HIPAA and telehealth, what therapists need in place

Video sessions are now a normal part of therapy, and HIPAA applies to them in the same way it applies to in-person care. This guide covers what the U.S. Department of Health and Human Services (HHS) says, and how to check your own setup.

HIPAA applies to telehealth

HHS says all telehealth services provided by covered health care providers must comply with the HIPAA Rules. If HIPAA applies to your practice, the video visit, the notes about it and the messages around it are all covered. If you are unsure whether you are a covered entity, see our guide to starting a cash-pay practice, which explains how to check.

Use a vendor that will sign a BAA

HHS says covered providers should use technology vendors that comply with the HIPAA Rules and will enter into a business associate agreement (BAA) for their video products. HHS also notes that vendors familiar with the Security Rule often include stronger security features to prevent data interception. The same questions we list for practice software apply to a video tool.

The pandemic flexibilities are over

From March 17, 2020, HHS's Office for Civil Rights said it would not penalize covered providers for good faith telehealth using popular apps such as FaceTime or Zoom. That notice ended at the end of May 11, 2023. OCR then gave a 90 day transition period, which ended on August 9, 2023. If your video setup was chosen under those flexibilities, check that it now meets the HIPAA Rules, and that you have a BAA where one is needed.

A telehealth checklist

• A BAA with your video vendor, and with any tool that stores recordings or transcripts.
• A private space for you, with headphones if others are nearby.
• A way to confirm the client's identity and their location at the start of a session, which also helps in an emergency.
• A telehealth consent form that covers limits of the technology and what to do if the connection fails.
• A backup plan, such as a phone call, and a written note in the record of when you use it.
• No recording unless the client agrees in writing and your vendor stores it under a BAA.

Audio-only sessions

HHS has published guidance on how the HIPAA Rules apply to audio-only telehealth. If you use phone sessions, read it and the rules of your state.

Check the payer and state rules

HIPAA is one layer. Your state license may need to cover the state where the client is located, and insurers set their own rules for billing video visits. Ask your licensing board and each payer.

RafaNest includes built-in video visits from its Professional plan. Clients join from a link in their browser, and recording with an AI-written visit summary is part of Premium. Read the telehealth guide for how it works.

Sources are the HHS pages HIPAA rules for telehealth technology and the enforcement discretion notification. This is general information and not legal advice.