Video-based appointments with patients, including storing images and files, need to meet safety standards identical to in-person appointments to ensure the proper level of confidentiality and patient data safety. The HIPAA guidelines on telemedicine lie within the HIPAA Security Rule and say that:
Only authorized users should have access to ePHI
The data that is electronically transmitted must be fully encrypted
The technology vendor should enter into a Business Associate Agreement (BAA)
The communication system between a patient and healthcare provider must be secure, and no third party can access the ePHI during remote care
Communication systems need to be monitored and controlled to avoid unexpected or malicious data breaches
To follow HIPAA guidelines on telehealth, physicians must use HIPAA-compliant tools, software, and communication touchpoints.