HIPAA Compliance Requirements for Store-and-Forward Teledermatology Services

Store-and-forward teledermatology lets a patient or referring clinician submit skin images and related information for a dermatologist to review later. Those images and records may be protected health information (PHI) when they identify a patient and relate to their care. If your practice is a HIPAA covered entity—or provides services as a business associate—you must protect applicable PHI throughout collection, transmission, review, and storage.

HIPAA does not create a separate set of rules just for store-and-forward care. Instead, the Privacy, Security, and Breach Notification Rules apply to the relevant PHI and electronic PHI (ePHI). Your workflow should also account for state telehealth laws, professional requirements, and payer rules that may apply to your service.

What HIPAA requires when handling store-and-forward teledermatology information

HIPAA requires covered entities and business associates to safeguard applicable PHI. For a teledermatology workflow, that can include identifiable skin images, intake forms, medical histories, clinician comments, recommendations, and follow-up communications. The Security Rule requires safeguards for ePHI and a risk analysis that considers where the information is created, received, maintained, and transmitted. See the HHS Summary of the HIPAA Security Rule and HHS guidance on risk analysis.

Map the full information path: patient upload, any intake or triage queue, dermatologist review, documentation in the medical record, and any return message or referral. Identify the devices, systems, staff, and vendors involved, then address the risks through policies, training, and appropriate technical and physical measures. These HIPAA Security Rule safeguards should reflect your organization’s size, operations, technology, and risk analysis.

If a technology vendor creates, receives, maintains, or transmits PHI on your behalf and meets HIPAA’s definition of a business associate, your practice generally needs a written business associate agreement (BAA) before allowing that vendor access to PHI. The BAA should describe permitted uses and disclosures and require appropriate safeguards. A vendor that merely supplies software without access to the PHI may not be a business associate; evaluate the actual service and access involved. See HHS Business Associates guidance and its software-vendor FAQ.

How to secure teledermatology images and clinical records during transmission and storage

HIPAA’s transmission security standard requires technical measures to guard ePHI against unauthorized access while it is being sent over an electronic communications network. The Security Rule also addresses encryption and decryption for stored ePHI. Encryption specifications are “addressable,” not a blanket instruction that every file must use one particular encryption method. Your organization must assess whether encryption is reasonable and appropriate; if it is not, document that decision and use an appropriate alternative when needed to meet the standard. See HHS’s Security Rule summary and HHS guidance on encryption.

For protected health information transmission, use an organization-approved patient portal or telehealth system configured to protect uploads and messages. Assess encryption in transit and at rest as part of your risk analysis, along with authentication, device security, backups, vendor access, and how images move into the clinical record. Avoid routine workflows that send identifiable images through personal email, consumer messaging apps, or unmanaged devices unless the organization has assessed and secured the method appropriately.

Set procedures for receiving images, checking that they are associated with the correct patient, and moving them into the approved record system. Limit local downloads and copies, protect devices used for review, and securely dispose of temporary files when they are no longer needed under your retention and disposal policies. HHS telehealth guidance also recommends secure data handling and addressing privacy risks across collection, transmission, and storage; see HHS guidance on developing a telehealth privacy and security strategy.

What patient consent and privacy notices should explain

HIPAA generally does not require a patient’s written consent or authorization simply to use or disclose PHI for treatment. A dermatologist’s consultation with another provider about a patient is generally part of treatment. However, state law or professional rules may require informed consent for telehealth, and other uses—such as using identifiable images for marketing or certain educational purposes—may require a HIPAA authorization. Keep treatment consent, telehealth informed consent, and HIPAA authorization distinct. See HHS guidance on treatment, payment, and health care operations and HHS guidance on HIPAA authorizations.

Where applicable, your Notice of Privacy Practices (NPP) must describe HIPAA-required information, including permitted uses and disclosures, patient rights, and the covered entity’s privacy duties. Keep the notice accurate if your privacy practices materially change. A teledermatology-specific consent form is not a substitute for the NPP. See HHS guidance on Notices of Privacy Practices.

As a practical informed-consent step, explain how the store-and-forward service works, what information and images the patient should submit, who may review them, how the practice will communicate its response, and what to do if symptoms require urgent attention. Explain relevant privacy limits and alternatives, such as an in-person evaluation, and invite questions. If you collect electronic informed consent, document the patient’s agreement in a way that complies with applicable state law. HHS notes that telehealth informed-consent requirements vary by state; see HHS guidance on obtaining informed consent.

How to control access to teledermatology submissions

HIPAA requires technical access controls that allow ePHI access only to authorized users or software, unique user identification, audit controls that record and examine activity, and procedures to verify the identity of people or systems seeking access. These access control and audit controls help your practice limit exposure and investigate inappropriate access. See HHS’s summary of the Security Rule technical safeguards.

Assign access based on job responsibilities: for example, intake staff may need to route a submission, while the reviewing dermatologist needs access to the images and relevant history. Use individual accounts rather than shared logins, review access when roles change, promptly remove access when it is no longer needed, and check system logs for unusual activity. Multi-factor authentication and automatic session locking can further reduce risk; select safeguards through your risk analysis rather than treating any single technology as a substitute for the full Security Rule program.

Apply the HIPAA minimum-necessary standard where it applies, such as to many workforce uses and disclosures. It does not apply to disclosures to or requests by a health care provider for treatment, but role-appropriate access policies can still help protect information. Train workforce members on your organization’s policies for handling images, patient identity, secure messages, and misdirected submissions.

What records and care plans should be documented

HIPAA does not prescribe a single teledermatology note template. Your clinical record should nevertheless be clear enough to support continuity of care and explain the decisions made. As a practical approach, document the patient’s identity and relevant history, the date and source of the submission, the skin location shown, the images reviewed, the reviewing clinician, the assessment, and any limitations that affected the review.

Record the recommendations and care plan, including medication or self-care guidance when appropriate, follow-up timing, referrals, and instructions for an in-person or urgent evaluation. Document important communications with the patient or referring clinician, including when the response was sent and any plan to confirm receipt or arrange follow-up. This teledermatology consultation documentation is a clinical best practice; state law, professional standards, or payer rules may impose additional requirements.

Keep any consent or authorization records required by law or your own policies, and ensure that images and the consultation note are linked to the correct patient record. Do not assume that HIPAA sets the retention period for the medical record: HHS explains that the HIPAA Privacy Rule does not establish medical-record retention periods, which are generally governed by state law. The Security Rule’s six-year documentation period applies to specified Security Rule policies and required records, not as a universal medical-record retention rule. See HHS guidance on medical-record retention and HHS’s Security Rule summary.

Which state and program requirements may apply beyond HIPAA

HIPAA is only one part of the compliance picture. State requirements may address telehealth informed consent, professional licensure, scope of practice, the standard of care, medical-record retention, and whether a particular store-and-forward model is permitted. When a patient is in another state, confirm which state’s rules apply and whether the clinician is authorized to practice there. See HHS telehealth legal considerations and HHS guidance on cross-state licensure.

Coverage and payment rules are separate from HIPAA privacy and security obligations. Medicaid telehealth coverage and delivery requirements can vary by state and by covered benefit; check the relevant state Medicaid plan and program guidance. Other payer contracts and program rules may also affect eligible providers, covered modalities, documentation, and billing. See CMS Medicaid telehealth guidance.

In summary, protect images and records through a risk-based security program, clear access and documentation procedures, and vendor agreements where required. Then check the patient’s location and applicable state and payer rules, because HIPAA compliance alone may not satisfy every requirement for store-and-forward teledermatology.

FAQs

Is written patient consent required for store-and-forward teledermatology?

HIPAA generally does not require written consent to use or disclose PHI for treatment, including a clinical consultation. But state telehealth law or professional rules may require informed consent, and your practice should verify the rules that apply to the patient and clinician. Consent to receive telehealth care is also different from a HIPAA authorization for a use or disclosure that is not otherwise permitted. See HHS guidance on treatment disclosures and HHS telehealth informed-consent guidance.

What information should a teledermatology consent form disclose?

There is no single HIPAA-mandated teledermatology consent form. As a practical matter, explain that the service is asynchronous, what images and information to submit, who may review them, how and when the patient will receive a response, potential limits of image-based assessment, privacy considerations, alternatives to remote care, and when to seek urgent or in-person care. Confirm any additional elements required by state law and document the consent as required by your workflow and applicable rules.

How should patient images and records be transmitted securely?

Use an organization-approved system with safeguards selected through your risk analysis, such as authenticated access and appropriate encryption for transmission and storage. Avoid sending identifiable images through personal email or consumer messaging services unless the method has been assessed and properly secured. HIPAA requires transmission security, while encryption specifications are addressable and must be evaluated under the Security Rule. See HHS’s Security Rule summary.

Does HIPAA require a dedicated transmission link for teledermatology?

No. HIPAA requires technical security measures to guard ePHI against unauthorized access during electronic transmission; it does not prescribe a dedicated transmission link for teledermatology. Your practice must select and document reasonable and appropriate protections for its specific systems and risks, including encryption or suitable alternatives where applicable. See HHS’s Security Rule summary.