Be careful with HIPAA under OCR’s good faith telehealth provision

Why This Topic Matters

As telehealth use expanded rapidly during the public health emergency, providers needed to balance access to care with privacy, security, and compliance obligations. The article helps readers understand the scope of the OCR guidance and the operational areas where HIPAA, state law, vendor selection, and internal security practices can still create exposure.

Article Sections

1. Telehealth enforcement discretion during COVID-19

   Overview of the federal response to expanded telehealth use during the public health emergency and the OCR enforcement posture. The section frames why remote care options became more widely available.

2. Counseling caution

   Discussion of provider caution, privacy concerns, and the continuing relevance of HIPAA and state-law obligations when using communication technology. It also addresses patient privacy expectations and legal risk awareness.

3. Push the patient to compliance

   Guidance on patient communication, documenting patient preferences, and choosing communication methods that support privacy and security. The section also covers general considerations for discussing technology choices with patients.

4. Five tips for the new tech

   A practical overview of operational safeguards for telehealth technology, security risk analysis updates, and patient-side precautions. It focuses on implementation themes such as security settings, safeguards, and risk reduction.

5. Don’t forget your staff

   Workforce-related privacy and security concerns, including remote work risks, documentation handling, and staff security training. The section emphasizes employee behavior as part of overall HIPAA protection.