Telehealth HIPAA Compliance: Why Many Providers Need a Virtual CISO
What telehealth HIPAA compliance requires now that OCR's enforcement discretion has ended — and when a Virtual CISO is the right-sized response for providers managing mixed telehealth workflows.
What Is Telehealth HIPAA Compliance?
Telehealth HIPAA compliance is the application of the HIPAA Privacy, Security, and Breach Notification Rules to healthcare services delivered remotely — including video visits, audio-only calls, secure messaging, and remote patient monitoring. Since August 9, 2023, when OCR's COVID-19 telehealth enforcement discretion fully expired, ordinary HIPAA compliance expectations apply to covered telehealth workflows. For many telehealth providers, meeting these requirements without a dedicated security executive has become the central compliance challenge.
The Telehealth Enforcement Discretion Has Ended
OCR announced on April 12, 2023 that the COVID-19 telehealth enforcement discretion would expire with the public health emergency on May 11, 2023. A 90-day transition period followed, giving covered entities and business associates time to bring non-compliant communication technologies into alignment with the HIPAA Rules. That transition period ended August 9, 2023, and ordinary HIPAA enforcement expectations have applied to telehealth ever since.
A common misconception is worth correcting: telehealth providers were always subject to HIPAA where applicable. What ended was OCR's enforcement discretion for specific non-compliant communication technologies used in good faith during the public health emergency — not HIPAA's underlying applicability to telehealth. Telehealth did not come under HIPAA "for the first time" in 2023; the Privacy Rule, Security Rule, and Breach Notification Rule had always reached telehealth services provided by covered entities and their business associates.
The practical effect is that providers who relied on the discretion period need to be operating under standard HIPAA rules now. That includes BAAs with platform vendors where required, risk analyses updated to reflect current telehealth workflows, workforce training that covers remote PHI handling, and technical safeguards such as access controls and encryption evaluated against the realities of a distributed clinical workforce. Providers should also be tracking the proposed HIPAA Security Rule changes, which would further tighten requirements if finalized as written.
Source: HHS OCR "Notification of Expiration of Certain Notifications of Enforcement Discretion" (April 2023); Telehealth.HHS.gov provider resources.
Enforcement Discretion Is Not the Same as Exemption
Some telehealth providers interpreted OCR's enforcement discretion as an exemption from HIPAA. It was not. OCR declined to impose penalties for certain non-compliant telehealth technologies during the public health emergency. The underlying HIPAA obligations never changed. Providers operating as if they were exempt should assess their current compliance posture.
What Telehealth HIPAA Compliance Requires Today
Telehealth is broader than video. It includes audio-only phone visits, secure messaging, asynchronous store-and-forward communication, and remote patient monitoring. Each modality may involve different vendors, different data flows, and different workforce contexts — but all are subject to the same HIPAA Privacy, Security, and Breach Notification Rules when they touch protected health information.
Required by the HIPAA Rules
Business Associate Agreements
With vendors acting as business associates — those that create, receive, maintain, or transmit PHI on your behalf. A conduit-only telecom provider with transient access does not require a BAA.
45 CFR § 164.502(e), § 164.504(e)
Risk Analysis Covering Telehealth Workflows
Must explicitly address all telehealth modalities — video, audio-only, messaging, and remote monitoring — and be updated periodically as workflows change.
45 CFR § 164.308(a)(1)(ii)(A)
Designated HIPAA Officials
A designated Security Official under the Security Rule and a designated Privacy Official under the Privacy Rule. These roles must be designated within the covered entity.
§ 164.308(a)(2), § 164.530(a)(1)
Workforce Training
Training on remote PHI handling across all telehealth modalities, including audio-only and messaging contexts — not just video platform usage.
§ 164.308(a)(5)
Access Controls
With automatic logoff or another reasonable equivalent safeguard where appropriate. This is an addressable implementation specification — the covered entity must evaluate and document its approach.
§ 164.312(a)(2)(iii)
Encryption
Of PHI in transit and at rest where reasonable and appropriate. Also an addressable specification requiring documented evaluation.
§ 164.312(a)(2)(iv), § 164.312(e)(2)(ii)
Audit Controls
Across systems containing PHI used in telehealth workflows.
§ 164.312(b)
Contingency Plan
Including data backup and disaster recovery for PHI created in telehealth workflows.
§ 164.308(a)(7)
Incident Response Procedures
That cover telehealth-specific scenarios, including platform compromise and remote-device PHI exposure.
§ 164.308(a)(6)
Recommended by HHS / HRSA Telehealth Guidance
Per HHS, the HIPAA Rules do not require providers to educate patients about telehealth privacy and security risks, but HHS and HRSA recommend the following as good telehealth practices:
Patient Identity Verification
At the start of telehealth encounters.
Private Environment Practices
Clinicians in closed-door settings, with lowered voices or headphones in shared spaces.
Mobile Device Hygiene
Routine deletion of cached files, session recordings, and chat logs from clinician devices.
Patient-Side Guidance
Helping patients connect from private environments and recognize legitimate provider communications.
Sources: 45 CFR § 164.308, § 164.310, § 164.312, § 164.530; HHS OCR telehealth FAQs; HRSA telehealth best practices.
Five Telehealth-Specific Risk Areas Most Providers Underestimate
These are the gaps that most commonly surface when a telehealth provider steps back and evaluates its post-enforcement-discretion compliance posture. Several of them connect directly to incident-response readiness — see the Healthcare Data Breach Response Guide for the operational side of what happens when these risks are realized.
Vendor BAA Gaps
Telehealth providers frequently assume that a popular communication tool is HIPAA-compliant without confirming whether the vendor will sign a BAA — or whether the vendor's role even requires one. Audio-only and messaging vendors are particularly likely to fall through the BAA review process because they often were not part of the original telehealth deployment.
Audio-Only and Messaging Blind Spots
Compliance postures often center on the video platform and overlook phone visits, SMS-style messaging, and asynchronous communication. Each modality may involve different vendors, different data flows, and different risk profiles — but they are all subject to the same HIPAA requirements.
Home-Office Workforce Risks
Unmanaged personal devices, shared home networks, household members within earshot of clinical conversations, and the absence of physical access controls. Remote workforce security requires policies and controls that most in-office environments never needed.
Mobile Data Residue
Session recordings, downloaded attachments, chat logs, and cached PHI lingering on clinician phones and tablets after encounters. Without device management policies and routine data hygiene practices, mobile devices become unmanaged PHI repositories.
Online Tracking Technologies
HHS guidance confirms that tracking pixels, analytics, or chat widgets on authenticated patient portals, intake and scheduling flows, registration pages, and regulated mobile apps can involve PHI and trigger HIPAA obligations where applicable. Note: a federal court partially vacated (vacatur) the broader theory that an IP address combined with a visit to an unauthenticated public webpage was sufficient by itself. The remaining scope — authenticated portals and user-input contexts — is still in effect and directly relevant to telehealth providers with patient-facing digital tools.
Healthcare vCISO Services
A healthcare vCISO supports your designated HIPAA security and privacy officials with risk assessment leadership, policy development, and compliance program management.
Healthcare vCISO ServicesWhy a Virtual CISO Is Often the Right-Sized Answer
A Virtual CISO is a contracted security executive who provides program ownership, risk management, and compliance leadership on a fractional basis. For telehealth providers navigating post-enforcement-discretion HIPAA obligations, a vCISO is often the right-sized answer — large enough to meaningfully own the program, small enough to fit the economics of a growth-stage or small-to-mid-sized practice.
Full-time CISOs are the right fit for larger systems with the budget, scale, and internal complexity to justify one. For most telehealth providers, a full-time hire is overkill: the program does not require a 40-hour-a-week executive, and the clinical economics rarely support one. On the other end, attempting to run HIPAA compliance as a side responsibility of clinical leadership tends to under-produce. Compliance gaps accumulate, risk analyses go stale, BAA inventories drift, and the organization becomes exposed to OCR audit scrutiny at precisely the moment that scrutiny has intensified.
Critical framing: a vCISO augments, never replaces, the designated officials. The Security Rule requires a designated HIPAA Security Official (§ 164.308(a)(2)) and the Privacy Rule requires a designated Privacy Official (§ 164.530(a)(1)). Those roles must be designated within the covered entity. A vCISO does not become the accountable official. What a vCISO provides is the program leadership and specialized expertise that those officials draw on — risk analysis execution, BAA inventory and gap closure, policy alignment, workforce training design, technical controls review, incident response readiness, and audit-ready documentation.
The engagement pattern is consistent across telehealth programs. A vCISO engagement commonly begins with a risk analysis scoped to all communication modalities. That analysis frequently surfaces BAA gaps — particularly across audio-only and messaging vendors that were not part of the original telehealth deployment. From there, the engagement moves through vendor consolidation, policy alignment, workforce training, and incident response readiness. The result is a HIPAA-aligned security program built to support the covered entity's compliance posture — not a claim to transfer accountability.
For a fuller view of the healthcare vCISO model — including scope, pricing structure, and how the role interacts with designated officials — see the Healthcare vCISO Services pillar.
What a Telehealth vCISO Engagement Looks Like
A typical first engagement runs roughly 90 days. The goal is a documented, tested compliance posture that the organization's designated officials can defend — not a one-time deliverable that sits on a shelf.
Telehealth-Scoped Risk Analysis
A comprehensive risk analysis covering all communication modalities — video, audio-only, messaging, and remote patient monitoring. This phase establishes the baseline and identifies the highest-priority gaps.
Vendor Inventory and BAA Gap Closure
Review of every telehealth vendor relationship to determine which require business associate agreements. Gap closure for vendors acting as business associates that lack current BAAs.
Policy Alignment and Technical Controls
HIPAA policy alignment, workforce training on remote PHI handling, technical controls review including encryption posture, access controls, and mobile device management.
Incident Response and Documentation
Incident response tabletop exercises, documentation package, and audit-ready artifacts. The organization ends this phase with a documented, tested compliance posture.
Frequently Asked Questions About Telehealth HIPAA Compliance
Telehealth HIPAA compliance is the application of the HIPAA Privacy, Security, and Breach Notification Rules to healthcare services delivered remotely — including video visits, audio-only calls, secure messaging, and remote patient monitoring. OCR's COVID-19 telehealth enforcement discretion ended on August 9, 2023, and ordinary HIPAA compliance expectations now apply to covered telehealth workflows.
Yes. HIPAA applies to telehealth services provided by covered entities and their business associates. This was always the case — what changed was that OCR exercised enforcement discretion during the COVID-19 public health emergency for certain non-compliant communication technologies. That discretion is no longer in effect. Telehealth workflows involving protected health information must comply with the HIPAA Privacy, Security, and Breach Notification Rules.
No. OCR announced on April 12, 2023 that the COVID-19 telehealth enforcement discretion would expire with the public health emergency on May 11, 2023. A 90-day transition period ran from May 12 through August 9, 2023. Since August 9, 2023, ordinary HIPAA enforcement expectations apply to telehealth. Covered entities and business associates should be using HIPAA-compliant communication technologies and have appropriate business associate agreements in place.
The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information in telehealth workflows. Key requirements include a risk analysis covering all telehealth modalities, business associate agreements with vendors acting as business associates, workforce training on remote PHI handling, access controls with appropriate safeguards such as automatic logoff, encryption where reasonable and appropriate, audit controls, and incident response procedures. HHS and HRSA also recommend practices such as patient identity verification, private environment guidance for clinicians, and mobile device hygiene.
A business associate agreement is required when a telehealth vendor creates, receives, maintains, or transmits protected health information on behalf of the covered entity. A telecom provider acting merely as a conduit — with only transient access to PHI — does not require a BAA. The distinction is based on the vendor's role and access, not on the type of technology. Each vendor relationship should be evaluated individually.
A virtual CISO is a contracted security executive who provides program ownership, risk management, and compliance leadership on a fractional basis. Telehealth providers may benefit from a virtual CISO when they need structured security leadership but cannot justify or afford a full-time chief information security officer. A vCISO supports — but does not replace — the organization's designated HIPAA security and privacy officials, providing the expertise and program management capacity those officials draw on.
Understand Your Telehealth HIPAA Compliance Posture
Telehealth providers operating mixed workflows across video, audio, and messaging face compliance obligations that extend well beyond platform selection. The next step is a risk analysis scoped to how your practice actually delivers care — the foundation of a HIPAA-aligned security program.
This article is for informational purposes and does not constitute legal advice. HIPAA requirements applicable to telehealth are complex and depend on individual organizational circumstances, vendor relationships, and clinical workflows. Consult legal counsel experienced in healthcare privacy law for guidance specific to your organization. Cloud Solutions Consulting provides virtual CISO advisory services that support healthcare organizations' HIPAA-aligned security programs. CSC does not serve as the designated HIPAA Security Official or Privacy Official for client organizations. Information reflects regulatory status as of April 2026.