HIPAA telehealth compliance: The 2026 Provider Guide
HIPAA telehealth compliance is a settled subject in 2026, not a moving target. Telehealth volumes are roughly 38 times higher than the pre-2020 baseline, per McKinsey data. The pandemic-era HIPAA enforcement discretion ended on August 9, 2023. Every HIPAA telehealth provider, platform, and vendor is now on the hook for full compliance.
This guide walks through what HIPAA telehealth compliance looks like in 2026. It covers which rules apply, which platforms qualify, what BAAs you need, what the technical safeguards must cover, and the practical pitfalls that cause OCR investigations. The audience is clinical leadership, compliance officers, telehealth platform engineers, and digital health founders.
What HIPAA telehealth compliance means in 2026
HIPAA telehealth compliance is a subset of normal HIPAA compliance. HIPAA itself is a US federal law from 1996. It protects Protected Health Information held by covered entities (most healthcare providers, health plans, and clearinghouses) and their business associates. Telehealth is not a separate legal category under HIPAA. The same Privacy Rule, Security Rule, and Breach Notification Rule that govern in-person visits govern virtual visits. The medium changed, the obligations did not.
In practice that means three things for any provider running telehealth:
- The audio, video, chat, and screen-share carrying the visit must run on a platform that signed a Business Associate Agreement and meets the HIPAA Security Rule technical safeguards.
- Any electronic Protected Health Information generated by the visit (recordings, transcripts, notes, attachments, chat logs) must be stored, transmitted, and disposed of in compliance with HIPAA.
- The patient must receive a Notice of Privacy Practices and the provider must document patient consent appropriately for the modality.
For background on the framework see our HIPAA compliance pillar and the HIPAA Security Rule technical safeguards checklist.
What changed when the enforcement discretion ended
From March 2020 through August 2023, the HHS Office for Civil Rights exercised enforcement discretion. Providers could use non-compliant tools (FaceTime, Skype, consumer Zoom) without penalty as long as they were used in good faith for telehealth. That window is closed.
Since August 2023, OCR is enforcing HIPAA against telehealth normally. Penalty exposure matches any other HIPAA violation. Civil penalties run up to $2.13 million per violation category per year. Reputation damage and breach-notification costs land on top. The HHS HIPAA enforcement page lists current resolution agreements and corrective action plans.
In late 2024 and into 2025, OCR resolved several telehealth-related cases involving inadequate risk analyses, missing BAAs, and improper use of unsecured chat tools. The signal is clear: telehealth is now treated as a normal HIPAA compliance subject, not a grace period.
Which telehealth platforms are HIPAA compliant
"HIPAA compliant" applied to a platform is shorthand for two things. First, the platform implements the technical safeguards of the HIPAA Security Rule. Second, the vendor will sign a Business Associate Agreement with you. Without both, the platform is not HIPAA compliant for your use, regardless of marketing language.
A non-exhaustive list of platforms that meet the bar in 2026:
Platforms that sign a BAA (HIPAA telehealth eligible):
- Zoom Workplace for Healthcare — specific healthcare SKU; consumer Zoom does NOT sign a BAA
- Microsoft Teams (Business / Enterprise / 365) — BAA covers Teams when included in Microsoft 365 enterprise plans
- Google Meet (Workspace Business / Enterprise) — BAA covers Workspace business and enterprise tiers, not free Google accounts
- Doxy.me — telehealth-specific; free tier includes BAA
- Updox — healthcare-focused video platform
- SimplePractice — common in behavioral health
- VSee — healthcare-purpose-built
- Webex Meetings (paid) — BAA available for paid plans
- Amazon Chime / AWS Chime SDK — BAA covers AWS-side hosting; integrator must implement controls
Platforms that do NOT sign a BAA (NOT HIPAA telehealth eligible):
- FaceTime, Skype consumer, WhatsApp, SMS, personal Gmail accounts, personal Slack — none sign BAAs and none are HIPAA telehealth compliant for clinical use
For deeper coverage of two of the most common platforms in healthcare see our guides on whether Microsoft 365 is HIPAA compliant and whether Google Workspace is HIPAA compliant, plus our breakdown of whether Zoom is HIPAA compliant.
The most common mistake we still see in 2026 is providers using consumer-tier Zoom or personal Google accounts. The technology looks identical to the healthcare-tier version. It is not. Without the healthcare SKU and the signed BAA, the use is non-compliant.
The BAA is the gating contract
A Business Associate Agreement is a contract between a covered entity and a vendor that handles PHI on the covered entity's behalf. HIPAA requires a BAA before PHI can be shared with the vendor. In telehealth, you need a BAA with:
- The video conferencing platform
- The EHR or charting system
- Cloud hosting providers (AWS, Azure, GCP) if you run your own infrastructure
- Patient communication tools (secure messaging, appointment reminders, post-visit forms)
- Storage and backup vendors
- Transcription and AI-assisted note tools (a fast-growing risk area)
- Any analytics, observability, or session recording vendor that touches PHI
- Subcontractors of the above (covered through downstream BAA chains)
For full mechanics see our HIPAA Business Associate Agreement guide. Maintain a vendor inventory with BAA status for every vendor that touches PHI. Auditors will ask for it.
Technical safeguards specific to telehealth
The HIPAA Security Rule technical safeguards apply to any electronic PHI, but a few are especially relevant to telehealth.
Encryption end to end
Audio and video carrying PHI must be encrypted in transit and at rest. Most enterprise telehealth platforms encrypt with AES-256 at rest and TLS 1.2 or 1.3 in transit. Consumer tools often advertise encryption but do not provide BAAs, which means they are not contractually committed to those protections.
Access controls and unique user identification
Each user of the platform (provider, scribe, billing staff, IT support) must have a unique account and credentials. Shared logins violate the access control standard. Multi-factor authentication is not strictly required by HIPAA but is the de facto standard and is required by many state-level privacy laws.
Audit controls
The platform must log access to PHI. You should be able to produce, on demand, a list of who accessed what visit recording or chat history and when. For telehealth this typically means platform-side audit logs plus your own session and integration logs.
Automatic session timeout
Sessions must terminate or lock after a defined idle period. The standard is 15 minutes for clinical workstations, often shorter for shared devices. Telehealth platforms typically support session timeouts at the SSO layer.
Transmission security
End-to-end encryption is the headline requirement, but transmission security also covers integrity controls (detecting tampering) and authentication of endpoints. Network-level protections (VPN, segmented networks for clinical traffic) are common controls.
Backup and disaster recovery
The platform must support data backup and recovery. Visit recordings, chat logs, and session metadata must be recoverable in the event of system failure. Document the recovery time objective and recovery point objective.
Privacy Rule obligations specific to telehealth
The Privacy Rule applies fully to telehealth. A few obligations cause confusion when the visit is virtual.
Notice of Privacy Practices
The Notice must be provided at the first telehealth encounter and acknowledged. Electronic acknowledgment is acceptable. The Notice itself does not change for telehealth.
Patient location and identity verification
Providers must reasonably verify they are speaking to the correct patient. They must also document the patient's location at the time of the visit. Location can affect licensure, billing, and the applicable state privacy law. Most telehealth platforms support pre-visit identity verification flows.
Minimum necessary
The minimum necessary standard applies. Visit recordings should not capture PHI beyond what is required for clinical purposes. Screen sharing should not expose other patients' records.
Patient access rights
Patients can request their telehealth records the same way they request in-person records. The platform must support export of session recordings, chat transcripts, and clinical notes when requested.
Breach notification specific to telehealth
A breach is an impermissible use or disclosure of unsecured PHI that compromises its security or privacy. Common telehealth breach scenarios:
- A clinician's device is stolen with cached visit recordings on it
- A consumer messaging app (WhatsApp, SMS) is used to send a patient document
- A non-BAA-covered third party joined a visit (interpreter, scribe vendor without a BAA)
- A misconfigured cloud bucket exposes session recordings
- A BAA-covered vendor experiences a breach affecting your patients
Breach notification rules apply: notify affected individuals within 60 days, notify HHS (immediately for breaches affecting 500+ individuals, annually for smaller breaches), and notify media if the breach affects 500+ residents of a single state.
For the broader breach mechanics see what counts as a HIPAA breach and our coverage of the Change Healthcare 2024 breach for a recent illustrative example of the cascade effects.
State law overlay
HIPAA is a federal floor. Many states impose stricter requirements that affect telehealth, especially around behavioral health, reproductive health, and minors. Notable examples:
- California's Confidentiality of Medical Information Act (CMIA) overlays HIPAA with California-specific consent and breach notification rules
- Texas Medical Records Privacy Act (HB 300) imposes mandatory training requirements
- New York's SHIELD Act and Mental Hygiene Law place specific consent requirements on telepsychiatry
- Multiple states (CA, OR, WA, IL, others) have specific consent and confidentiality rules for substance use and reproductive health that exceed HIPAA
Practical implication: if you serve patients in multiple states, the HIPAA telehealth compliance program must be HIPAA-plus. Map state laws to your service footprint annually.
For broader state privacy context see our CCPA compliance guide and GDPR compliance for US companies (relevant for international telehealth or tourists).
A pragmatic HIPAA telehealth program for 2026
The full HIPAA compliance program is the same regardless of in-person or virtual care delivery. The HIPAA telehealth additions are usually a thin layer on top. Most teams reach a defensible posture in 90 to 120 days when they sequence the work. A practical sequence:
Step 1 — Inventory
List every telehealth touchpoint: scheduling, consent capture, video, chat, file exchange, e-prescribing, post-visit communication, billing, analytics. Note the vendor for each.
Step 2 — BAA coverage check
For every vendor in the inventory that touches PHI, confirm a BAA is in place. If a vendor will not sign a BAA, replace them.
Step 3 — Technical safeguards review
Walk through the HIPAA Security Rule against your stack. Confirm encryption, access control, audit logging, automatic logoff, transmission security, and integrity controls are in place. Document gaps and remediate.
Step 4 — Risk analysis
Update your annual HIPAA risk analysis to reflect the telehealth footprint. The risk analysis is the single document OCR will ask for first in any investigation. See our HIPAA risk assessment guide for the standard methodology.
Step 5 — Workforce training
HIPAA telehealth training topics include:
- Which platform to use for which type of visit
- How to confirm patient identity at the start of the call
- What to do if the patient is in a public space
- When and how to suspend a visit
- How to handle accidental third-party presence (a family member walks in, a colleague enters the patient's room)
- How to document the visit afterward
- What to never send via SMS or consumer chat
Step 6 — Policy updates
Update your HIPAA policies to cover telehealth: HIPAA telehealth platform standards, recording policy, chat retention policy, identity verification procedure, location capture procedure, telehealth-specific incident response.
Step 7 — Patient-facing flows
The patient must get a clear privacy notice, give clear consent for telehealth (some states require explicit verbal or written consent), and be informed of the platform being used. Build this into your scheduling and intake flows.
Step 8 — Continuous evidence
Telehealth visits leave digital traces. Make sure your compliance program collects evidence of each control on a recurring basis: BAA renewal logs, training records, access reviews, audit log reviews, incident response drills.
For early-stage telehealth startups specifically, see our minimum viable HIPAA compliance for startups guide and the broader HIPAA SaaS startup compliance guide.
Common HIPAA telehealth compliance mistakes
Three patterns we see across telehealth providers and digital health platforms in 2026:
- Consumer-grade tools used out of convenience. SMS reminders with PHI, FaceTime when the regular platform glitches, personal Gmail for records exchange. Each is a potential breach. Train staff on hard rules and provide compliant alternatives.
- Missing BAAs in the long tail. The video platform has a BAA, the cloud hosts have a BAA, but the new AI scribe vendor does not. Neither does the transcription tool or the session-recording analytics vendor. Map every vendor and every downstream subcontractor.
- Stale risk analysis. Programs change, platforms change, teams change, but the risk analysis still reflects the 2023 environment. OCR will ask. Update annually and after every material change.
Frequently asked questions
Is FaceTime HIPAA compliant for telehealth?
No. Apple does not sign Business Associate Agreements for FaceTime. Even though the call is encrypted, the lack of a BAA means it is not HIPAA compliant for telehealth use.
Is consumer Zoom HIPAA compliant?
No. Only the Zoom Workplace for Healthcare SKU (formerly Zoom for Healthcare) carries a Business Associate Agreement. Consumer Zoom and the standard business plan do not, regardless of feature parity.
Do I need a separate BAA for each telehealth tool?
Yes. Every vendor that creates, receives, transmits, or maintains PHI on your behalf needs a BAA. The video platform, the EHR, the cloud host, the scheduling tool, the AI scribe, and the messaging vendor all require their own BAA.
Can I record telehealth visits?
Yes, with appropriate consent and on a HIPAA-compliant platform. The platform must support encrypted storage and access controls. Document patient consent, set retention policies, and ensure audit logging covers access to recordings.
What happens if a patient is in a public space during a HIPAA telehealth visit?
The provider should warn the patient about privacy risks, document the warning, and offer to reschedule if the patient prefers a private setting. The provider's environment must also be private to the extent feasible.
How long does a HIPAA compliance program take to set up for telehealth?
For a new HIPAA telehealth provider or platform, plan on 4 to 9 months to reach HIPAA readiness. Existing providers expanding into telehealth typically need 60 to 120 days to extend the program. See HIPAA cost and timeline guidance for budget figures.
Do international telehealth visits change HIPAA obligations?
HIPAA applies to PHI of US patients regardless of where the provider or platform is located. International telehealth often layers on additional privacy laws (GDPR, country-specific health privacy laws). The minimum is still HIPAA when US-based PHI is involved.
The bottom line
HIPAA telehealth compliance in 2026 is normal HIPAA compliance with a few added focus areas. The platform must carry a Business Associate Agreement and meet the Security Rule technical safeguards. Every downstream vendor that touches the visit must also have a BAA. The risk analysis must reflect the actual telehealth footprint. Training must cover virtual-care-specific scenarios. The pandemic-era enforcement discretion is gone, the platforms have caught up, and the audit and breach exposure now matches any other HIPAA-regulated activity.
The fastest path to a defensible program has five steps. Inventory the HIPAA telehealth stack. Close BAA gaps. Run an updated risk analysis. Train staff on hard rules. Document every control with continuous evidence. Treat HIPAA telehealth as a first-class part of the compliance program rather than a side stream, and the audit story writes itself.
About the author: James Mitchell is a Compliance and Security Analyst with eight-plus years of experience advising healthcare providers, telehealth platforms, and digital health startups on HIPAA, SOC 2, and HITRUST. He has guided more than 25 telehealth and digital health programs through their first HIPAA assessment cycle.
