HIPAA Compliance Guide for Virtual-First Health Plans

A virtual-first model changes how a health plan enrolls members, coordinates care, and communicates with patients—but it does not, by itself, change the plan’s HIPAA obligations. The key questions are which entity is handling protected health information (PHI), what role it plays, and whether each system and vendor protects that information appropriately.

Which HIPAA rules apply to virtual-first health plans?

A health plan that meets HIPAA’s definition of a covered entity must comply with the HIPAA Privacy, Security, and Breach Notification Rules. A plan does not become exempt by offering services through a website, app, or virtual care network. HHS lists health plans among the entities covered by the Privacy Rule, including when they contract with others to perform plan functions. See HHS guidance on who must comply with HIPAA.

Covered entity obligations depend on each organization’s role. A health plan is covered; an employer that sponsors a plan is not automatically a covered entity simply because it sponsors or administers employee benefits. Health care providers in the virtual-care network may also be covered entities if they meet HIPAA’s definition, including by conducting certain covered transactions electronically.

HIPAA applies to PHI that a covered entity creates or receives in connection with health care, including plan enrollment, claims, care coordination, and member communications. The Security Rule specifically protects electronic protected health information (ePHI) created, received, maintained, or transmitted by a covered entity or business associate. HHS describes the scope of the HIPAA Security Rule.

Not every app or company that handles health-related information is covered by HIPAA. A vendor’s status depends on what it does and on whose behalf. Consumer-facing services outside a covered entity or business associate relationship may instead fall under other laws, including state consumer health data laws or, in some cases, the FTC’s Health Breach Notification Rule.

How do the Privacy Rule and Security Rule protect health information?

The Privacy Rule sets limits and conditions on how covered entities and business associates may use and disclose PHI. It also gives individuals rights over their information. For many uses and disclosures, the rule generally requires covered entities to limit PHI to the minimum necessary for the purpose, subject to exceptions such as disclosures to a provider for treatment. See HHS’s summary of the HIPAA Privacy Rule.

The Security Rule focuses on ePHI. It requires administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of that information. A plan must conduct an accurate and thorough risk analysis, address identified risks, and keep its security policies and procedures current as its systems, vendors, and operations change. HHS explains the Security Rule risk-analysis requirement.

These rules work together. For example, privacy policies determine which workforce members may access member information for their duties, while technical and administrative safeguards help enforce and monitor that access. For a virtual-first plan, the risk analysis should include its member portal, telehealth workflows, messaging tools, claims systems, cloud services, remote-work environment, and vendor connections.

What security features should telehealth platforms support?

HIPAA does not certify a particular telehealth product or require every platform to use an identical set of technologies. The plan must assess risks in its own environment and choose safeguards that are reasonable and appropriate. That means evaluating the whole system—including configuration, user practices, integrations, and vendor operations—not relying on a product label alone.

For a platform that handles PHI, assess whether it can support safeguards such as:

• Individual user accounts, role-based access, and procedures for removing access when a user no longer needs it.
• Audit logs that help the plan review access to ePHI and investigate suspicious activity.
• Secure transmission and storage controls, with encryption considered as part of the risk assessment.
• Controls to protect the integrity of information, such as detecting unauthorized changes.
• Secure authentication, session management, and appropriate safeguards for remote access and devices.
• Backup, recovery, and incident-response support that helps maintain access to information and address security events.
• Data-retention, deletion, and export processes that support the plan’s policies and contractual obligations.

These are practical evaluation points, not a standalone checklist that guarantees compliance. For example, encryption is an addressable implementation specification under the Security Rule, not an unconditional requirement in every circumstance. The organization must assess whether encryption is reasonable and appropriate; if not, it must document its decision and follow the rule’s requirements for alternatives. See HHS guidance on encryption under the Security Rule.

HHS states that covered health plans and providers must use telehealth technology vendors that comply with HIPAA when the vendors handle PHI for them. A plan should confirm the vendor’s role, safeguards, incident-reporting process, and ability to sign a business associate agreement (BAA) when required. See HHS guidance on HIPAA and telehealth technology.

How should health plans assess vendors and business associate agreements?

Start by mapping which vendors create, receive, maintain, or transmit PHI on the plan’s behalf. A vendor that performs a plan function involving PHI will generally be a business associate, as may a subcontractor handling that information for the vendor. The plan should document the services, data involved, access pathways, and downstream subcontractors before the service goes live.

When a vendor is a business associate, the plan generally needs a written BAA. The agreement should define permitted and required uses of PHI, require appropriate safeguards, require reporting of impermissible uses or disclosures and breaches, address subcontractors, support individual-rights obligations where relevant, and establish what happens to PHI when the agreement ends. HHS provides sample BAA provisions and required contract terms.

A BAA is necessary but not sufficient. Assess the vendor’s security controls, incident response, access management, data-location and retention practices, service continuity, and subcontractor oversight. Keep a record of the plan’s review and reassess vendors when services, integrations, or risks change.

There are limited cases in which a vendor is not a business associate. For example, HHS explains that a telecommunications provider acting only as a conduit, with transient access to PHI, may not require a BAA. Do not assume that every communications or technology provider qualifies for this exception; assess the actual service and data handling. See HHS guidance on remote communication technologies for telehealth.

What privacy policies, patient consent practices, and staff training are needed?

A covered health plan needs privacy policies and procedures suited to its operations. These should explain permitted uses and disclosures, role-based workforce access, minimum-necessary practices where applicable, member requests, complaints, incident escalation, and how the plan oversees business associates. The Privacy Rule also requires workforce training appropriate to members’ functions and the plan’s procedures, along with appropriate sanctions for violations. HHS summarizes these duties in its Privacy Rule guidance.

Health plans must provide a Notice of Privacy Practices that explains how the plan may use and disclose PHI and describes individuals’ privacy rights. A health plan generally provides the notice at enrollment and must remind enrollees at least once every three years that they can request a copy. An acknowledgment of receipt is not the same as permission to use information for a special purpose. See HHS information about the Notice of Privacy Practices.

HIPAA does not require an individual’s authorization for every use or disclosure. The Privacy Rule generally permits covered entities to use or disclose PHI for treatment, payment, and health care operations, subject to the rule’s requirements. Other purposes may require a valid authorization, and state law or specific program requirements may impose additional consent rules. Make any consent or authorization request specific and separate from a general privacy notice when the law requires that distinction.

Training should reflect the tasks people perform—not just the fact that the organization works in health care. Train staff on topics such as identity verification, secure messaging, avoiding unintended disclosures during virtual visits, handling records in shared workspaces, reporting suspected incidents, and following plan-specific procedures. HIPAA requires appropriate workforce training; it does not establish a universal annual certificate-renewal requirement.

What patient rights and breach reporting duties apply?

Under HIPAA, individuals generally have rights to access and obtain copies of their records, request amendments, receive a Notice of Privacy Practices, and request certain restrictions or confidential communications. The plan should provide clear instructions for making requests and coordinate with vendors that hold information needed to fulfill them. HHS summarizes these rights in its HIPAA rights guidance.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through the required risk assessment, or another exception applies. The plan should have a documented process to investigate incidents, assess whether notification is required, mitigate harm, and preserve the decision record.

For a breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. It must notify HHS within that period for breaches affecting 500 or more individuals; breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, although the BAA may set a shorter deadline. See the HHS Breach Notification Rule.

HIPAA notification duties are not necessarily the only ones that apply. State breach-notification laws or other federal rules may add requirements, depending on the organization, data, and incident. A health plan should have a response process that routes incidents for legal and compliance review rather than assuming that one notification timeline covers every law.

When do state privacy laws add requirements beyond HIPAA?

HIPAA is not a complete substitute for state privacy-law analysis. State laws may provide additional protections or rights, and some laws cover consumer health information held by entities that are not HIPAA covered entities or business associates. The rules may also differ according to the data, the organization’s role, and the state’s connection to the person or activity.

HIPAA generally sets a federal floor. A contrary state privacy law that provides greater privacy protections or rights may not be preempted; where both laws apply and can be followed together, an organization may need to comply with both. HHS explains the relationship in its guidance on HIPAA and state-law preemption.

For example, Washington’s My Health My Data Act addresses certain consumer health data outside HIPAA’s PHI protections and imposes obligations on regulated entities within its scope. The statute also contains exemptions, including for information that qualifies as HIPAA PHI, so assess the specific data and entity rather than assuming the law applies uniformly. See Washington’s My Health My Data Act.

For virtual-first plans, map applicable state requirements across member locations, provider and vendor operations, and data flows. Review privacy notices, consent and authorization language, retention practices, and breach-response timelines against those requirements. In short, a sound compliance program combines HIPAA safeguards with a documented assessment of vendor roles, state-law obligations, and the plan’s actual virtual-care workflows.

FAQs

Are virtual-first health plans covered entities under HIPAA?

A health plan that meets HIPAA’s definition of a health plan is a covered entity, whether it operates primarily online or through in-person services. Its virtual-first model does not remove its HIPAA duties. See HHS guidance on covered entities.

Do telehealth vendors need a business associate agreement?

A vendor generally needs a BAA when it handles PHI on behalf of a covered health plan or provider as a business associate. A limited conduit exception may apply to a telecommunications provider with only transient access to PHI. Determine the vendor’s actual role and data handling before deciding whether a BAA is required.

What should a HIPAA-compliant telehealth platform support?

It should support the plan’s risk-based safeguards for access, secure communications, logging, data integrity, incident response, and continuity, as appropriate to the system and use. No product label or single feature establishes HIPAA compliance; the covered entity remains responsible for evaluating and implementing safeguards in its environment.

When must a health plan report a breach of unsecured PHI?

The plan must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more individuals, it must also notify HHS within that period; for fewer than 500, it may report to HHS annually, no later than 60 days after the calendar year ends. A breach affecting more than 500 residents of a state or jurisdiction also requires media notice. State law may add separate requirements.