New Audio-Only Telehealth Guidance to Meet HIPAA Rules

by  Summary of content created by Office for Civil Rights (OCR)
July 7th, 2022

Covered entities (healthcare providers and health plans) can use remote communications, called telehealth, to provide services to patients as long as they follow certain guidelines. The guidelines were developed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Privacy, Security, and Breach Notification Rules (HIPAA Rules), and the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) to help covered entities understand how they can use remote communication technologies.

Audio-Only Telehealth Clarifications

Because certain populations may have difficulty using audio-video telehealth, HHS is now issuing this guidance on audio-only telehealth in direct response to the Executive Order on Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government (E.O. 14058). This guidance will help ensure that individuals can continue to benefit from audio-only telehealth by clarifying how covered entities can provide telehealth services and improve public confidence that covered entities are protecting the privacy and security of patients' health information.

Some of the reasons these populations may have difficulty accessing or be unable to access technologies used for audio-video telehealth include the following: financial resources, limited English proficiency, disability, internet access, availability of sufficient broadband, and cell coverage in the geographic area.  Audio-only telehealth, especially using technologies that do not require broadband availability, can help address the needs of some of these individuals. 

Due to the coronavirus Public Health Emergency (PHE) of March 2020, the OCR issued a Telehealth Notification to assist the healthcare industry’s response to the PHE; and to quickly expand the use of remote healthcare services needed to treat patients without public facing contact. The notification is still in use. It will be in use until the PHE no longer exists or the notification expires, which will be determined by the secretary of the HHS at some later date.

New Audio-Only Telehealth Guidance to Meet HIPAA Rules

The following guidance will assist covered entities in complying with the HIPAA Rules when OCR’s Telehealth Notification is no longer in effect. 

  1. HIPAA covered entities can use remote communications technologies to provide telehealth services including audio-only services in compliance with the HIPAA Privacy Rule. 

  2. The HIPAA Security Rule applies to electronic protected health information (ePHI), which is PHI transmitted by, or maintained in electronic media.

  3. The HIPAA Rules require a covered entity to enter into a business associate agreement (BAA) with a telecommunication service provider (TSP) only when the vendor is acting as a business associate. As explained in previous guidance, a covered entity using a telephone to communicate with patients is not required to enter into a BAA with a TSP that has only transient access to the PHI it transmits because the vendor is acting merely as a conduit for the PHI. If the TSP is not also creating, receiving or maintaining PHI on behalf of the covered entity, and the TSP does not require access on a routine basis to the PHI it transmits in the call, no business associate relationship has been created. Therefore, a BAA is not needed.

  4. Covered healthcare providers may offer audio-only telehealth services using remote communication technologies consistent with the requirements of the HIPAA Rules, regardless of whether any health plan covers or pays for those services. Health plan coverage and payment policies for healthcare services delivered via telehealth are separate from questions about compliance with the HIPAA Rules and are not addressed in this document.




OCR Telehealth Resources List

HHS Telehealth Resources List


New Audio-Only Telehealth Guidance to Meet HIPAA Rules. (2022, July 7). Find-A-Code Articles. Retrieved from

© InnoviHealth Systems Inc

Article Tags  (click on a tag to see related articles)

Publish this Article on your Website, Blog or Newsletter

This article is available for publishing on websites, blogs, and newsletters. The article must be published in its entirety - all links must be active. If you would like to publish this article, please contact us and let us know where you will be publishing it. The easiest way to get the text of the article is to highlight and copy. Or use your browser's "View Source" option to capture the HTML formatted code.

If you would like a specific article written on a medical coding and billing topic, please Contact Us.


innoviHealth Systems, Inc.
62 East 300 North
Spanish Fork, UT 84660
Phone: 801-770-4203 (8-5 Mountain)
free demo
request yours today
free subscription
for any budget

Thank you for choosing Find-A-Code, please Sign In to remove ads.