HIPAA-Compliant Telehealth Platforms: Features, Requirements and Comparison

Every telehealth business in 2026 uses a platform. The HIPAA compliance of that platform or more precisely, the HIPAA compliance of the entire technology stack built around it determines whether protected health information is legally protected throughout every patient encounter, every message, every prescription request, and every stored record the practice generates.

HIPAA’s technical safeguard requirements for telehealth have been fully in force since the COVID-era enforcement discretion ended on May 11, 2023. There are no current exceptions, no active waivers, and no general-purpose video conferencing tools not standard Zoom, not FaceTime, not Google Meet, not WhatsApp that meet HIPAA requirements out of the box. A platform can only be HIPAA-compliant when it is purpose-configured for healthcare use, signed under a Business Associate Agreement, and backed by internal policies and procedures that keep the entire workflow clean.

This guide covers what makes a telehealth platform genuinely HIPAA-compliant, the essential features to evaluate, the most dangerous compliance gaps practices create through platform misconfiguration, and the broader technology and clinical infrastructure framework that a platform sits inside because a compliant platform within a non-compliant broader operation does not make the practice HIPAA-compliant.

What HIPAA actually requires of a telehealth platform

HIPAA’s requirements for telehealth technology flow from the HIPAA Security Rule, which governs the protection of electronic protected health information (ePHI). The Security Rule sets three categories of safeguards administrative, physical, and technical all of which apply to telehealth platforms and the organizations that use them.

The technical safeguards that directly govern platform selection and configuration are:

• Access controls — unique user identification for every person who accesses ePHI, automatic logoff after periods of inactivity, and emergency access procedures. Role-based access controls ensuring that clinical staff can only access records for patients they are authorized to treat are a required component, not an optional feature
• Audit controls — comprehensive activity logging recording who accessed what patient data, when, from what device, and what actions they took. These logs must be tamper-evident, retained for a defined period, and accessible to compliance officers during breach investigations or HIPAA audits
• Transmission security — encryption of all ePHI transmitted across open networks, including video streams, audio, chat messages, patient intake forms, file attachments, and any API data exchanges between the platform and connected systems. TLS 1.2 or higher for signaling and HTTPS, with AES-256 encryption for stored data, are the current operational standard
• Data integrity — mechanisms ensuring that ePHI is not improperly altered or destroyed, including secure backups, version history, and deletion controls that prevent unauthorized modification of patient records

Critical 2026 reminder: The COVID-era enforcement discretion that permitted the temporary use of non-HIPAA-compliant video tools (FaceTime, standard Zoom, Skype, Google Meet) for telehealth ended permanently on May 11, 2023. HIPAA technical safeguard requirements apply to every telehealth encounter in full. Any practice still using general-purpose consumer video tools for patient consultations is operating in violation of the HIPAA Security Rule on every visit.

The Business Associate Agreement: what it must cover

A Business Associate Agreement (BAA) is the contract between a covered entity (your practice) and a business associate (the platform vendor) that establishes the vendor’s HIPAA obligations. HHS has made clear that covered providers must use telehealth vendors that will enter into a signed BAA — without one, using the platform to transmit or store patient data is a HIPAA violation regardless of the platform’s technical features.

But not all BAAs are equally protective. A HIPAA-compliant BAA must include:

• A specific description of permitted uses and disclosures of PHI — including explicit prohibitions on the vendor using patient data for secondary purposes such as advertising, analytics sold to third parties, or AI model training without patient authorization
• Obligations to implement administrative, physical, and technical safeguards — the BAA should reference HIPAA’s specific safeguard categories, not just contain vague data security language
• Breach notification obligations — the vendor must notify your practice of any breach involving your patients’ data within 60 days of discovery, in accordance with the HIPAA Breach Notification Rule
• Subprocessor disclosure — the BAA should identify or provide a mechanism to identify all subprocessors (hosting providers, storage vendors, analytics tools) that have access to PHI, and confirm that each subprocessor is also covered under appropriate agreements
• Return or destruction of PHI on contract termination — the agreement must specify how patient data is handled when the relationship ends

A vendor that offers a BAA only on premium or enterprise tiers — not on standard or free plans — is implicitly indicating that their standard-tier infrastructure does not meet HIPAA requirements. A BAA must accompany any plan under which patient data will be transmitted or stored.

HIPAA-compliant vs HIPAA-ready: A platform can be “HIPAA-ready” — meaning the infrastructure supports compliant use — without being HIPAA-compliant on its own. HIPAA compliance requires both: a platform that supports compliant workflows, and the internal policies, procedures, and staff training that keep those workflows clean in practice. The BAA is necessary but not sufficient.

Essential security features in 2026

Evaluating a telehealth platform’s HIPAA compliance means going beyond the marketing page and verifying the specific technical implementations that satisfy each Security Rule requirement. Here is what to confirm for each essential feature category:

End-to-end encryption

All PHI — video streams, audio, files, messages, intake forms, and session metadata — must be encrypted in transit and at rest. The minimum current standard is TLS 1.2 for all data in transit (TLS 1.3 preferred), DTLS-SRTP for live media streams, and AES-256 for stored data and backups. Verify that the platform uses ephemeral session keys with automatic rotation — static encryption keys are a vulnerability that mature platforms have addressed. Confirm also that metadata does not contain PHI in plaintext in system logs.

Multi-factor authentication (MFA)

Every user account with access to ePHI must be protected by MFA. A platform that makes MFA optional rather than mandatory creates a Security Rule compliance gap: a provider who disables MFA on their account exposes patient records to unauthorized access in a way the platform’s technical safeguards are supposed to prevent. For multi-state telehealth organizations with many providers, MFA enforcement at the administrative level — not left to individual provider choice — is a required configuration step.

Role-based access controls

Providers should only be able to access records for patients they are actively treating. Billing staff should not have access to clinical documentation. Administrative staff managing scheduling should not be able to view prescription records. Role-based access controls that define and enforce these boundaries at the platform level are a HIPAA Security Rule requirement — and a common gap in platforms designed for small solo practices that are then scaled to multi-provider telehealth organizations.

Audit logging

Full audit trails showing who accessed patient data, when, from which device, and what actions were taken are required by the HIPAA Security Rule’s audit control standard. These logs must be exportable for compliance review, tamper-evident, and retained for at least six years under HIPAA’s documentation retention requirement. Platforms that log user activity but do not make those logs accessible or exportable to the practice’s compliance team do not satisfy this requirement in an operationally meaningful way.

Automatic logoff

Shared workstations and unattended provider devices are a persistent source of unauthorized access to patient records. HIPAA’s technical safeguard requirements include automatic session logoff after defined periods of inactivity. Verify that the platform enforces this at the organizational level, not just as an option providers can enable or disable on their own accounts.

Clinical and operational features that matter

HIPAA compliance is the floor, not the ceiling. A platform that meets HIPAA’s minimum technical requirements but lacks the clinical and operational features needed to run a real telehealth practice is not a viable long-term solution. Here are the clinical features to evaluate alongside security requirements:

HIPAA compliance beyond the video layer

One of the most significant conceptual errors in telehealth HIPAA planning is treating the video platform as the entirety of the compliance question. HIPAA compliance for telehealth is a hosting and workflow question as much as a video question — and most breaches and violations occur in the parts of the technology stack that surround the video session, not during the video call itself.

The full scope of HIPAA-compliant telehealth technology includes:

• HIPAA-compliant hosting for the application and patient data — the servers and cloud infrastructure storing patient records, session notes, intake forms, and platform data must be covered under their own BAA. AWS, Microsoft Azure, and Google Cloud all sign healthcare BAAs — but using these cloud platforms does not automatically configure them for HIPAA compliance. The application layer sitting on top of the cloud infrastructure must also be correctly configured.
• Secure scheduling and appointment tools — the booking tool a patient uses to schedule their telehealth visit is in scope for HIPAA if it captures or transmits PHI. Calendly, for example, does offer a HIPAA-compliant plan with a BAA, but the standard consumer version does not qualify.
• HIPAA-compliant patient reminders and notifications — SMS appointment reminders that include patient names, appointment types, or any PHI must be sent through a HIPAA-compliant messaging system. Standard SMS (unencrypted text messages) does not meet HIPAA requirements for PHI transmission.
• Billing and payment processing — any system that processes payment information alongside patient identifiers must also operate under appropriate BAA coverage, at the intersection of HIPAA and PCI-DSS compliance.
• State privacy laws beyond HIPAA — California’s CMIA, New York’s SHIELD Act, and similar state-level health privacy frameworks impose requirements that go beyond federal HIPAA minimums. Multi-state telehealth organizations must verify compliance with each state’s applicable privacy law, not just federal HIPAA.

The five most common HIPAA platform compliance gaps

These are the gaps that most frequently surface during HIPAA audits, breach investigations, and state regulatory inspections of telehealth practices:

Gap 1: BAA not in place with all PHI-touching vendors

Practices sign a BAA with their primary telehealth platform and assume HIPAA coverage flows to everything else. It does not. Every vendor that touches PHI — the scheduling tool, the SMS reminder service, the lab integration, the cloud storage service, the billing platform — requires its own signed BAA. A breach through any unprotected integration is a HIPAA violation attributable to the covered entity, not just the vendor.

Gap 2: Consumer video tools used for telehealth visits

Standard Zoom, FaceTime, Google Meet, WhatsApp, and Skype are not HIPAA-compliant and may not be used for telehealth patient encounters. Using them — even briefly, even with patients who prefer them — violates the HIPAA Security Rule. The only compliant path is routing all clinical encounters through the HIPAA-configured, BAA-covered platform.

Gap 3: PHI in email notification previews

Many telehealth platforms send automated email notifications that include patient names, appointment times, or provider details in the subject line or preview text of standard (unencrypted) email. This is a Security Rule violation: PHI transmitted through unencrypted email does not meet HIPAA’s transmission security requirement. Configure notification systems to use generic, non-identifying language in subject lines and preview text.

Gap 4: Inadequate access control for multi-provider practices

A platform configured for a solo provider — where one person has access to everything — does not automatically become HIPAA-compliant as a multi-provider organization simply by adding users. Verify that role-based access controls are configured such that each provider can only access records for their own patients, administrative staff cannot access clinical documentation without authorization, and billing teams see only the information necessary for claims processing.

Gap 5: No internal policies and procedures to match platform capabilities

A HIPAA-compliant platform does not make an organization HIPAA-compliant on its own. HIPAA requires covered entities to maintain written policies and procedures governing how the platform is used, how staff are trained on telehealth-specific privacy requirements, how incidents are reported, and how the practice responds to breaches. Platform selection is necessary; internal governance is also required and independently auditable.

Related reading from LocumTele

• Telehealth Technology Platform — LocumTele’s integrated clinical and technology solution
• White Label Telemedicine Platform: Complete 2026 Guide
• Do You Need a Medical Director for a Telehealth Business?

Frequently asked questions

Q.1. What makes a telehealth platform HIPAA compliant?

A HIPAA-compliant telehealth platform must provide end-to-end encryption for all PHI in transit and at rest, multi-factor authentication, role-based access controls, comprehensive audit logging, automatic logoff, and a signed Business Associate Agreement (BAA). Critically, no platform is HIPAA-compliant on its own — the organization using it must also implement internal policies, staff training, and administrative procedures that comply with HIPAA’s requirements. The platform supports compliance; the organization achieves it.

Q.2.Is Zoom HIPAA compliant?

Standard Zoom is not HIPAA compliant. Zoom for Healthcare — Zoom’s dedicated healthcare offering — can support HIPAA-compliant use when the organization activates the appropriate HIPAA configuration settings and signs a BAA with Zoom. A Zoom for Healthcare BAA is required; standard Zoom’s terms of service do not include one. Using standard Zoom for telehealth patient encounters is a HIPAA Security Rule violation.

Q.3.Is FaceTime or Google Meet HIPAA compliant for telehealth?

No. Consumer FaceTime and standard Google Meet are not HIPAA compliant and cannot be made compliant for telehealth use. Neither Apple nor Google signs Business Associate Agreements for consumer versions of these products. The COVID-era enforcement discretion that temporarily permitted their use for telehealth ended permanently on May 11, 2023. All telehealth patient encounters must now use a platform with an active, signed BAA and appropriate security configurations.

Q.4.Do I need a BAA with every vendor that touches patient data?

Yes. Every vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate under HIPAA and requires a signed BAA. This includes your telehealth video platform, your scheduling tool, your EHR, your billing system, your patient reminder service, your cloud hosting provider, and any analytics or AI tools with access to patient data. A breach through any vendor without a BAA in place is a HIPAA violation attributable to your practice.

Q.5.What encryption standards does a HIPAA-compliant telehealth platform need?

The current operational standard for HIPAA-compliant telehealth platforms is TLS 1.2 or higher (TLS 1.3 preferred) for all data in transit, DTLS-SRTP for live video and audio streams, and AES-256 encryption for data stored at rest — including session recordings, patient records, intake forms, and backups. Platforms should use ephemeral session keys with automatic key rotation rather than static encryption keys, and system logs should never store PHI in plaintext.