephone without video, presents a distinct set of HIPAA considerations. HHS OCR has issued specific guidance on this topic, recognizing that audio-only services are essential for patients who lack access to video-capable devices or reliable internet connections.

What the OCR Guidance Covers

Under the HIPAA Privacy Rule, covered entities may use the telephone to provide telehealth services without violating HIPAA, provided appropriate safeguards are in place. Key points from the OCR guidance include:

• Verification of patient identity. Before discussing PHI, providers should verify that they are speaking with the correct patient using established identification protocols.
• Minimum necessary standard. Only the PHI required for the specific encounter should be discussed during an audio-only visit.
• BAA requirements for third-party platforms. If a third-party telephony platform or call routing service is used, a BAA is required unless the vendor qualifies as a conduit (a basic transmission-only service such as a standard telephone company).
• No recording without consent. Recording a telephone visit creates a new record containing PHI. Explicit patient consent is required, and the recording must be stored securely in compliance with the Security Rule.

Audio-only telehealth can be a fully compliant and valuable service modality when these safeguards are applied consistently.

Patient Privacy Risks and How to Educate Your Patients

Providers are not the only ones responsible for maintaining privacy during a telehealth encounter. Patients introduce their own risks based on their physical location and environment. OCR has published resources specifically to help providers educate patients on secure practices.

Providers must verify the patient's location and environment at the start of the call. If a patient is calling from a public space, such as a gym or a ski lift, sensitive information could easily be overheard. In these cases, providers should ask the patient to move to a private area before proceeding with the visit.

Key guidance to share with patients includes:

• Avoid public Wi-Fi. Unsecured networks expose health information to interception. Patients should use a private, password-protected connection for all telehealth visits.
• Use a private room. Patients should conduct visits from a location where they cannot be overheard by family members, roommates, or bystanders who have not been included in the consent process.
• Use personal devices. Shared or work-owned devices may have monitoring software or shared access. A personal device with an updated operating system is preferable.
• Log out after visits. Patients should close the telehealth app or browser tab immediately after a session ends and log out of any patient portal.

Providers can distribute these tips through pre-visit reminder messages, patient portal notifications, or a brief verbal prompt at the start of each session. OCR's published "Privacy and Security Tips for Patients" document is a free resource that can be linked or printed for distribution.

HIPAA Compliance Penalties and What Happens During a Violation

HIPAA compliance penalties play a crucial role in ensuring that healthcare organizations adhere to the regulations. The penalties for non-compliance depend on the severity of the violation and whether the entity knew or should have known about the violation. Here are some examples of HIPAA violations and the corresponding punishments:

Unintentional Violations

• Fine: up to $50,000 per violation, with an annual maximum of $1.5 million.
• Example: accidental disclosure of patient information due to a misaddressed email. If multiple patients' information is disclosed in a single incident, each patient's record may be considered a separate violation.

Reasonable Cause

• Fine: up to $50,000 per violation, with an annual maximum of $1.5 million.
• Example: failure to conduct a thorough risk assessment to identify vulnerabilities in the handling of electronic patient data.

Willful Neglect (Corrected)

• Fine: minimum of $10,000 per violation, with an annual maximum of $1.5 million.
• Example: not having proper technical safeguards in place despite awareness of the risk, but correcting the issue promptly after the violation is discovered.

Willful Neglect (Not Corrected)

• Fine: minimum of $50,000 per violation, with an annual maximum of $1.5 million.
• Example: not addressing a known vulnerability or ignoring a breach in patient privacy, leading to further unauthorized access or disclosure of patient information.

Criminal Violations

• Fine: up to $250,000 and imprisonment for up to 10 years for intentional wrongful disclosure or obtaining patient information under false pretenses.
• Example: deliberate theft or sale of patient records for personal gain.

Individual Penalties

• Fine: individuals who knowingly obtain or disclose PHI without authorization can face fines of $50,000 and imprisonment for up to one year.
• Example: an employee accessing patient records without a valid reason, such as curiosity or personal vendetta.

State Attorney General Enforcement

• Fine: state attorneys general can also bring civil actions against entities for HIPAA violations, resulting in monetary penalties.
• Example: a healthcare organization suffering a data breach and not promptly notifying affected patients, as required by state laws, leading to legal action by the state attorney general.

In addition to the penalty tiers above, the HIPAA Breach Notification Rule imposes separate obligations whenever a breach of unsecured PHI occurs. Covered entities must notify each affected individual, and must also report the breach to HHS. When a breach affects 500 or more individuals in a single state or jurisdiction, the covered entity must also notify prominent media outlets serving that area. Notifications must be provided without unreasonable delay. Failure to meet these notification obligations is itself a violation subject to the penalty structure above.

It's important to note that the penalties can also include corrective action plans, increased oversight by the U.S. Department of Health and Human Services, and reputational damage, which can have long-lasting consequences for healthcare organizations and individuals involved.

Frequently Asked Questions

1. Can I still use standard Skype for telehealth visits if I sign a BAA?

No. Since the COVID-19 PHE transition period ended on August 9, 2023, enforcement discretion no longer applies. Standard consumer Skype does not meet HIPAA technical safeguard requirements, and a BAA alone cannot make a non-compliant platform compliant. Providers must use a platform that is purpose-built or configured for HIPAA compliance, such as Zoom for Healthcare or Doxy.me.

2. What happened to the HIPAA telehealth flexibilities from the COVID-19 pandemic?

The HHS OCR Notifications of Enforcement Discretion expired when the COVID-19 Public Health Emergency ended on May 11, 2023. OCR provided a 90-day transition period that ran through August 9, 2023. After that date, full HIPAA compliance was required for all telehealth services without exception.

3. Are standard phone calls HIPAA compliant for telehealth post-PHE?

Yes, standard audio-only telehealth HIPAA compliance is achievable using regular telephone lines, because standard telephone networks act as conduits and do not require a BAA. However, if you use a third-party app or software to route the call, a BAA is required. Providers must still verify patient identity, apply minimum necessary standards, and obtain consent before recording.

4. Do I need a separate BAA for every telehealth platform I use?

Yes. Any vendor that creates, receives, maintains, or transmits ePHI on your behalf qualifies as a business associate and requires a BAA. This includes video platforms, secure messaging tools, scheduling software, and any cloud-based storage used in connection with patient care.

5. What are the most important steps a small practice should take to become HIPAA-compliant for telehealth?

Start with a formal risk analysis to identify where ePHI is created and transmitted in your workflow. Then ensure every technology vendor has signed a BAA, implement platform-level encryption and access controls, train all staff on telehealth-specific privacy requirements, and document your policies in writing. Review your compliance posture at least annually or whenever you adopt a new platform.

6. What are the new telehealth guidelines for 2026?

As of 2026, full HIPAA enforcement applies to all telehealth services with no remaining pandemic-era enforcement discretion. Providers should monitor OCR guidance regularly for any updates to privacy and security requirements. Medicare and Medicaid coverage rules for telehealth are governed separately from HIPAA, and providers should track any Congressional telehealth extensions or CMS policy changes that may affect reimbursement and service eligibility.

7. What are the most common HIPAA violations in telehealth settings?

The most frequently cited categories include using non-compliant video platforms that lack proper technical safeguards, failing to execute a BAA with every vendor that handles ePHI, insufficient staff training on telehealth-specific privacy risks, and failure to conduct a formal security risk assessment before launching virtual services. Addressing these four areas proactively reduces the majority of compliance exposure a telehealth practice faces.

8. Does HIPAA apply to telemedicine?

Yes. HIPAA applies fully to telehealth when a covered entity or business associate is involved. The same Privacy Rule, Security Rule, and Breach Notification Rule that govern in-person care govern virtual care without exception. Providers delivering telehealth services must meet all applicable HIPAA requirements, including platform safeguards, BAA execution, and breach notification obligations.

Final Thoughts

In the growing realm of telehealth technology, following HIPAA rules isn't just a legal necessity; it's a promise to patient safety. Understanding the rules, picking the right platforms, and using good practices benefits both healthcare providers and patients. Staying aware and taking action is vital to making the most of telemedicine while keeping patient data private and secure.