HIPAA and telehealth meet wherever a covered provider uses technology to see patients remotely. Every video platform, messaging tool, transcription service and cloud host in that chain touches protected health information, and the full HIPAA Rules apply to all of them again since the pandemic-era relief ended.
This guide covers what changed when that relief ended, which telehealth vendors need a business associate agreement, the Security Rule safeguards a virtual visit needs, how audio-only calls fit, and the new PHI stores telehealth creates.
How does HIPAA apply to telehealth?
Building a telehealth service to HIPAA safeguards?
Agnotic builds telemedicine platforms designed around the HIPAA Security Rule, with vendor data flows mapped from the start.
HIPAA applies to telehealth the same way it applies to in-person care: a covered provider must protect the privacy and security of PHI exchanged in remote visits, sign business associate agreements with vendors that handle it, and apply Security Rule safeguards to the platforms, devices and recordings involved. Telehealth gets no separate rule set.
What telehealth changes is the number of parties and places involved. An office visit keeps PHI inside the provider's walls and systems. A video visit sends it through a video vendor, a scheduling tool, a notification service, a cloud host and two homes, and each link needs a decision.
What changed when the OCR enforcement discretion ended?
When the enforcement discretion ended, everyday video tools stopped being acceptable without HIPAA safeguards. HHS OCR's telehealth notification expired with the COVID-19 public health emergency on 11 May 2023, and covered providers had a transition period until 9 August 2023 to bring telehealth into full compliance.
During the emergency, OCR said it would not penalize providers for good-faith use of non-public-facing communication tools, even without a business associate agreement. That relief is gone. Every vendor handling PHI for the telehealth service now needs a signed agreement, and the provider's risk analysis has to include the telehealth setup.
Providers that launched telehealth quickly in 2020 should check that the tools still in use are the ones they reviewed. Temporary workarounds, such as a clinician's personal video account, tend to outlive the emergency that justified them.
Which telehealth vendors need a business associate agreement?
A telehealth vendor needs a business associate agreement when it creates, receives, maintains or transmits PHI on the provider's behalf. That covers far more than the video platform, so map every service in the visit flow before deciding.
- Video platform: The vendor that carries the audio and video stream, including any recording or transcription features.
- Cloud host: The infrastructure provider that stores or processes the platform's data, even if the data is encrypted and the host cannot view it, as HHS cloud computing guidance explains.
- Messaging and notifications: SMS, email and push services that send visit links or reminders containing PHI.
- Scheduling and intake: Booking tools and form services that collect symptoms, insurance or demographics.
- Transcription and AI scribes: Services that turn the visit into a note or summary.
- Support tools: Help desk and screen-sharing services that may see patient records while staff assist users.
Some parties are not business associates. A clinician or lab receiving PHI to treat the patient is outside the definition, and so is an app the patient picks to collect their own records through the right of access. Consumer health apps outside HIPAA fall under the FTC Health Breach Notification Rule instead.
Keep the vendor map current. Product teams add analytics, error tracking and chat widgets during a build, and each new script on a visit or booking page can receive PHI such as names, appointment types or IP addresses linked to a visit. Review the map whenever a new third-party service is added, not once a year.
What should a telehealth BAA cover?
A telehealth business associate agreement must include the contract terms listed in 45 CFR 164.504(e), and it should also settle the practical questions that matter for video and messaging data. The regulation sets the floor; the service design fills in the rest.
- Permitted uses: What the vendor may do with PHI, limited to providing the service, and whether it may use data to improve its product.
- Safeguards: The vendor's duty to apply Security Rule safeguards to electronic PHI.
- Subcontractors: Assurance that the vendor's own subcontractors, such as its cloud host, sign equivalent terms.
- Breach reporting: How fast and how the vendor reports breaches and security incidents to the provider.
- Access and amendment: Support for the provider's duties when patients ask for their records.
- Return or destruction: What happens to recordings, transcripts and logs when the contract ends.
Read the vendor's standard agreement against the actual features in use. A vendor may sign a BAA for its healthcare plan but exclude features such as AI summaries or third-party integrations, which then cannot be switched on for patient visits.
Security Rule safeguards for virtual visits
The Security Rule's technical safeguards at 45 CFR 164.312 apply to every system in the telehealth flow. Four specifications are required: each user gets a unique identifier, there is a procedure for emergency access, activity is recorded by audit controls, and people or systems are authenticated before access. The others, including automatic logoff, integrity controls and encryption of stored and transmitted ePHI, are addressable: the provider implements each one or records why an equivalent measure is reasonable.
For video visits, those safeguards become concrete design choices. Each clinician has their own login. Visit links are tied to the appointment and the patient, and expire. Audit logs record who joined, when, and who viewed or exported recordings. Streams are encrypted in transit, and stored recordings and transcripts are encrypted at rest.
Multi-factor authentication is good practice for clinician and administrator accounts. HHS has proposed making it required in a January 2025 Security Rule proposal, but it is not required by the rule today.
Administrative safeguards matter as much. The risk analysis must include the telehealth platform, the vendors and the clinicians' home working setups, and workforce training should cover where staff may take visits and how to handle a patient who joins from a public place.
Do audio-only visits fall under HIPAA?
Audio-only visits fall under HIPAA when they involve electronic PHI. HHS OCR guidance on audio-only telehealth explains that a call over a standard landline is not covered by the Security Rule because the information is not electronic, while calls using VoIP, mobile technologies over the internet or cellular networks, or recorded voice involve electronic PHI and need Security Rule safeguards.
Most modern phone systems are electronic somewhere in the chain. Cloud phone systems, softphones on laptops and call recording services all store or transmit voice data, so their vendors need business associate agreements and the calls need the same safeguards as video.
Privacy Rule duties apply to every audio call, electronic or not. Clinicians should verify the patient's identity, confirm the patient can talk privately, and take calls where they cannot be overheard.
Voicemail needs a rule too. A message left for a patient should carry the minimum needed, such as a callback request with the clinic name, unless the patient has agreed to more detail. Store that preference in the patient record so every staff member and automated reminder follows it.
Recordings, chat and photos: the PHI telehealth creates
Virtual visits leave behind data that an exam room never did: recordings of the session, typed chat, photos the patient uploaded, captured screen shares, AI-drafted summaries, and the logs that tie each item to a patient. Each one needs an owner, an access rule and a retention decision.
Recording should be off by default. Where a service records visits for quality or training, the recording is part of the provider's PHI, it may fall within the designated record set if used for decisions about the patient, and patients may ask for it. Workforce training is a health care operation, but de-identified or consented material is the safer choice for training libraries.
Chat and photos are easy to forget. Messages typed during a visit and images uploaded before it often live in the video vendor's system rather than the EHR. Decide whether they are copied into the chart, and how long the vendor keeps its copy.
A telehealth HIPAA review list
Use this list with the privacy officer, the security officer and the telehealth product owner. Each item should have evidence, not only a yes.
- Vendor map: Every service in the visit flow is listed with the PHI it handles.
- Agreements: Each vendor that handles PHI has a signed business associate agreement covering the features in use.
- Risk analysis: The current risk analysis includes the telehealth platform, vendors and home working setups.
- Access: Clinicians have unique logins, and administrator accounts use multi-factor authentication.
- Links: Visit links are tied to the patient and appointment and expire after the visit window.
- Audit logs: Joins, recordings, exports and record views are logged and reviewed.
- Encryption: Streams are encrypted in transit and recordings and transcripts at rest, or the alternative is documented.
- Phone systems: VoIP and recording vendors are covered and audio calls follow the same safeguards.
- Telehealth PHI: Recordings, chats and photos have owners, access rules and retention periods.
- Training: Staff know where they may take visits and how to confirm a patient can speak privately.
How Agnotic can help
HIPAA questions in telehealth are mostly answered in the architecture: which vendors see PHI, where recordings live and who can open them. Agnotic Technologies builds telemedicine platforms for providers with those decisions designed in, including vendor data-flow maps, unique logins and expiring links, audit logging, encryption and retention rules for recordings and chat.
The client's privacy and security officers own the policies and the risk analysis. Agnotic supplies the technical evidence each safeguard needs, so reviews and audits can be answered from the system itself.
Build telehealth with HIPAA safeguards designed in
See how Agnotic designs telemedicine platforms around HIPAA safeguards, or browse the compliance hub.
Related reading on Agnotic
Continue with telehealth security engineering, telemedicine requirements, healthcare IT compliance, HITRUST and HIPAA for APIs.
