FAQs on Telemedicine and HIPAA During the Public Health Emergency

Historical update (October 31, 2026): This May 2021 article describes a temporary COVID-19 HIPAA telehealth enforcement-discretion policy, not current permission to use software that fails applicable HIPAA requirements. The policy expired on May 11, 2023, and the 90-day transition period ended on August 9, 2023. For current requirements, consult HHS guidance on HIPAA and telehealth.

Throughout the COVID-19 pandemic, federal agencies sought to allow health care companies more flexibility to use popular technology and applications to better engage with their patients. One example is the Department of Health and Human Services’ Office of Civil Rights (OCR), which issued a notice explaining that OCR would temporarily refrain from imposing certain HIPAA penalties when health care providers used non-public-facing audio or video communications technology to provide telehealth in good faith during the COVID-19 public health emergency. That enforcement discretion has expired.

OCR has provided a set of Frequently Asked Questions on Telemedicine and HIPAA Waivers, offering helpful guidance and clarification. For example:

11. If a covered health care provider uses telehealth services during the COVID-19 outbreak and electronic protected health information is intercepted during transmission, will OCR impose a penalty on the provider for violating the HIPAA Security Rule?

No. OCR will exercise its enforcement discretion and will not pursue otherwise applicable penalties for breaches that result from the good faith provision of telehealth services during the COVID-19 nationwide public health emergency. OCR would consider all facts and circumstances when determining what constitutes a good faith provision of telehealth services. For example, if a provider follows the terms of the Notification and any applicable OCR guidance (such as this and other FAQs on COVID-19 and HIPAA), it will not face HIPAA penalties if it experiences a hack that exposes protected health information from a telehealth session.

OCR believes that many current and commonly available remote electronic communication products include security features to protect ePHI transmitted between health care providers and patients. In addition, video communication vendors familiar with the requirements of the Security Rule often include stronger security capabilities to prevent data interception and provide assurances they will protect ePHI by signing a HIPAA business associate agreement (BAA). Providers seeking to use video communication products are encouraged to use such vendors, but will not be penalized for using less secure products in their effort to provide the most timely and accessible care possible to patients during the Public Health Emergency. Providers are encouraged to notify patients that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications. OCR does not endorse the use of or the security capabilities of any particular communications product.

Under that temporary policy, providers could use non-public-facing video applications (e.g., Apple FaceTime, Facebook Messenger, Google Hangouts, Zoom, Skype) in good-faith telehealth even when an application did not fully satisfy HIPAA requirements. The temporary policy no longer applies. The term “non-public facing” means the application, by default, only allows the intended parties to participate in the communication. In contrast, “public-facing” products (e.g., TikTok, Facebook Live, Twitch) or public video chat rooms would not be acceptable forms of communication for telemedicine services.

The telehealth enforcement-discretion notice described in this 2021 article expired on May 11, 2023. OCR’s subsequent transition period ended on August 9, 2023. Covered entities must assess their current telehealth operations against applicable HIPAA privacy and security requirements; the temporary COVID-19 policy should not be relied upon as an ongoing exception. Providers should select and configure telehealth technologies with appropriate safeguards and comply with applicable business associate agreement requirements. See HHS guidance on HIPAA rules for telehealth technology.