How do I ensure my video consultations with a telemedicine platform are compliant with HIPAA and BAA rules?

To keep video consultations compliant with HIPAA and Business Associate Agreement (BAA) requirements, focus on people, platform, process, and documentation.

1) Use a platform that will sign a BAA

If the telemedicine vendor handles PHI for you, it is a business associate and you generally need a BAA in place before using it for patient care.

Check that the platform:

• Explicitly offers a BAA
• Defines what PHI it may access, store, transmit, or process
• Includes required security and breach-notification obligations
• Covers any subcontractors the vendor uses

If a vendor won’t sign a BAA, don’t use it for PHI.

2) Verify the platform’s HIPAA safeguards

Ask for or review:

• Encryption in transit and at rest
• Access controls and role-based permissions
• Audit logs for visits and data access
• Authentication options like MFA
• Secure messaging and file sharing
• Session controls for waiting rooms, locking visits, and participant permissions
• Data retention/deletion policies
• Whether recordings are stored, where, and who can access them

3) Minimize PHI exposure

Use only the PHI necessary for the consultation:

• Don’t overshare on screen or in chat
• Avoid unnecessary attachments
• Disable recording unless it’s clinically necessary and permitted
• Use de-identified data where possible for demos, testing, and training

4) Make sure your workflows are HIPAA-safe

Create policies for:

• Patient identity verification
• Consent for telehealth and recording, if applicable
• Who can join a visit and how additional participants are approved
• Secure follow-up communication
• Handling missed connections, rescheduling, and technical support
• Incident response if a privacy issue occurs

5) Train staff and clinicians

Your team should know:

• How to use the platform securely
• How to confirm the patient’s identity and location
• How to conduct visits in a private setting
• How to avoid discussing PHI over insecure channels
• How to report suspected breaches or errors

6) Protect the devices and networks used

HIPAA compliance isn’t just the platform:

• Use managed, password-protected devices
• Keep systems patched and updated
• Require screen locks and encryption on laptops/tablets/phones
• Avoid public Wi‑Fi, or use a secure VPN if your policy requires it
• Ensure remote staff use approved devices and networks

7) Maintain required HIPAA documentation

Keep:

• Signed BAAs
• Risk analyses and mitigation plans
• Security policies and training records
• Access review logs
• Breach/incident reports and corrective actions

8) Confirm state telehealth and privacy rules

HIPAA is only part of compliance. Also check:

• State licensure rules
• State telehealth consent requirements
• Record retention rules
• Any stricter state privacy laws that may apply

9) Test before going live

Before using the platform with patients:

• Review the vendor security documentation
• Confirm the BAA is executed
• Run a privacy/security test visit
• Verify waiting room, participant controls, and recording settings
• Ensure support staff can’t access PHI beyond their role

10) When in doubt, get legal/compliance review

A healthcare attorney or compliance officer should review:

• The platform contract
• The BAA
• Your telehealth workflows
• Any recording or storage features

If you want, I can also give you a HIPAA telemedicine vendor checklist or a sample BAA review checklist you can use when evaluating platforms.