> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
How do I implement HIPAA-compliant video sessions?
HIPAA-compliant telemedicine video requires both technical and operational controls. Technically: all signaling must use TLS 1.2+ over WSS (WebSocket Secure); all media must use DTLS-SRTP (the encryption layer of WebRTC); no unencrypted fallback paths should exist; PHI in recordings must be encrypted at rest with AES-256; and access to recordings must be role-controlled and audit-logged. Operationally: you need a BAA with your video platform vendor, your cloud hosting provider, and any recording storage service. If you build on third-party WebRTC providers (Daily, Twilio, Vonage, Whereby), verify they offer signed BAAs and that their infrastructure meets HIPAA requirements - do not rely on generic privacy policies as substitutes for a BAA.
What does the patient need to consent to before a telemedicine visit?
Consent requirements vary by state, but builders should design for the most stringent common requirements. Capture consent for: (1) the telemedicine modality itself - many states require explicit consent separate from the general patient consent form; (2) state-specific telehealth consent requirements (some states mandate specific language); (3) session recording (if applicable) - recording consent is typically legally required separately from telehealth consent; (4) any AI features (transcription, diagnostic aids) that process PHI; and (5) data sharing with third-party services (labs, pharmacies). Store each consent event with: patient identity, consent version/text hash, timestamp, collection method (click, e-signature), IP address, and session ID.
How do I verify that a clinician is licensed in the patient's state?
Cross-state licensure verification is one of the most complex data model challenges in telemedicine. At session start, the platform must: (1) determine the patient's physical location (state) - not billing address, actual physical location via IP geolocation or explicit patient attestation with fraud controls; (2) look up the clinician's active licenses in a license verification database (primary source is state medical board databases; consolidated access via FSMB DocInfo or IMLC for compact states); (3) compare the patient's state against the clinician's verified license states; (4) allow the session to proceed only if there is a valid active license in the patient's state; (5) log the verification result with the query timestamp and data source for audit. Build in caching with short TTLs (24-48 hours) for license status - licenses can be suspended with no advance notice.
What encryption is required for telemedicine video/audio streams?
HIPAA requires that ePHI transmitted over a network be protected from unauthorized access, and in practice TLS 1.2+ for signaling and DTLS-SRTP for media are the standard implementation. For WebRTC-based sessions: WebRTC mandates DTLS-SRTP for all media by specification - browsers refuse to establish media without it. Confirm your WebRTC implementation does not allow unencrypted media in fallback scenarios. For signaling, use WSS (WebSocket Secure with TLS 1.2+) and HTTPS for all API calls. Verify that your TURN server (media relay) is encrypted - TURN without TLS exposes media relay traffic. For recording storage: AES-256 with customer-managed keys is the recommended baseline.
What is the Ryan Haight Act and how does it affect telemedicine features?
The Ryan Haight Online Pharmacy Consumer Protection Act (2008) prohibits prescribing controlled substances via the internet without a prior valid in-person medical evaluation (with limited exceptions). For builders, this means: your controlled substance prescribing feature must check whether the patient has had an in-person evaluation with the prescribing provider. The DEA implemented a telehealth exception during the COVID-19 public health emergency, but long-term rules were still being finalized as of 2024. Implement: a gate in the prescription flow that requires documentation of prior in-person evaluation or an applicable exception (VA provider, DEA registered telemedicine practice, PHE exception); log the gate decision and exception basis in the encounter record; and subscribe to DEA regulatory updates for finalized post-PHE rules.
How should I handle session recording from a HIPAA perspective?
Session recording creates persistent PHI and requires: (1) explicit patient consent captured before recording begins - this is separate from general telehealth consent and must be obtainable and revocable mid-session; (2) recording encrypted at rest (AES-256); (3) access to recordings restricted to treating providers and authorized staff only, enforced at the API level; (4) audit trail for all recording accesses; (5) retention per state medical records law (typically 7-10 years for adults); (6) patient access rights - recordings are part of the medical record and subject to patient access rights; (7) secure deletion at the end of retention period. Never store recordings in the same bucket as non-PHI content without strict object-level access controls.
How do I implement patient identity verification for telehealth?
Patient identity verification prevents session hijacking and unauthorized PHI access. A minimum verification approach: (1) for scheduled appointments, patients authenticate via MFA-protected portal login before receiving a session token; (2) the session token is bound to the patient's identity in your database; (3) at session join, the session token is validated and the patient is presented to the provider with their verified identity and appointment context; (4) the provider verbally confirms patient name and date of birth at session start (a common clinical requirement). For higher-assurance scenarios (controlled substance prescribing, first-time patients): implement NIST IAL2 remote identity proofing using document verification (driver's license, passport) with liveness check. Log all identity verification events with method and timestamp.
What should I do when a session fails mid-encounter?
Design for graceful failure as a first-class requirement. When a session drops: (1) client-side: display a clear reconnection UI with attempt counter and estimated wait; (2) server-side: preserve session state (clinical notes in progress, consent state, recording status) for up to 10 minutes; (3) offer an automatic fallback to audio-only call if video fails; (4) offer a provider-initiated phone callback as final fallback; (5) when reconnection succeeds, restore the clinical note context; (6) log the failure event (time, reason code, duration of interruption) in the session audit trail; (7) if reconnection fails, trigger the emergency fallback protocol (notify care team, send patient follow-up instructions, schedule callback appointment). Store all session failure events for post-incident analysis and SLA monitoring.
How do I implement cross-state licensing checks at scale?
Cross-state licensing at scale requires an architectural approach, not manual verification. Implement: (1) a License Registry microservice that polls state medical board APIs or aggregators (FSMB DocInfo API, IMLC API) to maintain a cached, time-stamped license status table for all providers in your network; (2) a session pre-authorization check that queries the License Registry with (provider_id, patient_state) and returns a binary allowed/blocked decision; (3) short cache TTL (12-24 hours) with forced refresh on suspicious state changes; (4) alert workflow when a provider's license is found suspended in a state where they have active scheduled sessions; (5) a provider credentialing enrollment flow that captures all license states during onboarding and triggers reverification at configurable intervals (typically 90 days).
What state data must be captured and retained for telehealth compliance?
At minimum, retain for each telehealth session: session ID; patient identity (verified); provider identity and license state; patient physical location at time of visit (state); session start/end timestamps; session modality (video, audio-only, async); consent record ID(s); encounter note record reference; prescription references (if applicable); session outcome (completed, abandoned, technical failure); recording ID (if session was recorded); and audit log entries for all events in the session lifecycle. Retention: session metadata typically follows the same retention schedule as the encounter record - minimum 6 years under HIPAA for compliance documentation, state medical records law for clinical records (commonly 7-10 years for adults).
How do I handle minors in telemedicine?
Minor patients require additional consent and identity controls. Depending on state law and the clinical context: (1) a parent or legal guardian must consent for treatment of patients under 18 (in most contexts); (2) for certain sensitive services (reproductive health, mental health, substance use) many states allow minors to consent independently - the platform must know the state and service category to determine who consents; (3) the patient portal for minors requires age-appropriate access controls - proxy access for parents with the minor's age-based access phaseout; (4) prescribing to minors requires weight/age appropriateness checks for certain medications; (5) recording consent for minors typically requires guardian consent. Minors' records often have special handling requirements: some states require retention until the minor's 26th birthday.
What technical requirements apply to asynchronous (store-and-forward) telemedicine?
Store-and-forward telemedicine (patient uploads images/data for later provider review) requires: (1) secure file upload over HTTPS with CSRF protection; (2) pre-upload validation of file type and size; (3) server-side scanning for malware; (4) encryption at rest (AES-256) immediately upon upload; (5) immutable upload timestamp in the audit trail; (6) metadata capture: patient ID, body region, symptoms, device used; (7) provider review audit trail - when was it reviewed, by whom, what was the response; (8) delivery of response to patient via secure portal (not email without encryption); (9) retention per medical records law. For dermatology and ophthalmology: image quality requirements (minimum DPI, lighting) should be captured in the submission workflow.
How do I integrate telemedicine sessions with an EHR via FHIR?
FHIR R4 integration for telemedicine: (1) pre-session patient data pull using FHIR Patient, Condition, MedicationRequest, AllergyIntolerance, and Observation resources - use SMART on FHIR authorization so the patient/provider explicitly authorizes the data pull; (2) encounter note write-back using FHIR Encounter, ClinicalImpression, and DocumentReference resources; (3) prescription write using FHIR MedicationRequest; (4) appointment management using FHIR Appointment and Schedule resources. Secure all FHIR API calls with OAuth2 Bearer tokens (SMART on FHIR). Cache frequently accessed patient data with short TTLs (5-15 minutes for active session context).
What accessibility requirements apply to telemedicine video platforms?
Telemedicine platforms must comply with ADA and Section 508 accessibility requirements. Key requirements: (1) WCAG 2.1 AA compliance for all portal interfaces - keyboard navigation, screen reader support, color contrast; (2) closed captioning for video sessions - either real-time AI transcription or provider captioning support for deaf/hard-of-hearing patients; (3) screen magnification compatibility; (4) low-bandwidth accessible mode for patients with limited internet access; (5) video relay service (VRS) integration for ASL users; (6) text-based fallback chat for patients who cannot use audio. Document accessibility features in patient onboarding to meet ADA "effective communication" requirements.
What are the minimum identity proofing requirements for telemedicine provider enrollment?
Provider enrollment identity proofing requirements vary by state and prescribing authority. Minimum baseline for non-prescribing providers: (1) verification of professional license via primary source (state medical board) - not self-report; (2) NPI (National Provider Identifier) verification via NPPES; (3) DEA registration verification if prescribing; (4) exclusion list check (OIG LEIE, SAM.gov) - providers excluded from federal programs cannot participate in Medicare/Medicaid telemedicine. For controlled substance prescribing: DEA EPCS identity proofing (IAL2+, in-person or remote supervised) per 21 CFR Part 1311.
What telehealth parity laws affect platform feature design?
Telehealth parity laws in 40+ states require insurers to cover telehealth services on the same terms as in-person services for the same procedure codes. Builders should: (1) support CPT/HCPCS code assignment equivalent to in-person visits (99201-99215 E/M codes, modifier -95 or GT for synchronous telehealth); (2) support place-of-service code 02 (telehealth provided in a location other than a patient's home) or 10 (telehealth provided in a patient's home); (3) capture insurance plan data and route billing correctly for parity vs. non-parity plans; (4) support audio-only modifiers where applicable (modifier -93 for audio-only E/M in Medicare). Note: parity law requirements change frequently; implement a configurable rules engine rather than hard-coded billing logic.