HIPAA Compliant Telehealth Platforms: Compliance Checklist for Clinical Teams

HIPAA compliant telehealth platforms are services that can support a HIPAA-regulated video or remote-care workflow—but choosing a product is not the same as approving the way a clinic uses it. Evaluate the exact account, business associate agreement (BAA), enabled services, access controls and information flow. A secure video connection does not answer who can enter the visit, where a transcript goes, or what happens when an employee leaves.

This guide compares three platforms by patient entry, interpreter workflow, administration and published price, then gives clinical teams an evidence checklist and seven synthetic acceptance tests. Its focus is platform selection and launch controls, rather than a ranking of call quality or a library of patient forms. For multi-form routing, use the HIPAA forms and governance guide.

Legal and vendor sources checked September 15, 2026. This is compliance-support information, not legal advice or a certification. Vendor statements below are documentation-based, not independently audited product results. Sam Ellis is a Vero contributor; this version has not received separate privacy/security specialist review. Vero publishes this guide and sells AI documentation software. See our editorial policy.

What a HIPAA claim does and does not establish

For the U.S. scope checked September 15, 2026, HHS telehealth guidance says covered providers and health plans must use compliant technology vendors that will enter into appropriate BAAs for their telehealth services. Start with the organization’s role and the service being purchased, not a logo on a pricing page.

There are three different questions:

1. Contract: Does the agreement cover this organization and the services receiving protected health information (PHI)?
2. Configuration: Are the relevant controls enabled and governed in the actual account?
3. Operation: Can staff use that configuration correctly during routine visits, exceptions and failures?

A “yes” to one does not answer the others. A vendor may offer a BAA while the clinic is using an unrelated personal account. A contract may cover video meetings while an external note-taking bot receives the audio under different terms. A well-configured room can still admit the wrong person if staff rely only on a familiar display name.

As checked September 15, 2026, HHS OCR’s certification FAQ states that private Security Rule certifications do not replace legal obligations and are not recognized or endorsed by HHS. A security assessment can be useful evidence; it is not an official pass for every clinical use.

HIPAA is not the only possible privacy framework

Not every consumer health service operates as a HIPAA covered entity or business associate. The FTC’s consumer health information guidance, checked September 15, 2026, explains that the Health Breach Notification Rule applies to specified non-HIPAA categories, including vendors of personal health records, related entities and third-party service providers. The FTC also warns against misleading HIPAA claims. Do not translate “not covered by HIPAA” into “unregulated,” or assume the FTC rule applies identically to every health business.

The clinic’s privacy lead should identify the applicable framework before evaluating incident terms. State laws, professional obligations and the kind of information involved may require additional review. This guide does not determine telehealth licensure, prescribing authority, reimbursement or the clinical suitability of a particular encounter.

Compare three documented platform routes

These examples were selected to show different purchasing situations: an individual-provider telehealth service, a paid meeting-platform route and an organization-managed productivity suite. This is not a best-to-worst ranking. No calls, security controls or patient workflows were tested in these products for this article. “Potential fit” is an editorial starting point, not an observed performance finding.

Sources for the comparison: doxy.me BAA instructions, Zoom BAA documentation, Google Workspace HIPAA guidance and included functionality. All four were checked September 15, 2026. The doxy.me BAA article uses Professional/Clinic labels, while its current pricing page uses Free/Premium. Ask the vendor to reconcile the agreement with the account being purchased; do not transfer legacy plan prices or entitlements to Premium.

Which plan supports the proposed visit?

The following is a documentation comparison checked September 15, 2026, not a record of executed tests. “Not verified” identifies an evidence gap in this assessment, not proof that a capability does not exist. Prices and billing commitments appear in the cost comparison.

On a narrow screen, swipe the table sideways; keyboard users can focus it and use the arrow keys.

Capability sources: doxy.me patient joining, Premium features and Record app; Zoom joining, Waiting Room controls, Language Interpretation requirements, plan features and Epic FHIR integration; Google guest joining, edition comparison and recording requirements.

Selection implication: for an interpreter visit with a shared clinic queue, evaluate doxy.me Premium rather than assuming Free is equivalent. For managed identity through SSO, compare Zoom Business rather than pricing only Pro. For a clinic requiring Google's dedicated waiting room, budget Standard rather than Starter. These are feature-based shortlist decisions; none establishes that the clinic’s configured workflow passes its acceptance tests.

Integration can change the control model. Zoom’s Epic FHIR instructions require the account-level Waiting Room and join-before-host settings to remain unlocked so the integration can configure them. That is a reason to test the integrated admission policy with IT, not to copy a generic meeting configuration into production.

Do not shortlist by “free” alone. An individually suitable arrangement may not supply the organizational ownership, centralized administration or support workflow a multi-provider clinic needs. Conversely, a familiar enterprise suite can still create unnecessary patient friction. Run the same patient-entry and staff-offboarding tests on each candidate rather than assuming the more expensive option wins.

An EHR-native video module can also be worth evaluating if it reduces invitation and record-matching work. Treat that as another candidate, not an automatic approval: verify the named module, contract, permissions and failure path. The EHR integration guide covers handoff and integration evidence in more detail.

Map the visit before selecting software

The following is an original Vero planning map, not an observed clinic deployment. Assign one accountable owner for each handoff; a shared responsibility without a named owner is difficult to test.

1. 1. Schedule and invite. Front desk checks the contact route and sends the approved invitation without unnecessary clinical detail.
2. 2. Admit and identify. The host verifies the intended participant, identifies other people present and applies the clinic’s identity procedure.
3. 3. Establish the setting. The clinician confirms privacy, location and the locally approved fallback process.
4. 4. Conduct the visit. Approved participants join; recording, captions and AI services follow the reviewed configuration.
5. 5. Complete the record. The clinician verifies documentation and the correct destination; front desk or clinical staff own the agreed follow-up.
6. 6. Close and govern. End access, apply the retention schedule, investigate exceptions and remove departed staff.

For an interpreter visit, add the interpreter as an explicit participant with a tested invitation and admission route. Have three staff members rehearse the patient, clinician and interpreter roles. Each should speak a distinct neutral phrase, then confirm that the other two heard it. Test what happens when one participant reconnects or a display name changes. A successful two-person demonstration does not establish three-party usability or reliable translated captions.

For patient preparation, use plain language about joining, privacy and getting help. An adaptable opening is: “Before we begin, can we check who is here and whether you can speak privately? If the connection stops, we will use [approved callback or rescheduling process]. Our recording and note-taking setup is [verified explanation].” Have the clinic approve the wording and any consent process locally; do not substitute this brief example for jurisdiction-specific requirements.

Plan a fallback without assuming every telephone service is equivalent

HHS OCR’s audio-only guidance, checked September 15, 2026, permits audio-only care consistent with the applicable HIPAA rules. It distinguishes a telecommunications provider acting merely as a conduit from applications that also store or process PHI. Its identity and privacy guidance also matters when video is unavailable. Review the actual telephone or app route rather than assuming every fallback requires—or never requires—a BAA.

Operationally, specify who calls whom, which number is verified, where the incomplete encounter is recorded and when the clinician chooses another mode of care. Include accessibility needs in that rehearsal. “Try again later” is not a complete recovery procedure if nobody owns the follow-up.

The pre-launch compliance checklist

This is Vero’s editorial procurement checklist, not a validated assessment instrument or a legal determination. Use “evidence accepted,” “unresolved” or “not applicable with rationale” for each item in your approved internal evaluation record. A missing contract or unresolved unauthorized-access path should not disappear into an average score.

The legal foundation checked September 15, 2026 is HHS OCR’s risk-analysis guidance, which calls for identifying and assessing risks to electronic PHI, and HHS business associate contract guidance, which describes permitted uses, safeguards, incident reporting, subcontractors and return or destruction at termination where feasible. The practical evidence requests below are our synthesis of those concerns for telehealth purchasing.

Ask for answers that name the service and configuration. “Encrypted” without specifying which information, when and under whose control is incomplete purchasing evidence. Likewise, “we can export” does not establish that the exported record is usable or that access remains available at contract termination. Save the vendor response and the actual test artifact as different evidence types.

Run seven synthetic acceptance tests

Protocol TEL-ACCEPT v1.1, prepared September 15, 2026. This is a proposed procedure; no platform execution or results are claimed. Use staff-controlled test accounts and fictional appointment identifiers. Record product, plan, available version, test date, browser, operating system, device, role and configuration before starting. Repeat the suite on each required patient device and after material setting changes.

For every case, record the action, observed result, expected result, evidence reference, unresolved issue and owner. “Not tested” remains distinct from “passed.” These seven cases are an initial workflow screen, not a penetration test or a complete security assessment. No approved test account or execution artifacts were available for this edition; all vendor-specific outcomes remain not tested. Viewing a vendor’s public website is source verification, not a staff-only product trial.

T-01: forwarded invitation

Create fictional appointment DEMO-A for the staff member playing the patient. Forward its link to a second staff test account named “Unexpected guest.” Attempt entry before and during the visit. Expected: the approved admission process prevents that guest from receiving clinical-session content without appropriate verification. Record both software behavior and any manual host action; do not claim the system blocked entry if only a vigilant operator did.

T-02: back-to-back appointments

Use DEMO-A and DEMO-B with different staff participants. End A, begin B, and have A attempt to reconnect through the old invitation. Expected: A cannot see or hear B, including in any waiting-room or chat view. Inspect lingering files and messages as well as live audio. A reusable room needs a demonstrated separation procedure, not just a convenient link.

T-03: recording and an unapproved assistant

In the proposed baseline configuration, attempt to start recording as a host and as an ordinary participant. Attempt to admit a staff-controlled test assistant only if your organization permits that synthetic test. Expected: permissions match the approved policy; an unapproved service does not receive encounter information. Record which controls are enforced centrally and which depend on user behavior. Never introduce an unknown third party merely to complete this exercise.

T-04: interpreter and reconnection

Three staff members play patient, clinician and interpreter. Use the phrases “blue folder,” “green cup” and “yellow notebook” to verify all audio paths. Disconnect and rejoin the interpreter. Expected: the intended participants are identifiable, the audio path recovers and staff can explain who remains in the room. This English-language connectivity exercise does not validate translation accuracy or clinical language support.

T-05: disconnected visit

Interrupt the test patient’s connection during a neutral conversation. Run the approved callback or rescheduling procedure. Expected: staff know the contact route, record the incomplete visit and assign follow-up. Measure recovery time separately from successful visit time. Do not enter a real patient number into the rehearsal.

T-06: staff departure and export

Remove a dedicated test staff member through the approved administrative route. Attempt access through an existing session and a fresh login. Export a fictional record using a remaining authorized account. Expected: former staff access ends as specified, while the authorized team can still retrieve the intended record. Record any session-revocation delay, export omissions or support dependency.

T-07: accessible patient entry and visit controls

Choose the clinic’s supported device/browser and record the screen reader and version, if used. Have one staff member play a first-time patient using only the invitation and patient instructions; another hosts the visit. Run these tasks separately so a successful mouse-based call does not mask a keyboard barrier:

1. Unassisted entry: open the invitation, resolve camera/microphone prompts and request admission. Record time, confusing instructions and every staff intervention. A staff rehearsal does not measure usability in the actual patient population.
2. Keyboard-only route: use Tab, Shift+Tab, Enter and the documented shortcuts to join, mute, unmute, find captions and leave. Check visible focus, logical order and escape from dialogs.
3. Screen-reader route: confirm the invitation, waiting state, admission, participant list and microphone state are announced. Record unlabeled controls or missing state changes, not merely whether the page loads.
4. Readable layout: repeat key actions at 200% browser zoom and on the supported phone. Check whether captions obscure controls or controls disappear off-screen.
5. Caption content: have staff read “The demo appointment is at fifteen forty-five, not fourteen forty-five” and “The blue folder belongs to Morgan.” Compare displayed time, negation and speaker attribution with the script. Repeat in each supported clinical language with qualified language support; one English sentence validates neither clinical interpretation nor caption accuracy generally.
6. Recovery and help: reconnect, find the help route and complete the approved alternative when a required control is inaccessible.

Expected: the chosen entry and essential controls work through the required access method, or the clinic documents the barrier, owner and usable alternative before approval. Save synthetic-only screenshots of configuration, waiting state and captions with the observed result. Set any timing target before the trial; do not invent a universal accessibility pass time or claim WCAG conformance from these tasks.

Example completed record: T-02 room separation

Illustrative result only: this is a fictional evaluation record, not a finding about any listed vendor.

Product/version: none. Execution date: not run. Scenario: reusable room; DEMO-A reconnects after DEMO-B starts.

Invented observation: A entered the active room before the host noticed. Decision: unresolved admission failure; do not approve this configuration for the proposed workflow.

Owner and next action: IT and clinical operations revise the entry controls, document the expected behavior and rerun T-01 and T-02. No pass is recorded until a real synthetic retest supplies evidence.

Accessibility evidence and the patient-entry test

Documentation checked September 15, 2026 supplies starting points for T-07, not a comparative accessibility score:

• doxy.me Premium: its closed-caption instructions document English captions on desktop and mobile. Each person enables their own captions; a provider cannot enable them for the patient. The vendor says these captions are not stored. A current keyboard/screen-reader conformance report was not verified for this assessment—request one and test entry and caption activation rather than treating captions as complete accessibility support.
• Zoom: its accessibility documentation describes keyboard controls, screen-reader support and adjustable caption/chat text. Its plan table lists automated captions on Pro; translated captions are a separate entitlement. Verify the exact client and approved settings with the patient-role tester, including finding captions after browser-based admission.
• Google Meet: its screen-reader guide recommends Chrome with NVDA or JAWS on Windows, ChromeVox on ChromeOS, or VoiceOver on macOS. Its keyboard reference includes caption controls and announcements of the speaker and room information. Test the anonymous guest journey as well as the signed-in staff journey; they are not interchangeable.

An interpreter participant, automated captions and translated captions solve different problems. T-04 checks who can hear whom; T-07 checks access to the interface and a small caption sample. Neither is a substitute for evaluating qualified interpretation or the accommodations required by the clinic’s patients.

Recording, AI and retention need separate decisions

Start the evaluation with the functions the visit actually needs. A clinic can choose a proposed baseline with recording and external assistants disabled, then review additional functions individually. That is an editorial risk-reduction approach, not a claim that HIPAA universally forbids recording or AI.

For each extra feature, ask: what information is collected, who receives it, whether it is retained, what secondary uses are permitted, who can retrieve it and how the patient is informed. Treat live captions, stored transcripts, meeting summaries and a full recording as different information flows. A switch labelled “off” in one account may not govern an extension installed by another participant.

As checked September 15, 2026, HHS cloud-computing guidance explains that a cloud provider maintaining electronic PHI can be a business associate even when it cannot decrypt that information. Encryption does not erase the contract and risk-review questions. Apply that distinction when evaluating storage or processing outside the video platform.

Do not promise that deleting a visible file instantly removes backups, transcripts, exports and support copies. Ask for the retention schedule by data type and the contractual handling of termination. Keep clinically necessary records available under the applicable records policy before retiring a service. The medical-records release guide addresses access and release workflows separately.

An AI scribe is a separate approval decision

Vero is the publisher of this article and offers AI scribe software. This platform comparison does not establish that Vero integrates with any named telehealth service or that a particular audio-capture setup is approved. Evaluate documentation tooling on its own agreement, capture route, permissions and clinician-review process. The ambient scribe guide provides fictional tests for speaker attribution, missing audio and capture boundaries.

Canadian clinics need a separate jurisdiction check

The vendor comparison above centers on U.S. HIPAA contract routes. A BAA is not a finding of Canadian compliance. As checked September 15, 2026, the Office of the Privacy Commissioner’s overview explains that applicable Canadian privacy law depends on factors including organization type, location, information and cross-border flows. PIPEDA and provincial frameworks should not be treated as interchangeable labels.

For an Ontario physician practice, the CPSO Virtual Care policy, checked September 15, 2026, addresses patient identification, privacy, participant disclosure, fit-for-purpose technology and informed consent for virtual care. It also requires action when the encounter becomes unsuitable or technology compromises care. These are Ontario professional requirements, not a universal North American checklist.

For Canadian procurement, add the relevant province, custodian or organizational role, service-provider terms, processing/support locations, patient explanation and records-access arrangements to the evidence record. Ask the local privacy lead to assess the actual information flow. Neither a Canadian storage location alone nor a U.S. healthcare marketing page answers every applicable obligation.

Compare cost and make a scoped launch decision

Published entry prices and workflow upgrades

Public prices checked September 15, 2026; not negotiated quotes. Currency is explicit: doxy.me rendered a Canadian-dollar price in our locale, while Zoom was checked with USD selected and Google’s billing reference states USD. These are not currency-converted or like-for-like totals. Taxes, add-ons and implementation are excluded; confirm the order form before purchase.

Pricing sources: doxy.me pricing, Zoom Workplace pricing, Google Flexible versus Annual/Fixed-Term billing and Google Business edition limits. Google’s cited billing table supplies regular rates rather than introductory promotions. Obtain a quote where the required organization contract or deployment differs from these public plans.

Compare the cost of the approved workflow, not the cheapest advertised seat. Use the same period and included services for each quote. Separate recurring subscriptions from setup, training, support, integration and exit work. Count shared administrative effort explicitly rather than hiding it in a provider-seat price.

A simple planning calculation is:

First-year cost = 12 × monthly licensed-service cost + setup + training + integration + incremental administration.

For example, a fictional clinic budgeting $120 a month for all required services, $600 for setup and training, and two additional administrative hours monthly at $35 an hour would estimate $2,880 for year one: $1,440 + $600 + $840. These are invented planning inputs, not vendor prices, a measured clinic result or predicted savings. Taxes, equipment, clinical time, integration and exit costs would need to be added if applicable.

Review appointment completion, patient support requests, access exceptions, recovery work and record-handoff errors alongside cost. A cheaper platform that increases staff troubleshooting may not be cheaper in use. Equally, additional features are not valuable if they create data flows the clinic cannot govern.

The final decision should name the approved organization, plan, services, configuration, visit types, devices, owners and unresolved exclusions. For example: approve a tested one-to-one video workflow, but defer recording and external assistants until their separate review is complete. Reassess after a contract, enabled feature, identity system, integration or material workflow change. A recurring internal review date is useful only when a real owner accepts it; this article does not create that operating process for the clinic.

The most defensible purchase is the one the team can explain and reproduce: the right contract, a tested configuration, an accessible patient pathway, a reliable record handoff and a clear response when something goes wrong.