Yes. HIPAA covers telehealth: any HIPAA-covered entity that transmits health information electronically during a virtual visit must comply with the Privacy, Security, and Breach Notification Rules. The immediate priorities are signing Business Associate Agreements with every technology vendor, completing a documented risk analysis, and putting reasonable safeguards and breach-response procedures in place. HHS’s Office for Civil Rights and the FTC are the two federal authorities that matter here, and both have tightened their expectations now that pandemic-era enforcement discretion has ended.
TL;DR:
- Most telehealth providers must sign Business Associate Agreements with vendors creating or transmitting ePHI through video, messaging, or storage platforms.
- A documented risk analysis specific to a practice’s environment is essential for compliance, especially to address risks like unsecured Wi-Fi and device loss.
- Audio-only calls over landlines are not subject to HIPAA’s Security Rule, but VoIP and mobile calls transmitting PHI require full safeguard compliance.
- Breach notifications must follow a strict sequence, with detailed documentation, including log files and risk assessments, to satisfy OCR investigations.
- Telehealth privacy notices and patient consent forms require updates to reflect virtual-specific data handling, and staff must undergo regular training on these protocols.
A covered entity, meaning a health plan, health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction, does not lose that status by moving a visit online. The same three HIPAA rules that govern an in-person exam apply to a video consult, a remote monitoring session, or a portal message. Protected health information (PHI) becomes electronic PHI (ePHI) the moment it is created, stored, or transmitted digitally, and that shift is what pulls the Security Rule into play alongside the Privacy Rule.
The Privacy Rule sets the baseline: providers may use and disclose PHI for treatment, payment, and health care operations without special authorization, but everything else requires patient consent or falls under a specific exception. The “minimum necessary” standard applies just as strictly in a telehealth session as in a clinic hallway, so a provider should not pull up a patient’s full chart on a shared screen when only the current complaint is relevant. Every covered entity also has to maintain and distribute a Notice of Privacy Practices that patients can actually read and understand, and that notice needs updating to reflect how a practice handles video platforms, recordings, and app-based messaging.
The Security Rule adds a technical layer that only activates when ePHI is involved. According to HHS/OCR guidance on audio-only telehealth, a traditional landline call is not subject to the Security Rule because no electronic transmission of ePHI occurs, but a VoIP call, a video platform, or a mobile app crosses that line and triggers the full set of administrative, physical, and technical safeguard requirements.
A few structural points matter for anyone building or auditing a telehealth program:
That last point trips up a lot of practices. A wellness app a provider recommends to a patient, but does not integrate into clinical workflows, may never touch HIPAA at all. That does not mean it is unregulated: the FTC has its own health privacy authority that fills part of that gap, and providers who recommend such tools should know the difference before assuming a compliance box is checked.
Not every technology vendor that touches a telehealth workflow is a business associate. A telecommunications carrier that simply routes a phone call without accessing its content is generally treated as a conduit, exempt from BAA requirements. But a video platform, scheduling tool, cloud storage provider, or AI transcription service that creates, receives, maintains, or transmits ePHI on a covered entity’s behalf is a business associate, full stop, and needs a signed BAA before it ever touches patient data.
This distinction gets murky with cloud infrastructure. Guidance on HIPAA and cloud computing makes clear that a cloud service provider counts as a business associate even when it never holds the decryption keys to the data it stores, so “we can’t read it anyway” is not a defense against the BAA requirement.
A usable BAA should cover, at minimum:
Beyond the contract language, a practice should verify the technical claims a vendor makes rather than take a sales page at face value. That means confirming encryption in transit and at rest, checking whether the platform logs access to ePHI in a way that supports an audit trail, requiring multi-factor authentication for staff accounts, understanding how sessions time out on shared or unattended devices, and asking directly how long call or video recordings are retained and who can access them.
Pro Tip: Ask every vendor for their most recent third-party security assessment or SOC 2 report before signing, not just a marketing claim of “HIPAA-compliant” software.
Keep a file for each vendor containing the signed BAA, the security documentation reviewed, and the date of the last reassessment. When OCR asks for evidence of due diligence during a complaint investigation, a verbal assurance from a sales rep does not count. A dated paper trail does.
The HHS guidance on risk analysis describes it as the foundation the rest of the Security Rule sits on: an accurate, thorough, and documented assessment of every vulnerability to the ePHI a practice creates, receives, maintains, or transmits. Buying software marketed as “HIPAA-compliant” does not satisfy this requirement. The same guidance is explicit that risk analysis has to be specific to a covered entity’s own environment, devices, and workflows, not borrowed from a vendor’s generic compliance claims.
Telehealth introduces risk categories that a traditional in-office risk analysis might not anticipate:
A documented, site-specific risk analysis is the single requirement OCR most consistently cites in settlement actions involving electronic PHI, according to the HHS risk analysis guidance, which underscores why skipping this step is the costliest shortcut a practice can take.
Reasonable mitigations, once risks are identified, tend to fall into a short list: encrypt ePHI both in transit and at rest, enforce mobile device management on any device that touches patient data, keep audit logs that record who accessed what and when, apply role-based access control so front-desk staff cannot see the same records as a treating physician, and run workforce training at least annually with refreshers after any policy change.
The point of the risk analysis is not the document itself but what it drives. Findings should feed directly into a prioritized action plan, updated policies, and a budget conversation about which gaps get closed first. A risk analysis that sits in a drawer after the audit protects nobody.
Phone-based care occupies a genuinely different legal position than video. Per HHS/OCR’s guidance on audio-only telehealth, a call placed over a traditional landline is not subject to the Security Rule at all, because no electronic transmission of ePHI takes place. The same guidance confirms that VoIP calls, mobile phone calls, and any other electronic audio transmission do fall under the Security Rule, since ePHI is moving across a network that can be intercepted, logged, or misdirected.
That split has practical consequences for how a practice sets up its phone-based visits:
The safest posture is to treat every audio call as if the Security Rule applies, verify vendor status before assuming a conduit exception, and document the reasoning either way.
The HIPAA Breach Notification Rule defines a breach as an impermissible use or disclosure of unsecured PHI that compromises its security or privacy, unless the covered entity can demonstrate through a documented risk assessment that there is a low probability the information was compromised. A misdirected email or a lost unencrypted laptop typically counts; a properly encrypted device that goes missing usually does not, because the data itself remains unreadable.
When a breach does occur, the response follows a fixed sequence:
Pro Tip: Draft the notification letter template and the internal escalation contact list before an incident happens, not during one; a breach response written under pressure takes far longer and invites errors.
Keep records of every step, including the risk assessment used to determine whether notification was required at all. OCR reviews that documentation closely, and the absence of a paper trail is often treated as evidence the assessment never happened.
A short list of concrete actions closes most of the gap between “aware of HIPAA” and “actually compliant.” Update the Notice of Privacy Practices to describe telehealth-specific data handling, and confirm every patient receives it and acknowledges consent to telehealth before the first virtual visit. Coach patients briefly on private spaces, headphones, and keeping software updated, since incidental disclosure often starts on the patient’s end, not the provider’s.
| Record to keep | Why it matters |
|---|---|
| Documented risk analysis | Foundation OCR checks first during any investigation |
| Signed BAAs for every vendor | Confirms contractual security and breach obligations |
| Incident response log | Shows timely handling if a breach ever occurs |
| Training attendance records | Demonstrates ongoing workforce compliance effort |
Most compliance failures I have seen trace back to skipped risk analyses, thin BAAs signed without reading the security clauses, or patient communication that assumes people already understand video call risks. Usability and privacy pull against each other constantly, and the practices that get it right treat that tension as a design problem, not an afterthought.
— Bryan
For primary reading, start with HHS’s telehealth guidance and audio-only telehealth guidance, the risk analysis guidance, the Breach Notification Rule, and the FTC’s Health Breach Notification Rule page for apps outside HIPAA’s reach.
Building a telehealth program that treats privacy as a first design choice, rather than paperwork added afterward, is a crucial aspect of effective virtual care services. Every FitRx consultation for weight loss, anxiety and depression medication, birth control, or primary care runs through licensed providers with the same documented safeguards this article describes, and patients get continuous support through the app rather than a one-time visit that leaves privacy questions unanswered. If your practice is evaluating how a compliant virtual care model actually runs day to day, FitRx’s plans show what that looks like from the patient side, with pricing starting at an affordable monthly rate on the Annual Plan. Check current availability and see which plan fits your needs.
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
Telehealth visits are HIPAA compliant when the provider is a covered entity that follows the Privacy, Security, and Breach Notification Rules, including signed BAAs with every technology vendor involved. Compliance depends on the provider’s practices and vendor contracts, not on the technology alone, according to HHS’s telehealth guidance.
There is no single new federal telehealth law for 2026; providers instead operate under the existing HIPAA framework now that pandemic-era enforcement discretion has ended, meaning full compliance with the Privacy, Security, and Breach Notification Rules is required as described in HHS’s telehealth guidance. Providers using non-HIPAA health apps should also watch FTC enforcement, since the Health Breach Notification Rule amendments increased notification requirements and penalties starting July 29, 2024.
No new HIPAA rule specific to 2026 has been issued; the operative requirements remain the Privacy, Security, and Breach Notification Rules described in HHS’s HIPAA guidance. What has changed is enforcement posture, since the flexibility HHS allowed during the COVID-19 public health emergency no longer applies to telehealth technology choices.
Telehealth privacy policies must include an updated Notice of Privacy Practices describing how video, audio, and messaging platforms handle patient data, along with signed BAAs for every vendor that touches ePHI. Providers should also verify whether a given app falls under HIPAA or instead under the FTC’s Health Breach Notification Rule, since the obligations differ.
.svg)
