HIPAA Software for Telehealth Providers

Telehealth adds three failure modes, not a new rulebook

Telehealth providers are covered entities under the same HIPAA rules as any clinic. What changes is the operational surface. The environment is distributed, the video vendor is load-bearing, and the workforce is often spread across states. That shifts where the program breaks.

Three categories cause most of the pain: transmission security, recording policy, and multi-state operations.

Transmission security is contractual, not optional

45 CFR 164.312(e) requires a covered entity to implement technical safeguards that guard against unauthorized access to ePHI transmitted over a network. In practice, that means your video vendor, your messaging vendor, and your file-transfer vendor must be under a signed BAA. Consumer Zoom, consumer FaceTime, and consumer Google Meet are not. The public-health-emergency enforcement discretion that briefly allowed them ended in April 2023.

What a working program looks like:

• Every patient-facing video, messaging, and file-transfer vendor is listed in a BAA register with the contract start date, expiration, and scope.
• A named owner is responsible for each vendor relationship, with a recurring task to verify the BAA has not expired.
• The workforce has a clear policy on which tools may be used for patient PHI and which may not.

Recording policy is where most programs are thin

Many telehealth practices have not decided whether they record. Others record inconsistently. Both are risks. A defensible recording policy answers:

• Who may record a session and under what clinical circumstances.
• Where recordings are stored and under what BAA.
• How long recordings are retained and how they are destroyed.
• How the patient is informed and whether consent is documented in the chart.

This policy should live in the same system as training attestations and workforce acknowledgment. If a workforce member says “I did not know I could not record,” your compliance system should be able to show whether they were trained on it and when.

Multi-state operations create recurring compliance work

Telehealth practices licensed in several states pick up recurring obligations that are easy to lose track of: license renewal dates per state, DEA registration per state for controlled substances, state-specific telehealth rules, and state breach notification timelines, which are not all 60 days. These are not HIPAA obligations in the strict sense, but they live on the same operational surface and belong in the same task system.

What to look for in the software

• BAA register with expiration alerts. The most common OCR finding in telehealth investigations is an expired or missing BAA. The register should nag before it bites.
• Device and access inventory for distributed workforce. If a clinician sees patients from home, the device they use, the operating system, and the encryption status are compliance artifacts.
• Policy library tied to workforce attestations. Recording, acceptable-use, and texting policies should be signed, versioned, and timestamped per workforce member.
• Incident logging from any location. A breach notification clock starts at discovery, not at the in-office meeting. Incident capture should work from wherever the clinician is.
• Per-clinic flat pricing. Telehealth practices scale headcount faster than brick-and-mortar clinics. Per-seat economics punish that growth.

The defensible telehealth operating model

A working model has five artifacts kept current: workforce roster with device and location metadata, vendor and BAA register with expirations, recording and acceptable-use policies with attestations, incident log, and recurring-task ledger covering license renewals and access reviews. PHIGuard handles all five under per-clinic pricing with BAA coverage at every tier.

For the underlying rules, see our HIPAA basics. For a compliance-program self-check, request the self-assessment. To price the move, see pricing. Multi-location brick-and-mortar practices can compare the multi-location approach since the operational primitives overlap.