HIPAA Compliance for Addiction Medicine Telehealth: Key Requirements

Telehealth can make addiction medicine easier to access, but the privacy rules do not stop at the video call. Providers must protect protected health information (PHI), assess electronic security risks, and determine whether 42 CFR Part 2 adds confidentiality requirements for substance use disorder records.

Your telehealth workflow should account for the platform, staff devices, the patient’s setting, third-party vendors, consent, and any records created during a visit. Federal requirements may also intersect with state privacy, recording, professional licensing, and telehealth-consent laws.

What HIPAA protections apply to addiction medicine telehealth?

HIPAA applies to covered entities—such as many health care providers that conduct certain electronic transactions—and their business associates. The Privacy Rule governs uses and disclosures of PHI, while the Security Rule requires reasonable and appropriate safeguards for electronic PHI (ePHI). These protections apply to telehealth just as they do to in-person care; using a virtual platform does not remove them. See the HHS Summary of the HIPAA Security Rule.

For addiction medicine, this can include information in scheduling systems, intake forms, clinical notes, prescriptions, messages, and billing records. The Privacy Rule generally requires reasonable safeguards against impermissible uses or disclosures. It also applies a minimum-necessary standard to many uses and disclosures, although provider-to-provider disclosures for treatment are exempt from that standard. Review HHS guidance on the minimum necessary requirement.

HIPAA is not the only relevant privacy framework. If your program or records are covered by Part 2, you must also follow its applicable requirements. State law may impose additional protections or consent obligations.

When do 42 CFR Part 2 rules protect substance use disorder records?

Part 2 applies to records of patients in a federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment. Whether a program qualifies depends on the regulatory definitions and the program’s circumstances; providing care to someone with a substance use disorder does not, by itself, settle the question. Some Part 2 requirements also apply to organizations that receive Part 2 records. Consult the current 42 CFR Part 2 regulation and HHS’s Part 2 overview.

Part 2 generally restricts disclosures that identify a person as having or having had a substance use disorder, subject to specified permissions and exceptions. Under the updated rule, a patient may give a single consent for future uses and disclosures for treatment, payment, and health care operations. Recipients that are HIPAA-regulated may then redisclose the information as HIPAA permits, except for using it in legal proceedings against the patient. Part 2 compliance with the 2024 final rule was required by February 16, 2026.

Part 2 also treats SUD counseling notes separately: their use or disclosure requires specific consent, rather than relying on a broad treatment, payment, and health care operations consent. Keep consent language, access controls, and disclosure procedures aligned with the records your program actually creates and holds.

How should providers choose telehealth platforms and manage vendors?

Choose a platform based on its actual handling of PHI, not on a marketing statement that it is “HIPAA compliant.” Assess how the service authenticates users, protects calls and stored information, manages recordings and transcripts, controls vendor access, and supports incident response. Verify that the product and your configuration fit your organization’s workflow and risk analysis.

A vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits PHI on your behalf as a business associate. A vendor that merely transmits information as a conduit, without routine access or persistent storage, may fall outside that definition. HHS explains these distinctions in its audio-only telehealth guidance.

Where a BAA is required, it should define permitted uses and disclosures, safeguards, breach reporting, subcontractor responsibilities, and what happens to PHI when the contract ends. A BAA is not a certification and does not, by itself, make a provider or vendor compliant. Review HHS’s business associate contract provisions. If Part 2 applies, separately assess the rules for the vendor’s access to Part 2 records.

What should a telehealth privacy and security risk analysis cover?

A HIPAA Security Rule risk analysis must be accurate, thorough, documented, and cover risks to the confidentiality, integrity, and availability of ePHI. It should include the systems and data used in telehealth—not only the video platform. Map how information moves among the electronic health record, scheduling and messaging tools, staff devices, patient portals, vendors, and any recording or transcription services.

Identify potential threats and vulnerabilities, estimate their likelihood and impact, and document risk levels and corrective actions. Consider unauthorized access, intercepted communications, lost devices, weak authentication, inappropriate staff access, vendor storage, and how a disruption or data loss could affect care. HHS describes the process in its HIPAA risk analysis guidance.

Use the findings to select and implement safeguards, train staff, and plan for backups and security incidents. Revisit the analysis when your technology, vendors, workflows, or risks change. HIPAA does not set one universal schedule for repeating the analysis; HHS describes it as an ongoing process.

How can providers protect privacy and verify patient identity during visits?

Hold visits from a private location whenever feasible. Ask patients to choose a place where others cannot overhear or view the conversation, use headphones when helpful, and avoid speakerphone in shared spaces. If a private setting is not possible, use reasonable safeguards—such as lowering your voice—and discuss privacy options with the patient. See HHS guidance on where providers can conduct telehealth.

Verify a patient’s identity when they are not already known to the practice. HIPAA does not prescribe one specific method; depending on the situation, staff may use oral, written, or electronic verification. Establish a consistent process, confirm the identity of other participants, and check that the patient agrees to their presence. Make verification accessible, including through appropriate language assistance or disability accommodations when needed. HHS discusses identity verification in its audio-only telehealth guidance.

Before discussing sensitive details, confirm that the patient can speak privately and ask how they would like the practice to contact them afterward. Document relevant privacy preferences and follow your policies for secure messages and other follow-up communications.

Which technical safeguards protect telehealth devices and connections?

Use safeguards appropriate to the ePHI and risks identified in your analysis. Common measures include unique user accounts, strong authentication, role-based access, automatic device locking, timely software updates, endpoint protection, secure backups, and audit logs. Limit access to staff who need it for their roles, and remove access promptly when it is no longer needed.

Protected health information encryption can reduce the risk of unauthorized access during transmission or storage. Under the HIPAA Security Rule, encryption is an addressable implementation specification, not a blanket rule requiring the same technology in every situation. An addressable specification still requires assessment: implement it when reasonable and appropriate, or document why it is not and use an appropriate alternative when one is available. See HHS guidance on addressable Security Rule specifications.

Secure both ends of the visit: practice-managed computers and phones, as well as the systems used to store or send visit data. Explain to patients how to protect their own privacy, such as using a private space and avoiding public Wi-Fi for sensitive conversations. Patients’ personal devices are not automatically subject to HIPAA in the same way as a provider’s systems, but the practice should still take reasonable steps to protect information it handles.

When should providers obtain consent or record a telehealth visit?

Telehealth informed consent requirements vary by state and can depend on the service and patient. Explain what the visit involves, how the patient can ask questions, relevant privacy limitations, and who else may participate. Document consent as required by applicable law and your organization’s policy. HHS recommends explaining expectations and obtaining consent when another person will observe the visit; see its telehealth informed consent guidance.

HIPAA does not generally require providers to record telehealth visits. Avoid recording unless there is a clear clinical or operational need. If you do record, obtain consent in advance as a prudent practice, check applicable state recording laws, restrict access, and set secure storage and retention procedures. HHS advises providers to avoid recording unless necessary and to obtain consent and securely store and transmit recordings if they are made. A recording that contains Part 2 information may also require Part 2 protections; do not treat general telehealth consent as a substitute for any separate consent the rules require, including for SUD counseling notes.

HIPAA permits audio-only telehealth when the applicable Privacy, Security, and Breach Notification Rule requirements are met. Whether a particular visit is covered or reimbursed, and whether it is clinically appropriate, are separate questions from HIPAA permission. See the HHS guidance on audio-only telehealth.

FAQs

Is audio-only telehealth permitted for addiction medicine visits?

HIPAA permits covered providers to use audio-only telehealth when they follow the applicable privacy and security requirements. Coverage, reimbursement, professional practice rules, and clinical appropriateness are separate considerations. See the HHS audio-only telehealth guidance.

When does 42 CFR Part 2 apply to substance use disorder records?

Part 2 generally applies to records maintained in connection with a federally assisted program that provides SUD diagnosis, treatment, or referral for treatment. The program and record must meet the regulatory criteria; some requirements can also apply to organizations that receive Part 2 records. See HHS’s Part 2 overview.

Do telehealth vendors need a business associate agreement?

They generally need a BAA when they create, receive, maintain, or transmit PHI on behalf of a covered entity as a business associate. A vendor acting only as a conduit may not need one. Assess the vendor’s actual services and data handling, and consult the HHS BAA guidance.

Should providers record addiction medicine telehealth visits?

Usually, do not record unless there is a clear need. If you decide to record, obtain consent in advance, check applicable state law, and protect the recording with access controls, secure storage, and appropriate retention procedures. Consider whether Part 2 or other privacy rules apply to the recording.

In practice, addiction medicine telehealth privacy depends on more than the platform: assess HIPAA and Part 2 applicability, manage vendors through appropriate agreements, document ongoing security risks, protect the visit environment and devices, and handle consent and recordings carefully.