A HIPAA Compliance Guide for Telehealth Kiosk Operators

A shared telehealth kiosk can connect patients with care, but it also places screens, microphones, cameras, software, and networks in a setting where other people may be nearby. If the kiosk creates, receives, maintains, or transmits protected health information (PHI), the people and organizations responsible for it need safeguards that address how information is viewed, heard, accessed, stored, and cleared between sessions.

HIPAA obligations depend on the role an organization plays—not simply on whether it owns or hosts a kiosk. Covered entities and business associates that handle electronic protected health information (ePHI) must apply appropriate safeguards under the HIPAA Security Rule. The following guide explains practical issues to assess with your healthcare partners, technology vendors, and privacy and security teams.

What HIPAA risks do shared telehealth kiosks create?

A shared kiosk can expose PHI in ways that a private workstation may not. Someone nearby might see a patient’s name, appointment details, or medical record on the screen, or overhear a conversation through speakers or an open microphone. A camera may also capture other people in the space if it is poorly positioned.

Digital traces can remain after a visit, too. A browser session, downloaded document, saved password, open patient portal, cached page, clipboard entry, or print job could make information available to the next user. Risk can also arise if a lost or tampered-with device, outdated software, weak network security, or overly broad staff access compromises ePHI.

Think about the entire visit—not just the video connection. Consider check-in, identity verification, waiting screens, clinical conversations, document exchange, session termination, cleaning and maintenance, and incident reporting. HHS notes that telehealth technology can create privacy and security risks, while the Security Rule requires safeguards for electronic information systems wherever they are housed.

How can operators protect patient privacy during kiosk sessions?

Choose a location and layout that reduce the chance of someone seeing or hearing a visit without authorization. Where feasible, use an enclosed or screened area, position the display away from public sightlines, and consider a privacy screen. Use headphones or a privacy handset where appropriate, and check that the kiosk’s microphone and speakers do not broadcast conversations into a waiting area.

Explain the privacy options to patients before the session begins. Let them know whether the visit is recorded and, if recording is contemplated, follow the healthcare provider’s applicable consent and documentation procedures. Avoid recording unless it is needed for the care process and handled under the provider’s policies. HHS’s telehealth privacy and security guidance recommends considering privacy, consent, secure transmission, and the physical setting when planning telehealth visits.

Limit unnecessary information on public-facing screens. Use a neutral waiting display, avoid exposing patient names or visit details to bystanders, and provide a way for patients to request assistance discreetly. Make sure staff know how to respond if a patient reports being overheard, observed, or unable to use the kiosk privately.

Which access controls and session settings should kiosks use?

Set up access so each user or staff member can reach only the information and functions needed for their role. Staff should use individual accounts rather than shared credentials wherever the system supports them; assign appropriate permissions, promptly remove access when duties change or end, and review privileges periodically. The Security Rule includes technical access-control requirements, and HHS explains that access to ePHI must be limited to appropriately authorized people and software.

Configure automatic logoff to end an unattended session after an inactivity period suited to the kiosk’s use and risk. Automatic logoff is an addressable implementation specification, not a universal fixed-time setting: the regulated organization must assess whether it is reasonable and appropriate in its environment. If it is not, the organization must document its decision and follow the applicable Security Rule requirements for alternatives. See HHS’s guidance on access control and automatic logoff.

Configure each patient visit as a separate session. After a session ends or times out, return the kiosk to a neutral start screen and clear or securely isolate session data, including browser state and temporary files, so the next user cannot reopen the prior visit. Disable browser features that would expose saved credentials or allow access to unrelated sites, and control downloads, printing, clipboard use, and removable media according to documented policy.

Keep audit records that help authorized personnel review relevant system activity, and protect those records from inappropriate alteration or access. Apply authentication and session settings consistently across the kiosk, telehealth application, and connected systems. Test the full sign-out and reset process between sessions rather than assuming a visible return to the home screen has cleared all information.

How should a HIPAA security risk analysis cover kiosk technology?

For a covered entity or business associate, the security risk analysis should include the kiosk and the systems, locations, people, and vendors connected to it. Inventory the devices and applications that create, receive, maintain, or transmit ePHI, and map how information moves during check-in, the visit, support, storage, and disposal. Include the kiosk’s operating system, browser, camera, microphone, network connection, remote-management tools, and any connected printers or peripherals.

Assess plausible threats and vulnerabilities in context. These may include shoulder-surfing, overheard conversations, unattended sessions, theft, tampering, unauthorized remote support, misdirected messages, malware, or retained local data. Evaluate the potential effect on the confidentiality, integrity, and availability of ePHI, how likely each risk is, and what safeguards already exist.

Document the analysis, decisions, and risk-management steps. Assign owners and deadlines for remediation, then revisit the assessment when the kiosk, software, workflow, location, vendor relationship, or threat environment changes. HHS describes risk analysis as an assessment of risks and vulnerabilities to ePHI and says it should be an ongoing process; the Security Rule does not prescribe one universal schedule for repeating it. See HHS guidance on HIPAA security risk analysis and its explanation of risk analysis and risk management.

What safeguards protect telehealth devices and electronic health information?

Use administrative, physical, and technical safeguards that fit the kiosk’s specific risks. Physical measures might include a secure mounting, controlled access to ports, appropriate placement, privacy screens, and a process for reporting damage or suspected tampering. Establish rules for who may inspect, move, repair, or remove the device and for handling media that may contain ePHI.

Keep software and security protections maintained, restrict remote administration to authorized personnel, and secure the kiosk’s network connection. Use encryption for stored or transmitted ePHI when the Security Rule’s addressable specification is reasonable and appropriate; if it is not, document the decision and apply the measures required by the rule. HHS clarifies that “addressable” does not simply mean optional: regulated entities must assess the specification, document their decision, and implement an appropriate alternative when required. See HHS guidance on encryption under the Security Rule.

Prepare for service interruptions and security incidents. Define how staff should respond to suspected exposure, device loss, malware, or a kiosk that fails to clear a session; preserve relevant evidence and report the event through the organization’s established channels. Covered entities and business associates should coordinate incident handling so the responsible parties can assess the event and meet applicable obligations.

The HIPAA Security Rule’s physical safeguards cover facility access, workstation use and security, and device and media controls. HHS explains that these safeguards apply to electronic information systems whether they are located on the covered entity’s premises or elsewhere. See HHS’s overview of physical safeguards.

When do telehealth kiosk vendors qualify as business associates?

A vendor may qualify as a business associate when it performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. For example, a vendor that hosts ePHI, provides remote support requiring access to patient information, or manages a telehealth system that handles ePHI may fall within the definition. The relationship depends on what the vendor actually does and what information it can access—not just on the vendor’s label or contract title.

When a business associate relationship exists, the covered entity generally needs a written business associate agreement (BAA) that provides the required assurances and describes applicable responsibilities. Business associates may also need written agreements with subcontractors that handle ePHI on their behalf. Conversely, merely selling software without access to PHI does not by itself make the software vendor a business associate, according to HHS.

A kiosk operator is not automatically a business associate simply because it owns the kiosk or provides a location. Determine whether it handles PHI or provides a service involving PHI on behalf of a covered entity, and document the parties’ roles, permitted uses and disclosures, safeguards, incident reporting, and subcontractor responsibilities as appropriate. HHS provides more detail in its Business Associates guidance and its FAQ on software vendors.

What training and operational procedures should kiosk staff follow?

Train staff on the organization’s own privacy and security policies and on the tasks they are authorized to perform. Relevant procedures may cover helping patients start and end sessions, protecting screens and conversations, avoiding access to records without a work-related need, verifying identity according to provider instructions, and contacting the right person when a problem arises.

Include practical steps for resetting the kiosk between patients, checking that sessions have ended, protecting printed documents, and keeping unauthorized people away from device controls. Staff should know how to report suspected disclosures, lost devices, unusual system behavior, and attempted tampering. Keep a documented process for maintenance and remote support that limits access to what is necessary and ensures support activity is handled under the organization’s security procedures.

HIPAA requires workforce training as necessary and appropriate to carry out job functions, but it does not establish one universal federal annual training-certificate renewal requirement. Organizations should follow applicable employer policies, training plans, and any other requirements that apply to them. Training completion is not, by itself, proof that an organization or kiosk is HIPAA compliant. HHS describes workforce training in its Summary of the HIPAA Privacy Rule.

In practice, a safer kiosk program combines private placement, carefully limited access, dependable session reset, physical and technical safeguards, a documented risk analysis, clear vendor agreements where required, and staff who know how to follow local procedures. Review those controls together and update them when the kiosk or its use changes.

FAQs.

Do telehealth kiosk operators need a business associate agreement?

Not automatically. A BAA is generally needed when the operator or vendor qualifies as a business associate by providing services on behalf of a covered entity that involve PHI. Whether that applies depends on the actual service and access to information. An operator that only supplies a location or sells software without access to PHI may not be a business associate for that reason alone. Have the covered entity assess the relationship and document the decision.

How can a kiosk prevent the next user from viewing a patient’s information?

End the prior patient’s application and browser session, clear or securely isolate temporary data, remove access to saved credentials, and return the kiosk to a neutral start screen. Configure automatic logoff based on the kiosk’s risk and workflow, then test the reset process between visits to confirm that screens, files, and connected applications do not reveal the previous session.

What security safeguards should a telehealth kiosk use?

Use safeguards appropriate to the environment, such as controlled staff access, role-based permissions, individual staff accounts where feasible, session timeouts, audit records, secure network connections, software maintenance, and protection against unauthorized physical access. Reduce the chance of others seeing screens or hearing conversations, and establish secure procedures for device maintenance, incident reporting, and handling any media that contains ePHI.

What should a HIPAA security risk analysis include for a telehealth kiosk?

Include the kiosk, its software and peripherals, its physical location, connected systems and networks, vendors, staff workflows, and each point where ePHI is created, received, maintained, or transmitted. Identify relevant threats and vulnerabilities, assess their likelihood and potential impact on ePHI, evaluate existing safeguards, and document risk-management actions. Review the analysis when significant changes or new risks arise.