HIPAA for Telehealth: Complete Requirements for Therapists

Telehealth is now a permanent part of mental health practice—but many therapists are still using non-compliant platforms or unclear about what HIPAA actually requires for video sessions. The COVID-era enforcement discretion that allowed FaceTime and Skype ended in August 2023. If you're providing telehealth, you need compliant systems.

This guide covers exactly what HIPAA requires for telehealth: platform requirements, documentation, and how to avoid the compliance gaps that put your practice at risk.

HIPAA Telehealth Requirements at a Glance

Platform Requirements

What Makes a Platform HIPAA-Compliant?

Technical safeguards:

• End-to-end encryption (data encrypted during transmission)
• Access controls (unique user IDs, passwords)
• Automatic session timeout
• Audit logging (tracks who accessed what, when)

Administrative safeguards:

• Business Associate Agreement available
• Security policies and procedures
• Breach notification procedures
• Workforce training requirements

Operational:

• Data stored securely (encryption at rest)
• Clear data retention and deletion policies
• US-based servers (typically required for compliance)

Compliant Platforms

Non-Compliant Platforms

Business Associate Agreement (BAA)

You must have a signed BAA with your telehealth platform vendor before using it for client sessions.

What the BAA Covers

• Vendor's obligations to protect PHI
• Permitted uses and disclosures
• Breach notification requirements
• Return or destruction of PHI at contract end
• Your right to terminate for violations

How to Get a BAA

Most compliant platforms offer BAAs through their account setup:

• Doxy.me: Available in account settings
• SimplePractice: Part of subscription agreement
• Zoom Healthcare: Provided with healthcare plan

Keep documentation: Save a copy of signed BAAs. You may need to produce them for compliance audits.

Business Associate Agreements: Complete Guide →

Session Security

Before the Session

Your environment:

• Private room with door closed
• No one can overhear or see your screen
• Professional, confidential setting

Client verification:

• Confirm client identity at session start
• Verify client's location (state matters for licensing)
• Confirm client is in private space

Technology check:

• Stable internet connection
• Platform functioning properly
• Backup plan if technology fails

During the Session

Maintain confidentiality:

• No recording without explicit consent and documentation
• Screen sharing only with caution
• Mute/disable waiting room appropriately

Handle disruptions:

• If connection drops, have reconnection protocol
• If security concern arises, end session and follow up securely
• Document any significant technology issues

After the Session

Documentation:

• Note that service was via telehealth
• Record platform used
• Document client location
• Note any technology issues

Data handling:

• Don't save recordings on unsecured devices
• Clear any local cache if applicable
• Maintain platform security (logout, secure passwords)

Documentation Requirements

Telehealth sessions require the same documentation as in-person sessions, plus telehealth-specific elements.

Standard Documentation

All the usual clinical documentation:

• Date and time
• Presenting concerns
• Interventions used
• Client response
• Treatment progress
• Plan

HIPAA Compliant Documentation →

Telehealth-Specific Documentation

Add to your notes:

Why Location Matters

Documenting client location serves two purposes:

1. Licensing: You must be licensed in the state where the client is located
2. Emergency response: If crisis occurs, you need to know where the client is

Client Communication About Telehealth

Informed Consent

Before beginning telehealth services, obtain informed consent addressing:

• How telehealth works
• Privacy and security measures in place
• Risks (technology failures, potential for interception despite encryption)
• Client responsibilities (private environment, technology requirements)
• Alternatives to telehealth
• Emergency procedures

Many therapists use a telehealth-specific consent form in addition to general consent.

Client Instructions

Provide clients with:

• How to access the platform
• Technical requirements (internet speed, device, browser)
• What to do if connection fails
• Reminder to use private space
• Emergency contact information

Telehealth Billing and HIPAA

When billing for telehealth sessions, you're transmitting PHI. The same HIPAA billing requirements apply.

Billing Requirements

• Submit claims through secure, compliant channels
• Use appropriate telehealth modifiers (95, GT, 93)
• Use correct Place of Service codes (POS 10 for patient at home)
• Maintain secure billing records

Documentation Supporting Claims

Your notes should support the telehealth billing:

• Evidence that session occurred via video/audio
• Time documentation (start/stop times)
• Clinical content justifying the CPT code

Telehealth Billing for Therapists →

CPT Codes for Therapists →

Special Situations

Audio-Only Sessions

HIPAA doesn't prohibit audio-only telehealth, but:

• Standard telephone isn't encrypted
• Some payers require video for reimbursement
• Audio-only may have different billing codes/rates

If using audio-only:

• Understand payer requirements
• Document that session was audio-only and why
• Consider HIPAA-compliant audio platforms

Client in Public Space

If a client joins from a non-private location:

• Discuss confidentiality limitations
• Client assumes some privacy risk
• Document that client was informed
• Consider rescheduling if sensitive content planned

Technology Failures

Have a protocol for when technology fails:

1. Attempt to reconnect (give it 5 minutes)
2. Try backup method (phone call to reschedule)
3. Document what happened
4. Reschedule if session cannot continue
5. Determine billing implications

Emergency During Telehealth

Know your client's location and have emergency resources ready:

• Local emergency services contact
• Crisis line numbers
• Client's emergency contact
• Protocol for wellness check if needed

Document emergency procedures in treatment planning.

Compliance Checklist

Platform Setup

• Using HIPAA-compliant platform
• BAA signed and on file
• Unique login credentials
• Strong password and/or 2FA enabled
• Familiar with platform security features

Environment

• Private office space for telehealth
• Door can be closed/locked
• Screen not visible to others
• Audio not audible to others
• Professional background

Documentation

• Telehealth consent form in place
• Session notes include telehealth elements
• Client location documented each session
• Technology issues documented when they occur

Policies

• Written telehealth policies
• Client instructions documented
• Emergency procedures established
• Technology failure protocol in place

HIPAA-compliant telehealth isn't complicated once you have the right platform and processes. Get a compliant platform, sign your BAA, document properly, and maintain a secure environment. Your clients trust you with their most sensitive information—telehealth should protect that trust just as well as in-person sessions.