> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
AES-256 - Advanced Encryption Standard 256-bit
Symmetric block cipher used to encrypt telemedicine media recordings and PHI at rest. AES-256 is the NIST-recommended standard for data at rest and is considered "reasonable and appropriate" under HIPAA Security Rule Technical Safeguards.
BAA - Business Associate Agreement
Contract required by HIPAA (45 CFR § 164.504(e)) between a telemedicine covered entity and any vendor touching PHI. Required for: video platform vendor, cloud hosting, EHR API vendor, recording storage, analytics providers.
CDN - Content Delivery Network
Network of distributed servers used to deliver telemedicine patient portal assets and pre-recorded content with low latency. CDN providers handling PHI require BAAs; CDN providers delivering only public/non-PHI assets typically do not.
CPOE - Computerized Physician Order Entry
Electronic system for physicians to enter medication orders, labs, imaging directly into the healthcare information system. Telemedicine platforms supporting e-prescribing integrate with CPOE or standalone e-prescribing systems.
DEA - Drug Enforcement Administration
US federal agency that regulates controlled substance prescribing. Telemedicine controlled substance prescribing follows 21 CFR Part 1311 (EPCS) and the Ryan Haight Act in-person evaluation requirement (with pandemic exception extensions).
DTLS-SRTP - Datagram Transport Layer Security / Secure Real-time Transport Protocol
Encryption protocol for WebRTC media (audio/video). DTLS establishes keys; SRTP encrypts media payload in transit. Required for HIPAA-compliant video session encryption.
EHR - Electronic Health Record
A digital version of a patient's paper chart containing medical history, diagnoses, medications, and care plans. Telemedicine platforms integrate with EHRs via FHIR APIs for pre-session data pull and post-session encounter note write-back.
E2EE - End-to-End Encryption
Encryption where only session endpoints hold decryption keys. For telemedicine, E2EE conflicts with server-side features (AI transcription, recording). Selective E2EE with key escrow is an emerging approach.
EPCS - Electronic Prescribing of Controlled Substances
DEA-regulated process for electronically prescribing controlled substances, requiring two-factor identity proofing at clinician registration and logical access controls at time of prescription. (21 CFR Part 1311)
FHIR - Fast Healthcare Interoperability Resources
HL7 standard for healthcare data exchange via RESTful APIs. FHIR R4 is the current standard. Required for ONC-compliant patient data access APIs (21st Century Cures Act information blocking rules).
HIPAA - Health Insurance Portability and Accountability Act
US federal law governing PHI privacy and security. Key rules for telemedicine builders: Privacy Rule (45 CFR Part 164, Subparts A and E), Security Rule (45 CFR Part 164, Subpart C), Breach Notification Rule (45 CFR Parts 164.400–414).
HLS / DASH - HTTP Live Streaming / Dynamic Adaptive Streaming over HTTP
Adaptive bitrate streaming protocols used for asynchronous telemedicine (store-and-forward) video delivery. Not used for synchronous live telemedicine (which uses WebRTC); used for pre-recorded visit playback, education, and async dermatology workflows.
IAL - Identity Assurance Level
NIST SP 800-63A classification of identity proofing strength: IAL1 (self-asserted), IAL2 (remote document verification), IAL3 (in-person proofing). EPCS controlled substance prescribing requires IAL2+.
ICE - Interactive Connectivity Establishment
WebRTC protocol for NAT traversal. Uses STUN (Session Traversal Utilities for NAT) to discover public IP, and TURN (Traversal Using Relays around NAT) to relay media when direct peer connection fails. TURN servers handling PHI require BAAs.
IMLC - Interstate Medical Licensure Compact
Agreement between 40+ US states for streamlined multi-state physician licensure. Relevant for cross-state telemedicine licensing verification workflows.
JWT - JSON Web Token
Compact, URL-safe token format used for session authentication in telemedicine. Tokens must be: short-lived (15-60 minute expiration for active sessions), signed (HMAC-SHA256 or RS256), and validated at every API call handling PHI.
MFA - Multi-Factor Authentication
Authentication requiring two+ factors from separate categories. Required for provider access to telemedicine PHI; strongly recommended for patient access. TOTP (FIDO2/WebAuthn) preferred over SMS OTP.
NIST SP 800-63
NIST publication defining Digital Identity Guidelines. SP 800-63A (Identity Proofing), SP 800-63B (Authentication), SP 800-63C (Federation). Reference for IAL and AAL requirements for telemedicine applications.
ONC - Office of the National Coordinator for Health Information Technology
Federal agency overseeing health IT standards and interoperability. ONC's Information Blocking rules (21st Century Cures Act) require telemedicine platforms to provide FHIR-based patient data access.
PDMP - Prescription Drug Monitoring Program
State-run databases tracking controlled substance prescriptions. Telemedicine providers prescribing controlled substances must query PDMP before prescribing per applicable state laws.
PHI - Protected Health Information
Any individually identifiable health information subject to HIPAA. In telemedicine: video content, encounter notes, diagnoses, prescriptions, scheduling metadata linked to patient identity.
PKI - Public Key Infrastructure
System for managing digital certificates and encryption keys. Used in telemedicine for TLS certificate management, code signing for medical apps, and (in some implementations) client certificate authentication.
SMART on FHIR
Open standard combining FHIR (data) with OAuth2/OIDC (authorization) for secure healthcare app integration. Enables telemedicine platforms to access EHR data with patient-authorized granular scopes.
SRTP - Secure Real-time Transport Protocol
Protocol for encrypting RTP (Real-time Transport Protocol) media streams. Used with DTLS for WebRTC session encryption. Essential for HIPAA-compliant audio/video transmission.
STUN/TURN - Session Traversal Utilities for NAT / Traversal Using Relays around NAT
WebRTC infrastructure for NAT traversal. STUN discovers public IP addresses; TURN relays media through a server when direct peer connection is blocked by firewalls. TURN servers in the media path are business associates and require BAAs.
TLS - Transport Layer Security
Cryptographic protocol for encrypted communication over networks. TLS 1.2 minimum required for PHI in transit (HIPAA Security Rule); TLS 1.3 recommended. All telemedicine API calls, signaling, and data exchange must use TLS.
TOTP - Time-based One-Time Password
A form of MFA where a code is generated from a shared secret and current timestamp (RFC 6238). Used as second factor for provider and patient login to telemedicine platforms.
WebRTC - Web Real-Time Communication
Open browser standard for real-time peer-to-peer audio/video and data. Primary protocol for browser-based telemedicine. Key security requirements: DTLS-SRTP for media, WSS for signaling, HTTPS for portal delivery.