As PHE nears end, know when audio-only care becomes ePHI — and stay compliant

Why This Topic Matters

As telehealth policies evolve after the public health emergency, practices need to understand which audio-only workflows may trigger HIPAA security requirements and what safeguards OCR expects. This helps organizations reduce privacy risk and prepare staff and systems for ongoing compliance.

Article Sections

1. HIPAA compliance for audio-only telehealth

   Introduces the compliance focus for phone-based care and the role of OCR guidance as enforcement discretion changes. It frames the topic around telehealth operations and HIPAA obligations.

2. How OCR guidance applies to remote communication technologies

   Summarizes the federal guidance on audio-only telehealth and the broader categories of communication technologies discussed by OCR. It explains the article’s focus on when telehealth remains within HIPAA’s scope.

3. Is the ePHI just passing through?

   Discusses the distinction between transient transmission and situations where electronic information is retained or otherwise handled in a way that affects security obligations. It highlights the importance of understanding what happens to patient information during the call.

4. Review HIPAA requirements for audio-only care

   Covers general privacy and security preparedness steps for audio-only care as practices approach the end of the temporary enforcement flexibility. It also addresses operational safeguards and organizational readiness.