Telehealth Security Requirements in 2026: What HIPAA Expects

For roughly three years, telehealth security came with an asterisk. During the COVID-19 public health emergency, the HHS Office for Civil Rights (OCR) announced enforcement discretion: it would not penalize practices that stood up video visits in good faith on whatever tools worked, FaceTime and consumer Zoom included. That was a sensible call for a crisis, and it ended in 2023. The asterisk no longer exists.

The habit, however, survived. Many practices built a telehealth workflow in 2020, saw that it worked and never seriously revisited it, so a process designed under an exemption now runs under the full Security Rule. This post lays out the current standard plainly: what the platform has to be, what must be true around each session, the clinician's device and connection, recordings, and the expansion of the risk assessment that most practices have not made yet. It extends the telehealth section of our HIPAA compliance and healthcare IT guide and finishes with a readiness checklist you can work through this week.

Begin with the legal position, since it frames everything else. While the emergency lasted, OCR's enforcement discretion meant a practice using a non-compliant video tool in good faith would not be penalized for it. That protection lapsed in mid-2023. Telehealth is now simply care delivered through technology, and everything HIPAA requires of your EHR applies to it as well: encryption, access control, audit capability, business associate agreements and risk analysis.

What follows from that: if your telehealth tools were picked during the exemption and never reviewed, their compliance has been assumed rather than established. That is not a criticism. It is a to-do list, and the sections below are the items on it.

The foundation follows the same three-part logic as any system that carries PHI: a platform capable of compliance, a BAA that has actually been executed, and configuration that turns that capability into reality.

• Encryption of sessions in transit and of anything the platform keeps, including chat logs, shared files and recordings.
• An executed BAA with the video vendor. Consumer FaceTime and personal Zoom accounts do not offer one, and that is what rules them out, not the brand. Healthcare tiers of mainstream video platforms, and the telehealth modules built into major EHRs, do offer BAAs, but you still have to execute the agreement deliberately rather than inferring it from a marketing page.
• Configuration. A healthcare tier gives you compliant options without switching them on. Enable waiting rooms, require authentication, restrict recording, and set the data region and retention. A compliant platform left on defaults is the telehealth version of an email tenant with a BAA and no configuration: eligible, but not defensible.

If your visits run in your EHR's built-in telehealth module, much of this comes with the EHR relationship, so confirm that the BAA covers the telehealth component and move on. If it is a standalone tool someone chose in 2020, start your review here.

A telehealth visit is a clinical encounter, and the first question about any encounter is who is present. On video, that becomes an access-control question with three concrete answers:

• Turn waiting rooms on. The clinician admits each patient deliberately, and nobody can drop into a live visit unannounced. Make it a tenant-wide setting so it never depends on a clinician remembering.
• Use authenticated, per-visit links. Each visit should get its own link tied to the patient's identity and delivered through the portal or another verified contact channel, not a fixed personal meeting room reused all day. With a reused room, anyone who kept last month's link can knock on today's visit.
• Avoid guessable URLs. Predictable or sequential meeting IDs are what made "Zoom-bombing" possible. Current healthcare tiers randomize them by default; check that yours does, and that nobody has switched a personal room back on for convenience.

Practices often forget the patient's end of the call. A short verbal check at the start ("are you somewhere private, and is anyone with you?"), noted in the visit record, is good clinical practice and also evidence that privacy was considered.

This is where telehealth security stops being about the platform and becomes an infrastructure question. The session may be encrypted end to end, but it ends on a device. If that device is a shared family laptop without disk encryption or endpoint protection, crowded with browser extensions and used by three other people on the same profile, the encrypted platform is a locked front door on a house with the windows open.

The defensible standard is practice-managed devices for everyone who delivers care remotely: owned or controlled by the practice, with full-disk encryption, automatic screen lock, the same EDR and patching as the office machines, and MFA on everything that touches practice systems. That is not an unusual demand. It is the same cybersecurity baseline your office computers already meet, extended to wherever care now happens. The obstacle is seldom technical; home devices were waved through during the emergency and nobody ever replaced them.

Where personal devices truly cannot be avoided, the honest minimum is a managed enrollment profile that enforces encryption and screen-lock policies, practice data confined to managed apps, and a written record that this was a deliberate decision rather than something that drifted into place.

The clinician's connection is the other half of the remote setup. Unmanaged home Wi-Fi, often the router the internet provider installed years ago with its default admin password and original firmware, shared with smart TVs and the kids' devices, is not a clinical network by anyone's definition.

The current expectation is a VPN or zero-trust access path back to practice systems, so the EHR, file shares and internal tools are reached over an authenticated, encrypted channel that does not depend on how trustworthy the home network is. Zero-trust designs, which check identity and device health for each application on every session, suit hybrid care especially well because they protect the connections that matter without routing a patient's video stream through the office and back out. Building that access path is part of the network infrastructure work Talos does for practices.

The acronym matters less than the principle: a clinician's home internet connection should never be your security boundary. If your remote-access plan amounts to "they just log in from home," the network section of your next risk assessment already has its first finding.

Decide your recording policy deliberately, because a recorded telehealth visit is about as sensitive as PHI gets: a patient, on camera, talking about their health.

If you record visits for documentation, training or quality review, the recordings need full protection: a defined storage location under your control (not a clinician's downloads folder, and not the platform's default cloud storage left unexamined), encryption, access limited to the roles that need it, a retention rule, and patients who know they are being recorded. Recordings that feed the chart become part of the designated record set, with every obligation that brings.

For many practices the cleanest position is a written no-recording policy backed by platform settings, with recording disabled at the tenant level so one distracted click cannot break the policy. Either choice can be the right one. Having no policy at all is the only wrong answer.

This section ties the others together, because every requirement above comes from the same root: telehealth enlarged your environment, so your security risk assessment has to grow with it. An SRA that inventories the office (the server closet, the workstations, the Wi-Fi) but says nothing about twelve clinicians seeing patients from twelve homes describes an environment you no longer run. The Security Rule's risk analysis is meant to cover ePHI wherever it is created, received, kept or sent, and that now includes living rooms.

Concretely, the inventory phase of your SRA now has to capture who delivers care remotely, from where, on which device, over which connection, into which systems, and with what session and recording settings. Each is an asset or a data flow, and each deserves the same threat and safeguard analysis as anything inside the building. If you are following our step-by-step SRA walkthrough, this is a natural extension: the remote-work rows go into the same inventory tables, and adopting or changing telehealth is the kind of material change that calls for a reassessment outside the annual cycle.

The most common pattern is not a practice that ignored all of this. It is one that solved it in the office and improvised at home. The telehealth cart in the clinic is properly configured on the managed network, while the same clinician's Tuesday sessions from home run on a personal laptop over household Wi-Fi in a reused meeting room. Same clinician, same patients, same platform, and two completely different security postures, with the finding sitting in the second one.

Hybrid care also multiplies the front-office workflows around each visit: scheduling, reminders, intake, the call to say the clinician is running late. Each is a channel carrying PHI with its own rules, and more of it is being automated. Practices adding AI phone or front-desk automation should hold those tools to the same platform, BAA and configuration test as the video visit itself; our guide to AI voice agents for medical practices covers what compliant automation of those workflows looks like. The visit is one step in a workflow, and the workflow is what you have to secure.

Go through each item and mark it done, scheduled, or documented as not applicable:

Platform

• The video platform offers a BAA and yours has been executed (confirm in writing; for an EHR-integrated module, confirm the telehealth component is covered)
• Encryption confirmed for live sessions and for any stored content
• Tenant configured with waiting rooms on, authentication required, and personal or reused rooms disabled

Sessions

• A unique, authenticated link for every visit, sent through the portal or another verified channel
• A patient-side privacy check built into the visit routine

Endpoints

• Every remote clinician on a practice-managed device that is encrypted, screen-locked and protected by EDR
• MFA on all access to practice systems, with any personal-device exceptions documented and managed rather than assumed

Network

• VPN or zero-trust access for every remote connection into practice systems, so home Wi-Fi is never the boundary

Recordings

• A written recording policy (record with full controls, or do not record), enforced in platform settings either way
• If you record: storage location, encryption, access roles, retention rule and patient awareness all defined

Risk assessment

• SRA scope that includes every remote care setup, inventoried and analyzed, with each remediation item given an owner and a date
• New or changed telehealth treated as a trigger for reassessment

None of this is exotic security. It is the same discipline laid out in the full HIPAA guide, applied to a world where the places touching PHI include clinicians' homes: inventory what touches patient data, put agreements and controls around it, and document that you did. The practices that struggle are not short on technology. They are running decisions made in 2020 inside a 2026 enforcement environment.

This is everyday work for our healthcare IT team. Talos reviews telehealth setups as part of a broader risk assessment, closes the device and network gaps, and leaves behind the documentation an auditor will ask for. If your telehealth stack has not had a hard look since the exemption ended, the checklist above is that look. Work through it yourself, or contact Talos and we will run it with you.

Not the consumer versions. The pandemic-era enforcement discretion that tolerated consumer video tools ended in 2023, and telehealth now requires an encrypted platform covered by a signed BAA, which consumer FaceTime and personal Zoom accounts do not offer. Healthcare-grade tiers of mainstream platforms can qualify, provided the BAA is actually executed and the tenant is configured rather than just purchased.

An encrypted platform under an executed BAA; session access controls such as waiting rooms, authenticated per-visit links and no reusable or guessable URLs; secured, practice-managed devices for clinicians; VPN or zero-trust access for remote work rather than raw home Wi-Fi; a deliberate recording policy; and a security risk assessment whose scope includes every remote setup used to deliver care.

That is the defensible standard. A shared family laptop lacks the controls the Security Rule expects: no disk encryption you manage, no EDR, no managed patching, and other users on the same profile. A practice-managed, encrypted, screen-locked device with MFA into practice systems is what should sit behind every remote clinician. Where that is impossible, a documented and managed personal-device enrollment is the honest minimum.

Yes, and unusually sensitive PHI, because they capture a patient discussing their condition on camera. If you record at all, recordings need a controlled storage location, encryption, role-based access, a retention rule and patient awareness. For many practices the cleanest answer is a written no-recording policy enforced by disabling recording in the platform settings.

Yes. Once clinicians deliver care from home, those setups are part of your environment, including the devices, the connections and the household around them, and an SRA that still describes only the office is incomplete. Add a remote-work section that records who delivers care from where, on what device and over what connection, and give those entries the same analysis as everything in the building.