Is my telehealth visit private? HIPAA, video platforms and what to ask

A telehealth visit with a licensed healthcare provider is generally covered by the same federal privacy law as an office visit, HIPAA, and the provider is expected to use a video platform built for healthcare. Privacy still depends on details: which platform is used, whether the visit is recorded, who else can hear, and the device and room on your end. A few questions before your first visit tell you most of what you need to know.

Who HIPAA actually covers

HIPAA's Privacy and Security Rules apply to "covered entities", meaning health plans, healthcare clearinghouses and most healthcare providers, and to their "business associates", the vendors that handle health information on their behalf, such as video platforms, electronic records systems and billing services.

When you have a video visit with a licensed clinician at a medical practice, that practice is very likely a covered entity, and your visit, notes and results are protected health information. The practice must give you a Notice of Privacy Practices explaining how your information is used and shared.

The gap is outside traditional healthcare. Many symptom checkers, fitness and wellness apps, period trackers and direct-to-consumer health products are not covered by HIPAA at all. Their handling of your data is governed by their own privacy policy, by Federal Trade Commission rules against unfair or deceptive practices, including its Health Breach Notification Rule, and by state laws. California's Confidentiality of Medical Information Act, for example, adds protections that in some areas go beyond HIPAA.

What changed for video platforms in 2023

Early in the COVID-19 pandemic, the HHS Office for Civil Rights (OCR), which enforces HIPAA, announced it would not penalize providers acting in good faith who used ordinary video apps such as FaceTime or Skype for telehealth. Public-facing services such as Facebook Live or TikTok were never allowed.

That enforcement discretion ended with the public health emergency in May 2023, followed by a transition period that closed on August 9, 2023. Since then, providers are expected to use technology that meets HIPAA's Security Rule requirements, including protections for data in transit and at rest, access controls, and a business associate agreement with the vendor. If a practice asks you to join a visit by FaceTime or a personal messaging app, it is fair to ask why.

Is "HIPAA compliant" the same as private?

Not quite. HHS does not certify products as HIPAA compliant. Compliance is an ongoing obligation of the provider, covering policies, staff training, risk assessments and the vendors it uses. A platform can support compliance. It cannot make a practice compliant on its own.

Compliance also does not mean nobody else ever sees your information. HIPAA permits sharing for treatment, payment and healthcare operations, and in certain other situations set out in the rule. Your Notice of Privacy Practices describes those situations. What HIPAA requires is that sharing be limited to what is permitted, and that you can find out what has been shared.

Questions worth asking a practice

• What video platform do you use, and do you have a business associate agreement with the vendor?
• Are visits recorded? If so, who can access the recording, how long is it kept, and can I decline?
• Who will be present on your end? Students, assistants or scribes are sometimes present, and you can ask.
• How do you send me results and messages? A patient portal is generally more protected than ordinary email or text.
• Where can I read your Notice of Privacy Practices? It should be easy to find.
• Does your website share information with advertising or analytics companies? This is a separate question, explained in telehealth privacy: what health websites do with your data.

A practice should be able to answer these without difficulty.

Email, text and phone visits

HIPAA does not ban email or text messaging with patients. Providers may communicate by unencrypted email or text if you have been told the risks and prefer it. If you would rather receive sensitive information only through a portal, say so.

Audio-only visits are covered by HIPAA too. OCR has issued guidance explaining how the Security Rule applies depending on whether a call uses a traditional phone line or an internet-based technology. In practice, an audio-only visit with your provider is still confidential, and the same questions about who can hear apply.

Privacy on your side of the screen

The weakest point in a telehealth visit is often the patient's own environment. A few habits help:

• Use your own device. Work computers and phones may be monitored by your employer, and shared family tablets may keep app logins and notifications visible to others.
• Choose your room. A closed door, or a parked car, is better than a kitchen where others can hear. Headphones keep the clinician's side private.
• Avoid public Wi-Fi where you can. Your phone's mobile data or a personal hotspot is usually a better choice.
• Check notification settings. Message previews on a locked phone screen can show health information to anyone nearby.
• Log out afterward on any device you share.

If something goes wrong

If a provider has a breach involving your unsecured health information, HIPAA's Breach Notification Rule requires them to notify you, generally without unreasonable delay and within 60 days of discovering it. Breaches affecting 500 or more people are also reported to HHS and appear in a public database.

If you believe your privacy rights were violated, you can complain to the practice's privacy officer and to OCR, generally within 180 days of when you knew about the problem. Our post on your rights as a telehealth patient covers records access and complaint routes in more detail.

Aone's approach to health information is set out in its privacy policy, which includes our Notice of Privacy Practices. If you have questions about how your information will be handled, ask before your first visit.

Questions patients ask us

Is telehealth covered by HIPAA?

Generally, yes, when you are seeing a licensed clinician at a healthcare practice. HIPAA applies to most healthcare providers, health plans and their business associates, regardless of whether care is delivered in person or by video. Many wellness apps and direct-to-consumer health products are not covered by HIPAA and are governed by their own policies, FTC rules and state law instead.

Can my doctor use FaceTime or Zoom for telehealth?

Pandemic-era leniency that allowed everyday consumer apps such as FaceTime ended in August 2023. Providers are now expected to use platforms that meet HIPAA's Security Rule, typically under a business associate agreement with the vendor. Some video services offer healthcare versions that support this. If a practice asks you to use a personal app, ask why.

What does HIPAA compliant actually mean?

It means a provider meets HIPAA's requirements through its policies, staff training, risk assessments, technology and vendor agreements. HHS does not certify software or practices as HIPAA compliant, so a badge on a website is a marketing claim, not an official status. A platform can support compliance, but it cannot make a practice compliant on its own.

What is a business associate agreement?

It is a contract HIPAA requires between a provider and any vendor that handles patients' health information on its behalf, such as a video platform, records system or billing service. The agreement obliges the vendor to protect the information and limits what it can do with it. You can ask a practice whether it has one with its video vendor.

Are telehealth visits recorded?

Usually not, but practices differ. Ask before your visit whether sessions are recorded, who can access recordings, how long they are kept and whether you can decline. You should not be recorded without being told. If you want to record a visit yourself for your own notes, ask the clinician first.

Is it safe to do a telehealth visit on my work computer?

It is better not to. Employers may monitor work devices and networks, and IT staff may have access to browsing history, screen activity or files. Use your own phone, tablet or computer, ideally on your home network or your phone's mobile data rather than public Wi-Fi.

Can my provider text or email me about my health?

Yes, if you agree after being told the risks. HIPAA does not ban unencrypted email or text with patients who prefer it. If you would rather receive sensitive information only through the practice's patient portal, say so, and the practice should respect that preference.

Are phone-only telehealth visits private?

They are still covered by HIPAA when the provider is a covered entity, and the clinician has the same duty of confidentiality. HHS has issued guidance on how the Security Rule applies to audio-only visits depending on the technology used. On your side, the same rule applies as for video: take the call somewhere you cannot be overheard.

What happens if my telehealth provider has a data breach?

Under HIPAA's Breach Notification Rule, the provider must notify you if your unsecured health information is involved, generally without unreasonable delay and within 60 days of discovering it. Breaches affecting 500 or more people are also reported to HHS and listed publicly. You can complain to the HHS Office for Civil Rights.

How do I report a telehealth privacy violation?

Start with the practice's privacy officer, whose contact details appear in its Notice of Privacy Practices. You can also file a complaint with the HHS Office for Civil Rights, generally within 180 days of when you knew about the problem. For non-HIPAA apps, the FTC or your state attorney general handles privacy and deceptive practice complaints.