The short answer
Use a telehealth platform from a vendor that complies with HIPAA and signs a business associate agreement, keep devices secured and updated, work from a private space where no one can overhear, and document telehealth consent. Also confirm client location each session and have a plan for dropped connections.
What does HIPAA require for telehealth?
The same Privacy and Security Rules that apply to any health care, applied to remote technology. HHS says providers must use technology vendors that comply with HIPAA and will sign business associate agreements (BAAs) for their video or remote communication tools.
The pandemic-era flexibility that let providers use non-compliant apps has ended. Consumer video apps without a BAA aren't an option for routine care.
What's on the checklist?
Technology
- A telehealth platform whose vendor signs a BAA.
- Encryption in transit, with access controls and unique logins.
- Devices with strong passwords, automatic screen locks, and current updates.
- No shared family computer for clinical work.
- Secure storage for records, ideally inside your EHR rather than on your desktop.
Space
- A private room where no one can overhear.
- Smart speakers turned off or out of the room.
- Headphones if anyone else is home.
- A neutral background.
Clinical and consent
- Telehealth informed consent, covering risks, privacy, and what happens if the connection drops.
- Client location confirmed each session.
- An emergency contact and local resources on file. See Telehealth Emergency Planning.
What about audio-only sessions?
HIPAA permits audio-only telehealth with appropriate safeguards; HHS has guidance on audio-only telehealth. Whether a payer covers audio-only sessions is a separate question. Check before relying on it.
What about messaging and AI tools?
The same rules apply. Any vendor that handles client information needs to be HIPAA-compliant and sign a BAA, including texting, scheduling, transcription, and AI documentation tools.
How ValorWell handles this
ValorWell provides its own EHR with integrated scheduling and telehealth tools, built for clinical work and claims. You don't need to buy or vet your own telehealth platform for ValorWell clients. You do provide the private space, a reliable connection, and a secure device.
Important limits
- This isn't legal advice. Your state may add privacy requirements beyond HIPAA.
- Your environment is still your responsibility, even on a compliant platform.
- Risk analysis is required for HIPAA-covered entities in private practice. HHS has tools to help.