A Psychiatrist's Laptop Changed Everything

In 2020, a psychiatrist in New England started seeing patients over Zoom. No Business Associate Agreement. No encryption assessment. No risk analysis. It worked fine — until a former patient filed a complaint with OCR, and a routine investigation uncovered that session recordings were stored on an unencrypted personal laptop synced to a consumer-grade cloud account.

That scenario plays out more often than you'd think. Telemedicine and HIPAA compliance aren't opposites, but too many providers treat them like they are — rushing into virtual care without understanding how the Security Rule and Privacy Rule apply to every video call, every chat message, and every piece of ePHI transmitted over the internet.

If your organization offers telehealth services in any form, this post maps out exactly what you need to get right — and what happens when you don't.

The Enforcement Discretion Era Is Over

During the COVID-19 public health emergency, HHS exercised enforcement discretion for telehealth. Covered entities could use platforms like FaceTime and Skype without facing penalties for potential HIPAA violations. That grace period formally ended. OCR has made it clear: the standard rules apply fully in 2026.

I've seen organizations that built their entire telehealth infrastructure during the pandemic on non-compliant platforms. They never migrated. They never signed BAAs. And now they're sitting on years of accumulated risk.

The HHS telehealth notification page confirms the return to full enforcement. If you're still operating under pandemic-era assumptions, you're exposed.

What Telemedicine and HIPAA Compliance Actually Require

Let's cut through the confusion. HIPAA doesn't ban telemedicine. It doesn't even restrict which platforms you use — as long as you meet specific requirements. Here's the core checklist every covered entity and business associate must address.

1. Conduct a Risk Analysis for Telehealth Workflows

The Security Rule requires a thorough risk analysis under 45 CFR § 164.308(a)(1). That analysis must cover your telehealth-specific workflows: where ePHI is created, transmitted, received, and stored during virtual encounters.

I've reviewed risk analyses that mention "telemedicine" in a single bullet point. That's not sufficient. Your analysis should address the platform itself, the devices used by clinicians, the network connections (including home Wi-Fi), and any recording or transcription features.

2. Use a Platform with a Signed BAA

Your telehealth vendor is a business associate. Period. If they handle, transmit, or store ePHI on your behalf, you need a signed Business Associate Agreement before a single session takes place.

Consumer-grade tools like standard Skype, regular Zoom (not Zoom for Healthcare), and WhatsApp do not offer BAAs for healthcare use. Using them means you're violating the Privacy Rule every time a patient's information passes through their servers.

3. Encrypt ePHI in Transit and at Rest

Encryption is an addressable specification under the Security Rule, but "addressable" doesn't mean optional. If you choose not to encrypt, you need a documented, equivalent alternative — and in telehealth, there's almost never a defensible reason to skip encryption.

Every video stream, every secure message, every file shared during a telehealth visit must be encrypted with protocols like TLS 1.2 or higher. If your platform can't confirm this, find one that can.

4. Verify Patient Identity and Manage Access

Telehealth introduces unique identity verification challenges. You can't glance at a driver's license at the front desk. Your organization needs documented procedures for confirming patient identity at the start of each virtual visit — and for ensuring that only authorized workforce members access the session.

5. Train Every Member of the Workforce

This is where most organizations fail. They invest in a HIPAA-compliant platform and then hand it to staff who've never been trained on how to use it properly. A clinician taking a telemedicine call from a coffee shop with a screen visible to bystanders is a violation waiting to become a breach.

Our HIPAA Training for Remote Healthcare Workers addresses exactly these scenarios — how to secure home offices, manage screen visibility, and handle ePHI on personal and shared devices.

The $1.25 Million Warning from Premera Blue Cross

Premera Blue Cross agreed to a $6.85 million settlement with OCR in 2020 after a breach affecting over 10.4 million individuals. The root cause? A failure to conduct an enterprise-wide risk analysis and implement sufficient security measures. While that case wasn't exclusively about telehealth, it hammered home a principle that applies directly: if you can't demonstrate that you analyzed your risks and acted on them, OCR will hold you accountable.

More recently, in 2023, OCR settled with Banner Health for $1.25 million after a breach affecting nearly 3 million people. Again, the failure to conduct a compliant risk analysis was central. These aren't abstract regulatory exercises. They're the exact safeguards that determine whether your telemedicine program survives an investigation.

You can review active OCR enforcement actions on the HHS Resolution Agreements page.

What Counts as ePHI in a Telemedicine Session?

This is a question I get constantly, and it's worth answering directly for anyone searching for clarity.

Any individually identifiable health information transmitted or maintained electronically during a telemedicine encounter is ePHI. That includes the video stream itself, audio recordings, chat messages exchanged during the session, screen-shared documents, prescriptions sent through a portal, and any metadata (like appointment times linked to patient names) stored by the platform.

If your platform retains chat logs or recordings, those are ePHI subject to the full weight of the Security Rule — including access controls, audit trails, and retention policies.

Home Offices Are Clinical Environments Now

Here's what many organizations still haven't internalized: when a clinician conducts a telehealth visit from home, that home office becomes a clinical environment subject to HIPAA's physical safeguard requirements.

I've consulted with practices where providers took calls from kitchen tables while family members walked in and out. Others used shared household computers with no separate login credentials. One pediatric group discovered that a nurse had been using her teenager's gaming laptop — complete with screen-recording software running in the background.

Your policies need to address these realities explicitly:

  • Dedicated workspace with a closed door during patient encounters
  • Screen lock and automatic logoff policies
  • Prohibition on shared devices unless properly segmented
  • Secure Wi-Fi with WPA3 or WPA2 encryption and a strong password
  • No use of public Wi-Fi for telehealth sessions

Remote work isn't going away. If anything, it's expanding. Make sure your workforce is trained before they log in, not after a breach. The HIPAA Introduction Training 2026 covers foundational requirements that every team member — remote or on-site — needs to understand.

Breach Notification: Telehealth Doesn't Get Special Treatment

If a breach of unsecured ePHI occurs during or because of a telehealth session, the standard breach notification rules apply. Under 45 CFR §§ 164.400–414, you must notify affected individuals within 60 days, report to HHS, and — if the breach affects 500 or more individuals — notify prominent media outlets in the affected state.

Telehealth breaches can be subtle. A misdirected video link sent to the wrong patient. A session recording accidentally uploaded to a shared drive. A platform vulnerability that exposes session metadata. Each of these triggers a breach risk assessment, and if you can't demonstrate that the ePHI was rendered unusable through encryption, you're looking at a reportable breach.

Five Questions to Ask Your Telehealth Vendor Today

If you're evaluating a platform — or re-evaluating one you've been using — ask these questions before your next session:

  • Do you offer a signed BAA specific to telehealth services?
  • Is all ePHI encrypted in transit and at rest, and with what protocols?
  • Where are session recordings and chat logs stored, and for how long?
  • Do you provide audit logs showing who accessed each session?
  • What is your breach notification process if your platform is compromised?

If your vendor can't answer all five clearly and in writing, that's your answer.

Telemedicine and HIPAA Compliance Aren't Optional Anymore

The pandemic gave healthcare a crash course in virtual care. But the regulatory grace period is behind us. In 2026, telemedicine and HIPAA compliance must be fully integrated — not bolted on as an afterthought.

Every telehealth session creates ePHI. Every platform is a business associate. Every home office is a potential point of failure. And every workforce member who joins a video call without understanding their obligations puts your organization one complaint away from an OCR investigation.

Start with training. Start with a risk analysis. Start with the hard conversations about what your telehealth program actually looks like under HIPAA's requirements — not what you hope it looks like.

Explore our full HIPAA training catalog to build a compliance foundation that covers every member of your team, whether they work in the clinic or from their living room.