Core HIPAA Security Requirements for Telehealth Video
1. End-to-End Encryption (E2EE)
Encryption Standards Required
Data in Transit:
- TLS 1.2 or TLS 1.3 encryption minimum
- Perfect Forward Secrecy (PFS) enabled
- AES-256 bit encryption for video streams
- Encrypted signaling and media channels
- Certificate-based authentication
Data at Rest:
- AES-256 encryption for stored recordings
- Encrypted chat logs and file transfers
- FIPS 140-2 compliant cryptographic modules
- Encrypted backup storage
- Hardware Security Module (HSM) key management
End-to-end encryption ensures that data is encrypted on the sender's device and can only be decrypted by the intended recipient, rendering intercepted data useless to unauthorized parties.
2. Business Associate Agreement (BAA)
BAA Requirements
A BAA is a legally binding contract required by HIPAA whenever a covered entity (healthcare provider) works with a business associate (technology vendor) that may have access to PHI.
BAA Must Include:
- Permitted uses and disclosures of PHI
- Security safeguards vendor must implement
- Breach notification procedures
- Subcontractor agreement requirements
- Data return/destruction obligations
- Compliance audit cooperation
Vendor Responsibilities:
- Implement technical safeguards
- Maintain administrative policies
- Report security incidents within 60 days
- Allow HHS audit access
- Train employees on HIPAA requirements
- Maintain insurance coverage
Without a signed BAA, using any video conferencing platform for telehealth is a HIPAA violation, regardless of the platform's security features.
3. Access Controls & Authentication
Required Access Controls
User Authentication:
- Multi-factor authentication (MFA) required
- Strong password policies (12+ characters)
- Unique user identification
- Automatic session timeouts (15 minutes idle)
- Failed login attempt lockouts
- Single sign-on (SSO) integration
Meeting Security:
- Waiting room functionality
- Meeting passwords/passcodes
- Host controls for participant management
- Screen sharing restrictions
- Recording consent notifications
- End-of-meeting data clearing
Role-Based Access Control (RBAC)
User Roles:
- Administrator - full platform control
- Provider - patient session access
- Staff - limited scheduling access
- Patient - own session access only
Minimum Necessary Principle:
- Access limited to job requirements
- Recording access restrictions
- Transcript viewing permissions
- Administrative function separation
2025 HIPAA Telehealth Compliance Updates
End of COVID-19 Enforcement Discretion
During the COVID-19 public health emergency, HHS exercised enforcement discretion allowing providers to use non-compliant video platforms. This discretion period has ended, meaning:
No Longer Acceptable:
- Consumer-grade video apps (FaceTime, Skype)
- Social media video (Facebook Messenger)
- Platforms without BAA availability
- Good faith compliance exceptions
- Default security settings reliance
Now Required:
- Signed BAA with every vendor
- Full HIPAA Security Rule compliance
- Documented risk assessments
- Configured security controls
- Staff training documentation
2025 Security Rule Updates
Enhanced Requirements:
- Mandatory encryption (no longer addressable)
- Annual cybersecurity awareness training
- Regular vulnerability assessments
- Incident response plan updates
- Third-party vendor security reviews
Documentation Requirements:
- Updated policies and procedures
- Risk analysis every 12 months
- Security incident tracking
- BAA inventory maintenance
- Audit trail retention (6+ years)
Risk Analysis for Telehealth Platforms
Required Risk Assessment Elements
Per the HIPAA Security Rule, covered entities must identify, assess, and address potential risks to ePHI when using telehealth technologies:
Assess These Risks:
- Transmission interception by third parties
- Unauthorized access to stored recordings
- ePHI exposure during screen sharing
- Recording without proper consent
- Data breach from vendor vulnerabilities
- Insider threats from staff access
Verification Questions:
- Does the platform support encrypted transmissions?
- Where is ePHI stored and for how long?
- Who has access to meeting recordings?
- How is patient identity verified?
- What happens to data after session ends?
- How are security incidents reported?
HIPAA-Compliant Telehealth Platforms
Platforms Offering BAAs
Dedicated Telehealth Platforms
- Doxy.me - Free tier with BAA, designed for healthcare
- VSee - Enterprise telehealth with full compliance
- Curogram - Patient communication platform with BAA
- SecureVideo - Healthcare-specific video conferencing
- Teladoc - Full-service telehealth solution
- Amwell - Enterprise healthcare video
- SimplePractice - Practice management with telehealth
- TherapyNotes - Mental health telehealth
Configurable Business Platforms
These platforms can be HIPAA-compliant when properly configured with BAA signed:
- Zoom for Healthcare - Requires Healthcare plan
- Microsoft Teams - With proper configuration
- Google Meet - Google Workspace with BAA
- Cisco Webex - Enterprise healthcare edition
- GoTo Meeting - With healthcare add-on
- Pexip - Healthcare video infrastructure
Important: Having a BAA available doesn't automatically make a platform compliant. You must sign the BAA and configure security settings correctly.
Audit Logging & Monitoring Requirements
Comprehensive Audit Trails
A compliant platform must provide detailed audit trails that log all user activity for tracking PHI access and demonstrating compliance during audits.
Must Log:
- User login/logout timestamps
- Meeting start/end times
- Participant join/leave events
- Recording access and downloads
- Screen sharing events
- Failed authentication attempts
- Permission changes
- Data export activities
Log Requirements:
- Tamper-proof log storage
- Minimum 6-year retention
- Real-time monitoring capability
- Searchable log archives
- Automated anomaly alerts
- Compliance report generation
- Chain of custody tracking
- Geographic access logging
Telehealth Security Implementation Checklist
Pre-Implementation Steps
Before Going Live:
- ☐Conduct risk assessment for telehealth technology
- ☐Sign Business Associate Agreement with vendor
- ☐Verify encryption meets HIPAA standards
- ☐Configure waiting rooms and meeting passwords
- ☐Enable multi-factor authentication for all users
- ☐Set up role-based access controls
- ☐Configure audit logging and monitoring
- ☐Train staff on HIPAA telehealth requirements
- ☐Develop patient consent procedures
- ☐Document security policies and procedures
Ongoing Compliance Tasks
- Review access logs for anomalies
- Verify user account accuracy
- Check for security updates
- Monitor failed login attempts
- Update risk assessment
- Review and renew BAAs
- Conduct security training
- Test incident response plan
Related Healthcare Compliance Resources
Need HIPAA-Compliant Telehealth Tools?
Find secure video conferencing and meeting transcription platforms that meet healthcare compliance requirements.