HIPAA and Telehealth Platforms: What Clinics Need to Know
Quick answer: A telehealth platform should be built in a HIPAA-compliant environment: patient intake, consents and records stored in systems that protect health information, with a Business Associate Agreement (BAA) signed by every vendor that handles that data. The technology is only part of HIPAA compliance. Your practice also needs its own policies, staff training and risk assessments.
“Is it HIPAA compliant?” is one of the first questions clinics ask about telehealth. It’s the right question, but the answer has two parts: what the platform does, and what your practice does.
This article is general information, not legal advice. Your compliance advisor should review your setup.
What makes a telehealth platform HIPAA compliant?
A Business Associate Agreement
Under HIPAA, vendors that create, receive, store or transmit protected health information (PHI) on behalf of a healthcare provider are business associates and must sign a BAA. If a vendor won’t sign one, don’t put patient data in their system.
Secure data collection and storage
Intake forms, consents, patient records and messages should live in systems built for health data, with encryption, access controls and audit logs. At Exclusive Business Marketing, patient data collection runs through a HIPAA-compliant CRM covered by a BAA.
Access controls
Staff should only see the patient information they need. Your physician needs the full intake; your front desk may not.
Careful messaging
Email and SMS updates should share only what’s needed (“Your order has shipped”) and point patients to a secure place for details.
No PHI in marketing tools
Tracking pixels, analytics and ad platforms should not receive health information. Keep intake and patient pages separate from ad tracking, and review what your tags collect.
What your practice is responsible for
- Written HIPAA privacy and security policies
- Staff training and access management
- A risk assessment, reviewed periodically
- BAAs with every vendor that handles PHI (CRM, pharmacy integrations, video visits and so on)
- A breach response plan
Is there such a thing as “HIPAA certified”?
No. The U.S. Department of Health and Human Services does not certify software or vendors as HIPAA compliant. Be wary of anyone selling an official “HIPAA certification.” What you want to see is a signed BAA, clear security practices and a vendor willing to walk your compliance advisor through the setup.
Questions to ask any telehealth platform vendor
- Will you sign a Business Associate Agreement?
- Where is patient data stored, and who can access it?
- Is data encrypted in transit and at rest?
- Are access and changes logged?
- What patient information goes into email and SMS messages?
- How do you keep health data out of ad and analytics tools?
- Who owns the patient data, and can we export it?
Who owns the patient data?
You should. With a custom platform, your site, domain and patient data belong to your business. We can manage the CRM for you on our HIPAA-compliant platform, or set it up as an account in your own name. Turnkey services often keep the patient list on their system; see telehealth platform vs. turnkey telehealth service.
Frequently asked questions
Are your telehealth platforms HIPAA compliant?
Yes. We build them in a HIPAA-compliant environment, with patient data in a HIPAA-compliant CRM covered by a Business Associate Agreement. Your practice keeps its own HIPAA policies and training in place.
Can I use regular email or text for patient updates?
Limit messages to minimum necessary information and follow your compliance advisor’s guidance on patient communication.
Does HIPAA apply to wellness brands?
It depends on whether you or your clinical partners are covered entities and whether you handle PHI. If a physician is reviewing patient information, assume HIPAA applies and confirm with counsel.
Next step
See how the full system works on our telehealth platform development page, or book a 30-minute scoping call and we’ll walk you through the setup.