HIPAA Compliance for Telehealth

Telehealth has permanently reshaped how medical practices in Northern Virginia deliver care. What started as a pandemic necessity has become a patient expectation — and with that permanence comes a critical obligation: full HIPAA compliance for every virtual encounter. If your practice in McLean, Reston, or anywhere in the DC metro area offers telehealth, this guide walks you through exactly what compliance requires in 2026.

The HHS enforcement discretion that relaxed telehealth rules during COVID expired in late 2024. That means every virtual visit, every patient message, and every shared screen now falls under the same HIPAA Security Rule and Privacy Rule standards as in-person care. No exceptions, no grace periods.

---

Why Telehealth HIPAA Compliance Matters Now

The Office for Civil Rights (OCR) has made telehealth enforcement a stated priority for 2026. In Q1 alone, OCR issued three enforcement actions specifically targeting practices that failed to secure their virtual care platforms. The fines ranged from $75,000 to $1.2 million — and all three practices had fewer than 20 providers.

For healthcare practices in Northern Virginia, the risk is compounded by the region's tech-savvy patient base. Patients in the Washington DC metro area are more likely to use patient portals, messaging features, and telehealth — which means more data flowing through more channels, all requiring protection.

Step-by-Step: Securing Your Telehealth Platform

1. Audit Your Current Platform

Before changing anything, document what you are using today. Many practices in Northern Virginia cobbled together telehealth solutions in 2020 and never revisited them. List every platform, app, and communication channel used for virtual patient interactions — including text messages and personal email.

2. Verify Your BAA is Current

A Business Associate Agreement is required with every vendor that touches PHI. This includes your telehealth platform, your EHR, your cloud storage provider, and even your IT support company. Pull each BAA and confirm it covers telehealth-specific data handling, breach notification procedures, and data retention policies.

3. Enable End-to-End Encryption

HIPAA requires encryption for ePHI in transit. For telehealth, this means the video stream, chat messages, shared documents, and session recordings must all be encrypted using AES-256 or equivalent. Consumer-grade video tools (standard Zoom, Google Meet, FaceTime) do not meet this requirement without healthcare-specific configurations.

4. Implement Access Controls

Every person who can initiate or join a telehealth session needs unique credentials. Shared logins — common in small practices — violate HIPAA and make it impossible to maintain an accurate audit trail. Implement role-based access so front-desk staff can schedule sessions but cannot view clinical notes.

5. Configure Audit Logging

Your telehealth platform must log who accessed what, when, and from where. These logs need to be retained for at least six years (HIPAA requirement) and reviewed regularly. For practices in McLean and the broader NoVA region, we recommend monthly log reviews as part of your compliance program.

6. Secure the Patient's End

You cannot control a patient's home Wi-Fi, but you can take reasonable steps: use waiting rooms to prevent unauthorized access to sessions, auto-terminate idle sessions after 5 minutes, and provide patients with clear instructions on accessing care from a private location.

---

HIPAA Telehealth Compliance Checklist

• Signed Business Associate Agreement (BAA) on file and current
• End-to-end encryption (AES-256) for all video and messaging
• Unique user credentials for every staff member — no shared logins
• Role-based access controls separating clinical and administrative access
• Audit logging enabled with 6-year retention policy
• Automatic session timeout after 5 minutes of inactivity
• Virtual waiting room enabled to prevent unauthorized session access
• Recording storage encrypted at rest with access controls
• Patient identity verification process documented
• Staff trained on telehealth-specific HIPAA policies annually

Common Telehealth HIPAA Mistakes

After securing telehealth platforms for dozens of medical practices across Northern Virginia and the Washington DC region, we see the same mistakes repeatedly:

1. Using personal phones for patient communication. Text messages on personal devices are nearly impossible to secure, audit, or retain properly. Use a compliant messaging platform integrated with your EHR instead.
2. Assuming the platform handles everything. Even HIPAA-compliant platforms require proper configuration. Out-of-the-box settings rarely meet compliance requirements — someone needs to enable encryption, configure access controls, and set retention policies.
3. Skipping the risk assessment. HIPAA requires a documented risk assessment that specifically covers telehealth workflows. A general IT risk assessment is not sufficient. You must identify threats unique to virtual care: unsecured home networks, screen sharing risks, and recording storage.
4. No patient consent documentation. Virginia law and HIPAA both require documented patient consent for telehealth. This must be obtained and stored for each patient, not just posted on your website.
5. Ignoring state-specific requirements. Virginia has additional telehealth regulations beyond federal HIPAA. Practices in NoVA serving patients in DC and Maryland must also comply with those jurisdictions' telehealth laws when treating patients across state lines.

Virginia-Specific Telehealth Regulations

Beyond federal HIPAA requirements, Virginia practices must comply with state-specific telehealth rules that took effect in 2024:

• Informed consent: Must be obtained verbally or in writing before each telehealth encounter and documented in the medical record
• Provider location: The provider must disclose their physical location during the encounter
• Prescribing: Schedule II-V medications can be prescribed via telehealth but require an initial in-person visit or documented exception
• Cross-state practice: Providers in McLean serving DC or Maryland patients need appropriate licensure in each jurisdiction

What Should You Do Next?

If your practice has not formally assessed its telehealth HIPAA compliance since the enforcement discretion ended, the time to act is now. Start with these three questions:

1. Do we have a current, signed BAA with every vendor that touches our telehealth data?
2. When was our last documented risk assessment that specifically included telehealth workflows?
3. Can we produce audit logs showing who accessed our telehealth platform in the last 90 days?

If any answer gives you pause, you need a focused assessment. JPert INC works with medical practices across Northern Virginia — from solo practitioners in McLean to multi-provider groups in Reston and Arlington — to build telehealth compliance programs that protect patients and prevent penalties.

Schedule a free telehealth compliance review and we will identify your specific gaps within 30 minutes — no jargon, no pressure.