HIPAA Series #4: Ensuring Privacy and Security in Virtual Care

Technological advancements are changing the healthcare industry. With high-speed Internet, video conferencing facilities, and healthcare apps, patients can get the best healthcare regardless of where they live. They don’t have to travel to access quality healthcare and can interact with healthcare specialists right from their beds. Undoubtedly, these advancements have made healthcare more convenient and accessible to everyone.

On the flip side, it opens up privacy and security considerations as all communications happen through the Internet. It also raises questions about how a patient’s Protected Health Information (PHI) is accessed and used.

HIPAA lays down guidelines for virtual care to allay these fears and encourage telehealth facilities. But before we jump into the privacy and security considerations, let’s step back to understand what constitutes telehealth under HIPAA.

Read the Full HIPAA Series

Our HIPAA Series covers 10 important topics related to HIPAA rules, regulations, and compliance. If you missed one of the posts in the series, navigate to them here:

1. HIPAA Series #1: Compliance for Healthcare Providers – What You Need to Know
2. HIPAA Series #2: What is Protected Health Information (PHI) Under HIPAA?
3. HIPAA Series #3: An Overview of HIPAA’s Privacy and Security Rules
4. HIPAA Series #4: Ensuring Privacy and Security in Virtual Care
5. HIPAA Series #5: Steps for Reporting and Mitigating Breaches Under HIPAA
6. HIPAA Series #6: Building a Culture of Compliance
7. HIPAA Series #7: The Role of Business Associates Under HIPAA
8. HIPAA Series #8: The Importance of HIPAA Audits
9. HIPAA Series #9: HIPAA and Cybersecurity
10. HIPAA Series #10: HIPAA and Data Sharing

What is Telehealth?

Under HIPAA, telehealth encompasses any activity that uses electronic communication technologies, like video conferencing, secure messaging, and remote monitoring, to deliver healthcare services remotely. While the specific regulations governing telehealth under HIPAA are not explicitly defined, healthcare providers offering telehealth services must ensure compliance with HIPAA’s privacy and security requirements. In particular, they continue to be responsible for protecting patient information during virtual consultations and interactions. This includes safeguarding the confidentiality, integrity, and availability of patient data transmitted and stored through telehealth platforms. Also, healthcare providers must obtain patient consent and provide clear notices regarding PHI usage and protection.

As there are no specific guidelines, both healthcare providers and patients can take appropriate measures to safeguard their PHI. Let’s see what each of them can do to ensure privacy and security in virtual care.

What Can Patients Do?

If you’re a patient, here are 15 things you can do to protect your privacy and security during a telehealth session:

1. Attend a telehealth session in a private room where others can’t hear you/
2. Turn off devices like a home security camera that can record the conversation.
3. Avoid using public devices, work devices, or other shared computers where others can access your recorded telehealth session.
4. Never join a telehealth session over a public or unsecured network.
5. Install the latest security patches and update your antivirus definitions regularly.
6. Use strong and unique passwords. Consider using a password manager if required.
7. Create a separate login and lock your sessions with a password.
8. Delete the non required health information from your device.
9. Use two-factor or multi-factor authentication.
10.  Leverage encryption tools to protect your sensitive data from unauthorized access.
11. Ensure that your telehealth sessions are not recorded by the app or the healthcare provider.
12. Consider using a patient portal to send and receive messages from your healthcare provider securely.
13. Know more about your healthcare provider and verify their credentials and authenticity before scheduling a telehealth session.
14. Never download known or random apps on the device you use for telehealth consultations.
15. Avoid turning on your device’s location.

What Can Healthcare Providers Do?

Besides patients, healthcare providers must also take the following measures to safeguard PHI in a virtual care environment:

• Before starting a session with a patient, explain the remote technology tools you will be using throughout the session.
• Answer any questions the patients may have regarding the security and privacy of their data.
• Ensure that you communicate with the patient through a secure portal.
• Take all efforts to secure PHI from unauthorized access.
• Keep your device updated with the latest antivirus software.
• Disclose accidental access or views.
• Inform the patients of their rights and how they can file a complaint.

Thus, these are some steps a healthcare provider can take to protect patients’ security and privacy during telehealth sessions.

Final Words

In all, telehealth is a convenient way for patients and healthcare providers to provide healthcare, as it cuts across geographical barriers, ensuring that patients receive appropriate care regardless of their location. However, the use of technologies and devices for telehealth opens up security and privacy issues. In this article, we looked at a few actionable tips that patients and healthcare providers can take to preserve PHI in a virtual care setup. We hope this information helps safeguard sensitive data while meeting HIPAA compliance.