HIPAA and Telehealth Platforms: What Changed in 2023, and What a Cash-Pay Clinic Should Still Do
The pandemic-era allowance for consumer video apps ended in 2023. A clinic that handles patient information through a telehealth platform needs a business associate agreement with vendors that create, receive or maintain it. Whether HIPAA applies to a strictly cash-pay clinic is a separate question that should not be assumed away.
Key Highlights
- OCR's COVID-era telehealth enforcement discretion ended with the public health emergency on May 11, 2023, with a 90-day transition that ended August 9, 2023.
- A business associate agreement is required with a vendor that creates, receives or maintains protected health information beyond being a mere conduit, such as apps that store recordings or transcripts.
- HIPAA applies to covered entities, generally providers who transmit health information electronically in covered transactions, so a strictly cash-pay clinic may not be one, but state privacy laws can still apply.
- Treat the HIPAA standard as the working standard anyway.
What Changed in 2023
During the COVID-19 public health emergency, the Office for Civil Rights said it would not penalize providers who used everyday communication apps for telehealth in good faith. That discretion ended at 11:59 p.m. on May 11, 2023, with a 90-day transition that ended at 11:59 p.m. on August 9, 2023. Older HHS FAQ pages that describe apps like Zoom or FaceTime as acceptable were written for that period and should not be relied on today.
When a BAA Is Required
OCR's guidance on audio-only telehealth explains the principle: a business associate agreement is needed with a vendor that creates, receives or maintains protected health information on the provider's behalf, beyond merely transmitting it. Apps that store recordings or transcripts and translation services are examples. The Security Rule applies to apps, voice and video systems and recording or transcription, and risk analysis should cover encryption, authentication and session timeouts.
Does HIPAA Apply to a Cash-Pay Clinic?
HIPAA's rules apply to covered entities. Under OCR's guidance, a provider is a covered entity if it transmits health information electronically in connection with a covered transaction, which generally means insurance billing. A clinic that is strictly cash-pay and never bills insurance electronically may therefore fall outside HIPAA's definition, and that is a question for your own counsel. Two cautions apply. First, HHS notes that some states have privacy laws that apply to entities not covered by HIPAA. Second, a clinic that works with platforms, pharmacies or certification bodies will usually be held to the HIPAA standard by contract. LegitScript, for example, expects HIPAA compliance from US applicants that handle protected health information.
A Practical Standard
- term: text
- term: text
- term: text
- term: text
- term: text
Disclaimer
This article is general educational information, not legal advice. Telehealth rules differ by state and change often, so confirm specifics with health care regulatory counsel in each state where you treat patients.
MedGrid MSO provides management services to independently owned practices; it does not practise medicine and does not direct clinical decisions. Requirements vary by state and by service, and change over time — nothing on this page is legal or medical advice. Talk to us or your own counsel before making a structural decision for your clinic.