Telehealth HIPAA Compliance for Home Health Agencies

Telehealth went from a marginal offering to a core part of how home health agencies deliver care, and it happened fast enough that a lot of agencies are still running on whatever video tool got them through the early days of the shift, rather than one actually built for handling patient data. That gap matters more now than it did at the start, because the regulatory flexibility that made "whatever worked" an acceptable answer no longer applies.

The Enforcement Discretion Is Over

During the COVID-19 Public Health Emergency, OCR exercised enforcement discretion and declined to impose penalties for HIPAA noncompliance against providers using everyday video chat applications — including ones like Skype and FaceTime that would not normally meet the Security Rule's requirements — for telehealth delivered in good faith. That discretion was tied explicitly to the Public Health Emergency, and it ended when the PHE ended on May 11, 2023. Telehealth is no longer a regulatory gray area: a platform used for a clinical video visit involving PHI needs to meet the same Security Rule requirements as any other system handling patient data, and it needs a signed Business Associate Agreement with the vendor, exactly like the EHR does.

Agencies that adopted a quick-fix video solution in 2020 and never revisited it are the ones most exposed here — not because they did anything wrong at the time, but because what was acceptable under emergency discretion is not what's required now, and nobody necessarily flagged that the rules had reverted.

What Makes a Telehealth Platform HIPAA-Compliant

A platform being "secure" in a general sense and a platform being appropriate for telehealth under HIPAA are two different questions. The platform needs to offer a Business Associate Agreement specifically covering its video/telehealth product — many mainstream video platforms sell a separate healthcare-specific tier (built around a signed BAA, access controls, and audit logging) that is a different product from their standard consumer offering, even when the interface looks nearly identical. Using the consumer version of a platform that only offers a BAA on its enterprise healthcare tier does not meet the requirement, regardless of how similar the two versions appear to the person using them.

Beyond the BAA itself, a compliant platform needs end-to-end encryption of the video and audio stream, access controls that prevent an uninvited party from joining a session, session logging sufficient to support an audit trail, and a data retention policy for any recordings that's consistent with the agency's own retention schedule rather than whatever the vendor defaults to.

BAA Requirements for Telehealth Vendors

The same BAA logic that applies to an EHR vendor or a cloud storage provider applies to a telehealth platform: if the vendor's product touches PHI — and a clinical video visit is PHI by definition — the vendor is a business associate, and a signed BAA needs to be in place before the platform is used for a single patient visit. This extends past the core video tool itself to anything integrated with it: a scheduling layer that captures patient names and appointment reasons, a recording/storage add-on, a chat feature used during the visit. Each of these is handling PHI in its own right, and each needs to be covered by the BAA or excluded from use for anything involving patient information.

End-to-End Encryption: What to Actually Verify

"Encrypted" gets used loosely enough in vendor marketing that it's worth being specific about what to check. End-to-end encryption means the video and audio stream is encrypted from the sender's device to the recipient's device, with no intermediate point where the vendor's own servers can access the unencrypted content. Some platforms encrypt data only in transit to their servers and then again from their servers to the recipient — which still protects against network interception but means the vendor itself (or anyone who compromises the vendor's infrastructure) could technically access session content. For a clinical conversation covering a patient's health condition, that distinction is worth asking the vendor about directly rather than assuming "encrypted" answers the question on its own.

Caregiver Device Security for Video Visits

The platform is only half of the security picture — the device a caregiver or patient joins from matters just as much, and it's where most of the actual risk in home health telehealth concentrates, because the device is rarely a controlled office machine.

• Screen and audio privacy. A telehealth visit conducted from a caregiver's car, a shared office, or a public space risks exposing a patient's medical information to anyone within earshot or eyeshot, regardless of how secure the platform itself is. Visits should happen in a private location whenever the caregiver has any control over where the call takes place.
• Device-level access control. The device joining the call — laptop, tablet, or phone — needs a passcode or biometric lock and should be enrolled in the agency's device management program the same way any other device handling PHI would be, consistent with how a home health cybersecurity program treats mobile devices generally.
• Network security. Joining a telehealth visit over unsecured public WiFi introduces the same network-level risk as any other PHI transmission over an untrusted connection. A cellular connection or a secured, known network is the safer default.
• Recording controls. If visits are recorded, the recording needs to land in an approved, encrypted storage location covered by a BAA — not a personal device's local storage or an unapproved cloud folder, which happens more often than it should when a caregiver records a visit for their own reference without thinking through where that file ends up.

What OCR Guidance Actually Says

OCR's post-PHE guidance is direct on this point: covered entities must now return to full compliance with the HIPAA Security Rule for telehealth, including the BAA requirement, after the temporary flexibilities ended. OCR has not published a telehealth-specific numeric requirement beyond what the Security Rule already requires generally — the risk-based "reasonable and appropriate safeguards" standard applies to telehealth exactly as it applies to every other system touching PHI, informed by the agency's own risk analysis. In practice, that means a telehealth platform and the devices connecting to it should be an explicit line item in the agency's HIPAA risk analysis, not an afterthought treated separately from "real" IT systems because it happens to be a newer part of the care model.

Choosing a Telehealth Platform: What to Ask a Vendor

A short, direct set of questions to a telehealth vendor will reveal more than a review of their marketing page. Does the vendor offer a signed BAA, and does that BAA specifically name the video/telehealth product your agency plans to use, rather than a different tier of their service? Is the video and audio stream end-to-end encrypted, or only encrypted in transit to the vendor's own servers? What audit logging does the platform provide — can you produce a record of who joined a given session, from where, and when, if that's ever requested during an OCR investigation or an internal review? What happens to a recording if one is made, and does the vendor's default retention period match what your agency actually needs, or will you need to configure that separately? A vendor that can't answer these clearly, or whose sales material treats "secure" and "HIPAA-compliant" as interchangeable without specifics, is a vendor worth questioning further before committing a care program to their platform.

Common Mistakes Agencies Make With Telehealth Security

A few patterns show up repeatedly in agencies that run into trouble here. The first is sticking with whatever platform got adopted during 2020 without ever revisiting whether it still meets current requirements now that the emergency flexibilities have ended — a decision made under genuine urgency five years ago isn't automatically still the right one. The second is assuming a consumer-grade product is covered because the agency "has a business account" with the vendor, when a business account and a BAA-covered healthcare tier are frequently two entirely different products from the same company. The third is treating telehealth security as the clinical team's problem rather than folding it into the same device management, risk analysis, and training program that covers every other system touching PHI — a telehealth platform is an addition to the agency's attack surface, not a separate category exempt from the rest of the security program.

How ShieldForce Supports Telehealth Security

ShieldForce treats the devices used for telehealth visits the same way it treats every other device touching PHI — covered by the same device management, MFA enforcement, and encryption standards, rather than as a separate category outside the normal security program. This is part of the complete home health cybersecurity platform ShieldForce manages for agencies, covering the full device and data lifecycle around patient care, not just the clinical software layer. For the complete HIPAA Security Rule mapping and broader threat landscape, see our home health cybersecurity guide.

Frequently Asked Questions

Can we still use Zoom, Skype, or FaceTime for telehealth visits?

The COVID-19 enforcement discretion that allowed everyday consumer video apps for telehealth ended when the Public Health Emergency ended on May 11, 2023. Zoom is usable if your agency has the Zoom for Healthcare tier with a signed BAA in place — the standard consumer version, along with apps like Skype or FaceTime that don't offer a healthcare BAA, no longer meets HIPAA requirements for clinical video visits.

Does a telehealth vendor need a separate BAA from our EHR vendor's BAA?

Yes. A BAA covers a specific vendor and the specific services listed in that agreement — your EHR vendor's BAA does not extend to a separate telehealth platform, even if the EHR vendor also offers a telehealth feature, unless that feature is explicitly named in the agreement. Each vendor touching PHI needs its own BAA covering what it actually does.

What's the difference between encryption in transit and end-to-end encryption?

Encryption in transit protects data as it travels across the network but may still allow the vendor's own servers to access it unencrypted at some point. End-to-end encryption means only the sender and recipient devices can decrypt the content, with no point at which the vendor's infrastructure has access to the unencrypted stream. For clinical conversations, end-to-end encryption is the stronger standard to look for.

Do caregivers need special training for telehealth visits specifically?

Caregivers conducting telehealth visits should understand where they're permitted to conduct a visit from (a private location, not a car or shared space), how to verify they're using the approved platform rather than a more convenient substitute, and what to do with any recording they create. This is typically folded into existing HIPAA and device security training rather than treated as a wholly separate program.

Does a recorded telehealth visit need to be treated differently from the live visit itself?

Yes — a recording is a new piece of PHI in its own right and needs to be stored in an approved, encrypted, BAA-covered location with a defined retention period, not left on a caregiver's personal device or an unapproved cloud folder. The live visit being secure doesn't automatically make the recording of it secure if it's not handled with the same controls afterward.