Telehealth and HIPAA: Platforms, BAAs, and Post-PHE Rules

During the COVID public health emergency, OCR announced it would not penalize good-faith telehealth over non-public-facing consumer apps (FaceTime, Zoom without a BAA, Skype) even where HIPAA compliance was imperfect. That discretion ended with the PHE on May 11, 2023; OCR granted a 90-day transition through November 6, 2023, and since then the ordinary rules apply in full. Concretely: the platform must be under a BAA, the Security Rule risk analysis must cover the telehealth service, and the tolerated 'any video app in a pinch' posture is over. Providers still running pandemic-era stacks are carrying an unremediated known risk, the exact fact pattern current OCR enforcement targets.

No platform is 'HIPAA-certified', no such certification exists. The question is whether the vendor will sign a BAA covering the service and whether the service supports your Security Rule obligations: encryption in transit (and at rest for recordings and chat), unique user authentication, access controls, session security, audit logging, and breach reporting commitments. Major healthcare-oriented offerings (Zoom for Healthcare, Microsoft Teams under Microsoft's BAA terms, Doxy.me, and EHR-integrated modules) meet these when configured correctly; free consumer tiers of the same brands often do not include BAA coverage. Configuration is on you: waiting-room controls, disabled unnecessary recording, scoped admin access, the BAA covers the vendor's side, not your settings.

Treat clinician endpoints and locations as part of the covered environment. Devices: managed or verified endpoints with encryption, screen lock, current patching, and no PHI stored locally without controls, personal devices need an enforceable BYOD policy. Networks: VPN or TLS-only access; no clinical sessions over open public Wi-Fi. Physical privacy: private rooms on both ends where feasible, headphones, and screen positioning, OCR's telehealth guidance treats overheard sessions as a real disclosure risk. Recordings: default off, and where used, stored as PHI with retention rules. Household members and smart speakers are the low-tech threats risk analyses skip; a documented remote-work safeguard policy plus training covers the gap.

Yes, this is the sharpest current risk. OCR's online-tracking guidance (issued 2022, revised 2024 after litigation trimmed parts of it) takes the position that IP addresses and identifiers collected on pages relating to an individual's health care can be PHI, and telehealth pages, appointment booking, provider search, symptom checkers, patient portal logins, are the paradigm cases. Analytics pixels sending that data to ad platforms without a BAA or authorization have driven hundreds of breach reports, class actions against health systems, and FTC actions (GoodRx, BetterHelp) where HIPAA did not reach. Practical floor: inventory every tracker, remove third-party ad tech from authenticated and health-related pages, and route necessary analytics through BAA-covered or first-party tooling.

Three recurring layers. Consent: many states require documented patient consent to telehealth as a modality, separate from treatment consent. Recording: all-party consent states (California, Illinois, and others) make session recording without explicit consent a wiretap issue, HIPAA compliance does not cure it. Licensure and prescribing: the clinician generally must be licensed where the patient sits, with controlled-substance prescribing governed by Ryan Haight Act rules and evolving DEA telemedicine regulations. Add state health-data statutes, Washington's My Health My Data reaches telehealth data with a private right of action, and the compliance map is HIPAA plus a state matrix, checked per service line and per state served.