Telehealth Privacy, Security & Your Rights

Your health information is sensitive and deserves protection. This guide explains your privacy rights when using telehealth services, how reputable platforms protect your data, and steps you can take to safeguard your personal health information.

Understanding HIPAA and Telehealth

The Health Insurance Portability and Accountability Act (HIPAA) is the primary law protecting health information privacy in the United States.

What HIPAA Requires

• Privacy Rule: Limits who can access your health information
• Security Rule: Requires safeguards to protect electronic health data
• Breach Notification: Requires notification if your data is compromised
• Patient Rights: Gives you control over your health information

HIPAA-Compliant Telehealth

Legitimate healthcare providers using telehealth must:

• Use secure, encrypted communication platforms
• Protect stored health information
• Train staff on privacy practices
• Provide you with a Notice of Privacy Practices
• Get your consent before sharing information (with limited exceptions)

Reputable platforms like BetterHelp, Talkspace, Teladoc, and Cerebral are designed to meet HIPAA requirements.

Your Privacy Rights

Under HIPAA and related laws, you have the right to:

• Access your records: Request copies of your health information
• Request corrections: Ask to amend inaccurate information
• Know who accessed your data: Get a list of disclosures
• Request restrictions: Ask for limits on how your information is used
• Choose communication methods: Request how and where you're contacted
• File complaints: Report privacy violations to the provider or government

How Telehealth Platforms Protect Your Data

Technical Safeguards

• Encryption: Data is scrambled during transmission (end-to-end encryption)
• Secure servers: Information stored in protected data centers
• Access controls: Only authorized personnel can view your data
• Audit trails: Systems track who accesses information and when
• Automatic logouts: Sessions end after periods of inactivity

Administrative Safeguards

• Staff training on privacy practices
• Policies governing data access and use
• Risk assessments and security audits
• Incident response procedures

Physical Safeguards

• Secure data center facilities
• Controlled access to systems
• Proper disposal of data when no longer needed

What Information Is Collected

Telehealth platforms typically collect:

• Personal information: Name, contact details, date of birth
• Health information: Symptoms, diagnoses, treatment plans, medications
• Session content: What you discuss with your provider
• Insurance information: If using insurance coverage
• Payment information: Credit card or bank details
• Technical data: Device information, IP address, usage patterns

What's Typically NOT Collected (or Shouldn't Be)

• Video recordings of sessions (unless specifically disclosed)
• Unnecessary personal details
• Information about household members without their consent

Mental Health Privacy Considerations

Mental health information often has additional privacy protections:

• Psychotherapy notes: May have stronger protections than general medical records
• Substance abuse records: Federal law (42 CFR Part 2) provides extra protection
• State laws: Some states have additional mental health privacy laws

Exceptions to Confidentiality

Providers may be required to break confidentiality in certain situations:

• Danger to self: If you're at serious risk of harming yourself
• Danger to others: If you pose a credible threat to someone
• Child or elder abuse: Mandated reporting requirements
• Court orders: Legal requirements to disclose information
• Insurance requirements: Information needed for coverage

Your provider should explain these limits at the start of treatment.

Protecting Your Own Privacy

Steps you can take to protect your telehealth privacy:

During Sessions

• Use a private, secure location where you won't be overheard
• Use headphones to keep audio private
• Close other applications on your device
• Ensure no one else can see your screen

Technology Security

• Use a secure, private Wi-Fi network (not public Wi-Fi)
• Keep your devices updated with security patches
• Use strong, unique passwords for healthcare accounts
• Enable two-factor authentication when available
• Log out completely after each session

Account Management

• Review the platform's privacy policy before signing up
• Understand what data is collected and how it's used
• Know how to request your data or delete your account
• Be cautious about what you share in written messages

Red Flags in Telehealth Privacy

Be cautious of services that:

• Don't clearly state HIPAA compliance
• Have vague or missing privacy policies
• Sell or share data with third parties for marketing
• Don't use encrypted communications
• Use regular video chat tools (Zoom, Skype) without HIPAA configurations
• Don't allow you to access or delete your data
• Have a history of data breaches without proper notification

Apps and Wellness Tools: Different Rules

Important distinction: Not all health-related apps are covered by HIPAA.

• HIPAA-covered: Services provided by healthcare providers or health plans
• Not HIPAA-covered: Many wellness apps, fitness trackers, meditation apps

Apps like Calm, Headspace, and general wellness tools may not be bound by HIPAA. Review their privacy policies carefully to understand how your data is used.

State Privacy Laws

Some states have additional telehealth and health privacy protections:

• California: CCPA/CPRA provides additional data rights
• Other states: Various laws may provide extra protections

See our guide: Telehealth Laws by State

What to Do If Your Privacy Is Violated

1. Document the issue: Note what happened and when
2. Contact the provider: Report the concern to the telehealth service
3. File a complaint: Report to the HHS Office for Civil Rights (OCR)
4. Contact your state: State attorneys general may also investigate
5. Consider legal advice: For serious violations, consult an attorney

Questions to Ask About Privacy

Before using a telehealth service, consider asking:

• Is this platform HIPAA-compliant?
• How is my data encrypted and stored?
• Who has access to my health information?
• Is any data shared with third parties?
• Are sessions recorded? If so, how are recordings stored?
• How can I access or delete my data?
• What happens to my data if I cancel my account?

Related Guides

• HIPAA & Your Privacy in Telehealth
• Telehealth Laws by State
• Telehealth Technology Setup Guide
• How to Choose an Online Therapy Platform

Important Reminder