Which health compliance standards apply to US telehealth services?

US telehealth services must satisfy several overlapping requirements: federal privacy and security rules, state professional licensing and clinical practice laws, and any prescribing or reimbursement conditions attached to the service. Additional obligations can apply to substance use disorder records, consumer health applications, and regulated medical devices. There is no single federal “telehealth compliance certificate” that establishes compliance across all these areas.

For quality control and safety managers, the starting point is the service model. A hospital’s video consultation service, an independent behavioral health practice, and a consumer symptom-checking app can face different health compliance standards. Applicability depends on who delivers care, where the patient is located, what information moves through the system, and what the technology does. A useful review connects each requirement to a specific workflow and the evidence needed to show that it works.

Establish which requirements attach to the service

Before reviewing certificates or security questionnaires, define the operating boundaries. Identify the clinical entity, technology providers, patient locations, practitioner types, payment arrangements, and intended clinical functions. Include messaging, intake forms, recordings, transcription, remote monitoring, and prescribing if those features are available. Each can introduce obligations that a review focused only on the video platform would miss.

Four questions organize the initial assessment:

• Who provides the service? Determine whether the organization is a HIPAA covered entity, a business associate, a consumer application provider, or an organization performing several roles.
• Where does care occur? Identify the patient’s physical location during the encounter and the practitioner’s location, then assess the relevant licensing and practice rules.
• What clinical activity takes place? Consultation, diagnosis, prescribing, substance use disorder treatment, and device-supported monitoring require different checks.
• Who pays? Medicare, Medicaid, commercial insurers, and direct-pay arrangements introduce different coverage and contractual conditions.

This assessment should produce a requirements register with an owner, an applicability rationale, and supporting evidence for each obligation. “HIPAA compliant” is too broad to function as an acceptance criterion. A more useful criterion specifies, for example, which vendors require business associate agreements, how access is authorized, or how patient location is checked before care begins.

HIPAA governs covered workflows, but leaves other obligations in place

HIPAA applies to covered entities and their business associates. A healthcare provider is generally a covered entity when it conducts specified healthcare transactions electronically. A company handling protected health information on behalf of a covered entity may be a business associate. A health-related app does not automatically fall under HIPAA simply because it collects sensitive information.

For covered telehealth services, the HIPAA Privacy Rule governs permitted uses and disclosures of protected health information and relevant patient rights. The Security Rule addresses safeguards for electronic protected health information. The Breach Notification Rule establishes notification duties following breaches of unsecured protected health information. These obligations extend across the relevant workflow, including scheduling, consultations, documentation, storage, and support access.

The security assessment should examine the actual deployment. Relevant controls include access authorization, authentication, audit logging, transmission protection, backups, incident response, and the management of workforce and vendor access. A risk analysis must account for how the organization uses the system. A vendor’s general security assessment cannot establish whether a clinic has configured permissions correctly or secured the endpoints used by its clinicians.

Business associate agreements are essential where the relationship requires them, but an executed agreement does not demonstrate that safeguards operate effectively. Review subcontractor arrangements, incident reporting terms, data return and deletion provisions, and the provider’s ability to investigate an event. Vendors that maintain protected health information can have business associate responsibilities even when they cannot view encrypted content.

Additional features deserve particular scrutiny. Recording, automated transcription, AI-generated notes, and analytics can change data flows and access arrangements. Review their purposes, retention settings, recipients, and contractual treatment before enabling them. Telehealth consent should not be treated as blanket permission for unrelated uses of patient information.

For procurement teams, the strongest evidence combines contractual commitments with deployment-specific controls. Request documentation showing what the platform records, which administrative roles can access it, how access is logged, and whether recordings or secondary processing can be disabled. These details make privacy obligations testable.

Services outside HIPAA still need a privacy assessment

A consumer health service outside HIPAA may face Federal Trade Commission requirements and state privacy laws. The FTC Health Breach Notification Rule can apply to certain vendors of personal health records and related entities. Its coverage requires a separate assessment; it does not apply identically to every health app.

State consumer health data laws can reach information and organizations outside HIPAA’s scope. Their definitions, exemptions, consent requirements, and deletion obligations vary. State medical confidentiality and breach notification laws may also apply. Advertising pixels, software development kits, and analytics tools warrant review because disclosures through these tools may expose sensitive information or conflict with privacy representations.

An organization should therefore document why a data flow falls under a particular legal framework. Assuming that information outside HIPAA is unrestricted creates a substantial gap in vendor and product reviews.

State rules determine whether the clinical encounter can proceed

Professional licensing is a separate requirement from information security. In general, practitioners need authority to practice in the state where the patient is physically located during the encounter, subject to applicable exceptions, registrations, or other state pathways. A patient’s home address may be insufficient: the patient could be traveling when care is delivered.

Interstate compacts can facilitate authorization for participating professions and jurisdictions, but they do not establish unrestricted national practice rights. The pathway depends on the profession, the compact, and the states involved. An organization also needs to assess whether the practitioner’s own location creates additional requirements.

A defensible workflow records patient location at each encounter and connects that information to verified practitioner authority. Credentialing controls should cover renewal dates, restrictions, specialty scope, and changes in the states served. Scheduling systems should prevent bookings that exceed the approved service footprint.

State rules may also address informed consent, establishment of the practitioner–patient relationship, acceptable communication methods, documentation, and follow-up. Some services require a specific telehealth consent process. A general website acceptance box may not capture the information or evidence required for the clinical encounter.

Clinical suitability needs its own assessment. Telehealth does not remove the duty to meet the applicable standard of care. Teams should define when a remote examination is adequate, when an in-person assessment is necessary, and how urgent symptoms are escalated. For services with foreseeable emergency risks, staff need a workable method to identify the patient’s location and activate local assistance.

Operational testing can expose gaps that policy review misses. Test what happens when a patient is in an unsupported state, the connection fails during an urgent assessment, or the clinician cannot obtain sufficient information remotely. The system should produce a clear next action and a record of the decision.

Prescribing requires a separate authorization check

Remote prescribing depends on state professional rules, the medication involved, and applicable federal requirements. Controlled substances require particular attention under the Controlled Substances Act and DEA rules, including the Ryan Haight Act framework and any applicable exceptions or telemedicine pathways.

Federal telemedicine prescribing arrangements have changed through temporary measures and rulemaking. Organizations should check the provisions effective on the date of prescribing and avoid treating an earlier pandemic-era permission as permanent. State restrictions, DEA registration requirements, and other prescribing obligations can remain relevant even when a federal pathway permits remote prescribing.

Controls should link the practitioner, patient location, medication category, and encounter method to the applicable authorization. Where required, incorporate prescription drug monitoring program checks and identity verification. A prescription should not proceed solely because the platform supports electronic prescribing.

Additional requirements follow the records, technology, and payer

Some telehealth services need a more specialized compliance review. These requirements should be assessed when the service triggers them, rather than added indiscriminately to every vendor questionnaire.

Substance use disorder records. Records covered by 42 CFR Part 2 require additional analysis of confidentiality, consent, disclosure, and related obligations. Part 2 does not attach to every record mentioning substance use. Coverage depends on the program and the records involved. Organizations handling covered records need workflows that account for the rules when sharing information across clinical, billing, and technology partners.

Medical devices and clinical software. A general video communication platform does not become an FDA-regulated medical device merely because clinicians use it. Device status depends on intended use and functionality. Software or connected equipment used for diagnostic, treatment, or monitoring functions may require a device-specific assessment. For regulated products, review the applicable authorization, intended use, labeling, and responsibilities for maintenance and changes.

Quality teams should also test the complete monitoring workflow. A sensor’s regulatory status alone does not establish that its readings reach the right clinician or that alerts receive timely review. Define responsibility for data quality, missing readings, alert thresholds, technical failures, and escalation. These controls address patient safety even where the communication platform itself is not regulated as a device.

Reimbursement and program participation. Medicare, state Medicaid programs, and commercial payers can impose conditions involving eligible services, practitioner types, encounter methods, documentation, coding, and patient circumstances. These conditions are distinct from legal authority to provide care. A service may be clinically permissible yet fail a payer’s reimbursement requirements.

Payer rules and temporary coverage provisions can change. Billing teams need a maintained reference for the relevant payer and date of service, supported by clinical documentation. Treating one payer’s telehealth policy as a national rule can create repeated claim and audit problems.

Accessibility and nondiscrimination obligations also belong in the service review where applicable. Evaluate communication support, accessible interfaces, and accommodation procedures. A technically secure encounter can still fail operationally if a patient cannot use the service or understand the consultation.

Use certifications as evidence with defined limits

SOC 2 reports, ISO/IEC 27001 certification, and HITRUST assessments can support vendor evaluation. They do not independently establish compliance with HIPAA, state licensure rules, prescribing law, or clinical practice requirements. HHS does not issue an official HIPAA compliance certification for telehealth platforms.

SOC 2 is an attestation report, and its value depends on the services, criteria, period, findings, and customer responsibilities covered. ISO/IEC 27001 certification concerns an information security management system within a defined scope. HITRUST assessments also vary by scope and assessment type. Review the underlying evidence and determine whether it covers the product, hosting environment, and operations used by your organization.

Pay particular attention to responsibilities assigned to the customer. A vendor may provide logging, access controls, and secure configuration options while leaving activation and review to the healthcare organization. Procurement approval should identify those responsibilities and assign them before launch.

The final acceptance decision should follow the patient journey: booking, identity and location verification, consent, consultation, documentation, prescribing, follow-up, and incident handling. For each stage, identify the applicable requirement, the control owner, and the evidence retained. Reopen that assessment when the service adds a state, specialty, vendor, recording feature, prescribing function, or monitoring device. Those changes can alter the compliance position even when the platform’s certification remains valid.