A therapist in Ohio logs into a video platform, greets her patient, and starts a session about suicidal ideation. The session is encrypted in transit — but the recording lands on a server with no access controls, no audit logs, and no business associate agreement in place. Three months later, 4,000 patient records surface on a dark web forum. I've seen variations of this story play out more times than I'd like to admit.

HIPAA compliance for telemedicine apps isn't a nice-to-have checkbox. It's a legal obligation that carries real penalties — and in 2026, OCR is watching the telehealth space more closely than ever. If you build, operate, or use a telemedicine platform, this post lays out exactly what the law requires, where organizations keep failing, and what you need to fix before an audit finds it first.

Why OCR Is Laser-Focused on Telehealth in 2026

The pandemic-era enforcement discretion that HHS extended for telehealth officially ended. That grace period let covered entities use consumer-grade platforms like FaceTime and Skype without facing penalties. It was a temporary lifeline — not a permanent waiver.

Now, every telemedicine app that touches protected health information (PHI) must meet the full weight of HIPAA's Privacy, Security, and Breach Notification Rules. OCR has made this abundantly clear in its guidance and its enforcement actions.

In my experience, the organizations most at risk right now are the ones that adopted telehealth tools quickly in 2020 and never went back to audit them. They're still running on assumptions that expired years ago.

What Makes a Telemedicine App HIPAA-Compliant?

Let me be blunt: slapping "HIPAA-compliant" on a marketing page doesn't make it true. I've reviewed dozens of telehealth platforms that claim compliance but can't produce a single risk assessment. Here's what actually matters.

A Signed Business Associate Agreement (BAA)

If your telemedicine vendor handles ePHI on your behalf, they are a business associate under HIPAA. You need a signed BAA before a single patient session takes place. No BAA means no compliance — full stop.

This isn't theoretical. In 2023, OCR settled with MedEvolve for $350,000 after finding the company had allowed a business associate to access ePHI without a proper agreement in place. The lesson: the covered entity bears responsibility for vetting its vendors.

End-to-End Encryption

The HIPAA Security Rule requires covered entities to implement a mechanism to encrypt ePHI in transit and at rest. For telemedicine apps, this means end-to-end encryption on video, audio, chat, and any stored recordings.

"Encryption in transit" alone isn't enough. If session recordings or chat transcripts sit on a server without encryption at rest, you have an addressable specification you'd better be able to justify in writing — or just encrypt it.

Access Controls and Audit Logs

Every telemedicine platform must enforce unique user identification, automatic logoff, and role-based access. It also needs to generate audit logs that track who accessed what ePHI and when.

If your platform can't tell you which staff member viewed a patient's video session record on a specific date, you have a Security Rule gap.

A Current Risk Assessment

HHS requires covered entities and business associates to conduct a thorough risk analysis. This isn't a one-time exercise. Every time you add a new telehealth tool, change vendors, or modify your infrastructure, you need to reassess.

The single most cited deficiency in OCR enforcement actions is the failure to perform an adequate risk analysis. It shows up in nearly every major settlement.

The $1.5 Million Mistake: Real Enforcement You Should Know

In 2018, OCR reached a $1.5 million settlement with Fresenius Medical Care North America after a series of breaches exposed ePHI. Among the findings: missing risk analyses, insufficient device and media controls, and a lack of policies governing electronic access. Five separate facilities were involved.

Now imagine that same pattern — missing risk assessments, no device policies, uncontrolled access — applied to a telemedicine platform processing thousands of sessions per week. The exposure is enormous. OCR doesn't distinguish between a desktop computer in a clinic and a cloud-based telehealth app. The same rules apply.

HIPAA Compliance for Telemedicine Apps: What About Remote Workers?

Here's a wrinkle most organizations overlook. Your telemedicine app might be perfectly configured — but if a clinician logs in from a coffee shop on an unencrypted personal laptop, your compliance posture just collapsed.

Remote workforce training is not optional. Every team member who accesses ePHI through a telehealth platform needs to understand device security, network requirements, and incident reporting procedures. Our HIPAA Training for Remote Healthcare Workers course covers exactly these scenarios — screen sharing risks, home network vulnerabilities, and portable device management.

HIPAA's workforce training requirement under 45 CFR § 164.530(b) applies to everyone in your organization who touches PHI. "Everyone" includes the part-time therapist doing sessions from her living room.

Six Non-Negotiable Steps for Your Telehealth Platform

  • Execute BAAs with every vendor that transmits, stores, or processes ePHI — including cloud hosting providers, analytics tools, and scheduling integrations.
  • Implement end-to-end encryption for all video, audio, messaging, and stored data.
  • Enforce multi-factor authentication for all clinical and administrative users accessing the platform.
  • Conduct and document a risk assessment specific to your telehealth environment. Update it annually or whenever your tech stack changes.
  • Train your entire workforce — clinicians, administrators, IT staff — on HIPAA requirements specific to telemedicine. The HIPAA Introduction Training 2026 course is a strong starting point for new team members.
  • Establish an incident response plan that covers telehealth-specific breach scenarios — compromised video sessions, unauthorized recording access, or vendor data exposure.

What About Consumer Apps Patients Use on Their Own?

This is where it gets nuanced. If a patient independently downloads a health app and enters their own data, that app may not be a business associate — and HIPAA may not apply to it directly. But the moment a covered entity recommends, integrates, or requires a patient to use a specific app, the compliance obligation kicks in.

The FTC has also stepped in to regulate health apps under its Health Breach Notification Rule, which applies to entities not covered by HIPAA. If you're developing a telemedicine app that straddles both worlds, you need legal counsel who understands both frameworks.

How OCR Investigates Telehealth Complaints

OCR's investigation process hasn't changed just because the technology has. When a complaint lands — or when a breach report triggers a review — investigators will ask for your risk analysis, your BAAs, your policies and procedures, and your workforce training records.

In my experience, the training documentation is where most organizations fall apart. They can produce a policy binder. They can show me a signed BAA. But when I ask for proof that their clinicians completed HIPAA training within the last 12 months, the room goes quiet.

Don't let that be you. Our HIPAA Fundamentals course gives your staff the baseline knowledge OCR expects — and gives you the documentation to prove it.

Quick Answer: Is Zoom HIPAA-Compliant for Telehealth?

Zoom can be used in a HIPAA-compliant manner, but only if you use Zoom for Healthcare (their paid, BAA-eligible plan), configure it properly, and sign a BAA with Zoom. The standard consumer version of Zoom does not meet HIPAA requirements. The same logic applies to Microsoft Teams, Google Meet, and every other major platform — the clinical-grade tier with a signed BAA is the only option.

The Bottom Line for 2026

Telehealth isn't going away. Neither is OCR enforcement. Every day your organization runs telemedicine sessions without verified HIPAA compliance for telemedicine apps, you're accumulating risk that compounds with every patient interaction.

Start with a risk assessment. Audit your vendor agreements. Train your workforce. Document everything. The organizations that treat telehealth compliance as an ongoing process — not a one-time project — are the ones that sleep well when an OCR letter arrives.

Explore our full HIPAA training catalog to find the right course for every role on your team.