HIPAA Compliance Requirements for Telehealth Addiction Treatment Companies

Telehealth addiction treatment companies may need to follow HIPAA, 42 CFR Part 2, or both, depending on their services, organizational role, and the records they handle. Compliance involves more than choosing a video platform: you must assess who is regulated, protect patient information throughout its lifecycle, and ensure staff and vendors follow appropriate safeguards.

This overview covers key considerations for telehealth providers. Your specific obligations may depend on your organization’s status, state law, contracts, and the type of substance use disorder records you maintain.

Determine HIPAA Coverage and Business Associate Roles

Start by determining whether your organization is a HIPAA covered entity, a business associate, both, or neither. A health care provider generally qualifies as a covered entity if it conducts certain standard transactions electronically, such as claims transactions. A business associate is generally an organization or person outside the provider’s workforce that performs services involving protected health information (PHI) on behalf of a covered entity.

Telehealth delivery does not, by itself, determine HIPAA status. Review the organization’s services, billing and transaction practices, and relationships with other health care organizations. A company that is not covered by HIPAA may still have privacy obligations under 42 CFR Part 2, state law, contracts, or other applicable requirements.

Map the information your organization creates, receives, maintains, or transmits. Include clinical records, appointment details, messages, recordings, billing information, and data processed by telehealth platforms or other service providers. This inventory helps you identify which rules and safeguards apply.

Execute Business Associate Agreements With Vendors

When a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, the parties generally need a business associate agreement (BAA) before the vendor handles that information. This can include vendors providing video visits, cloud storage, electronic health records, scheduling, transcription, billing, patient messaging, or technical support.

A vendor’s role matters more than its label. A service provider that only transmits information and has merely transient access may qualify for the narrow conduit exception, but a provider that stores or accesses PHI usually requires closer analysis. If your organization is a business associate, you may also need written agreements with subcontractors that handle ePHI for you.

Review each BAA for permitted uses and disclosures, safeguards, incident and breach reporting, subcontractor requirements, and what happens to PHI when the relationship ends. A signed agreement does not replace your own risk assessment or make an unsuitable service safe to use.

Select HIPAA-Compliant Telehealth Technology

Choose technology based on your organization’s documented privacy and security needs—not on a vendor’s claim that a product is “HIPAA compliant.” HIPAA does not provide a general certification that automatically makes a platform compliant. You remain responsible for assessing whether the service and the way you use it protect PHI appropriately.

Evaluate whether the platform supports appropriate access controls, authentication, encryption, audit logging, secure storage, and session management. Find out whether it records, transcribes, or stores visits; who can access those files; how long they are retained; and how they can be deleted. Confirm that the vendor will sign a BAA when required and that its subcontractors are addressed.

Use settings that limit unnecessary collection and sharing. Disable recording and transcription unless there is a defined, permitted purpose and the required safeguards and permissions are in place. Review integrations, analytics, and tracking tools to make sure they do not expose patient information to unauthorized parties.

Apply Privacy Safeguards During Virtual Sessions

Set procedures for conducting visits in private locations and confirming who is present. At the start of a session, verify the patient’s identity as appropriate, confirm their location, and ask whether anyone else can hear or see the visit. Explain how to handle an unexpected participant, a dropped connection, or a request to record.

Train clinicians and staff to protect conversations and screens from being overheard or viewed by others. Use headphones and screen privacy measures where appropriate, lock unattended devices, and avoid discussing patient information in shared spaces. Explain practical privacy limitations to patients and encourage them to join from a private location and secure their own device.

Establish procedures for telehealth messages, appointment reminders, and follow-up documents. Use only approved channels for PHI, verify recipients before sending information, and apply the appropriate permissions or authorizations before sharing records. Privacy practices should account for both HIPAA and any additional protections that apply to substance use disorder records.

Conduct Security Risk Analysis and Risk Management

A HIPAA Security Rule risk analysis should identify the ePHI your organization holds or handles, the systems and people with access to it, and the reasonably anticipated threats and vulnerabilities. The analysis should cover the full telehealth environment, including devices, networks, video services, cloud systems, remote staff, backups, and connected applications.

Assess risks such as account takeover, phishing, ransomware, lost or stolen devices, misdirected messages, unauthorized recording, insecure home networks, excessive user access, and vendor incidents. Consider how a disruption or loss of data could affect the confidentiality, integrity, and availability of ePHI and patient care.

Use the findings to prioritize and implement risk management measures. Assign responsibility, document decisions, set deadlines, and revisit risks when services, vendors, technology, or threats change. A one-time assessment is not a substitute for ongoing security management, workforce training, and periodic evaluation of safeguards.

Protect Electronic Protected Health Information

Protect electronic protected health information (ePHI) with administrative, physical, and technical safeguards appropriate to your organization’s risks. Use role-based access so staff can view only the information they need, require unique user credentials, and promptly remove access when a role changes or employment ends.

Apply safeguards such as encryption where appropriate, secure authentication, automatic screen locks, audit logs, endpoint protection, and secure backups. Set policies for approved devices, remote access, software updates, data retention, secure disposal, and use of removable media. Train staff to recognize suspicious activity and report security incidents quickly.

Maintain an incident response plan that explains how to contain, investigate, document, and report a suspected exposure. Determine whether an event is a breach under applicable rules and follow relevant breach notification requirements, including required notices to affected individuals and government agencies when applicable. Your procedures should account for both HIPAA and Part 2 obligations if the incident involves Part 2 records.

Meet 42 CFR Part 2 Requirements for Substance Use Records

42 CFR Part 2 provides additional confidentiality protections for records held by qualifying federally assisted programs that provide substance use disorder (SUD) diagnosis, treatment, or referral for treatment. Determine whether your organization meets the definition of a Part 2 program and whether you receive or maintain records protected by Part 2. Not every record mentioning substance use is automatically a Part 2 record.

For covered records, establish processes for consent, permitted disclosures, patient notices, access controls, and responses to legal demands. The 2024 Part 2 Final Rule permits a single consent for future treatment, payment, and health care operations disclosures, subject to the rule’s requirements. It also preserves restrictions on using or disclosing records in legal proceedings against a patient without the required consent or court process. Separately maintained SUD counseling notes have additional consent protections.

The rule also added or aligned requirements concerning patient rights, notices, enforcement, and breach notification. Review how Part 2 interacts with HIPAA when the same organization is subject to both, and assess whether state law provides stricter protections. Build these requirements into staff training, vendor arrangements, and incident response procedures.

In summary: Determine which rules apply to your organization, use appropriate agreements and technology, protect privacy during every virtual visit, and continually assess risks to ePHI. If you handle Part 2 records, apply their additional consent, disclosure, and breach protections as well. The 2024 Part 2 Final Rule required compliance by February 16, 2026.

FAQs

Which telehealth vendors need a business associate agreement?

A vendor generally needs a BAA when it creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or business associate. This may include video platforms, cloud storage, electronic health record services, transcription providers, and patient messaging tools. A narrow exception may apply to a transmission-only conduit with merely transient access. Assess what the vendor actually does, what information it handles, and whether it stores or accesses PHI.

What security risks should telehealth addiction treatment companies assess?

Assess risks to the confidentiality, integrity, and availability of ePHI across your systems and workflows. Consider phishing, ransomware, stolen devices, unauthorized access, insecure networks, misdirected messages, session recordings, vendor incidents, and system outages. Include workforce practices, remote access, backups, connected applications, and the impact that lost or corrupted records could have on care.

How do 42 CFR Part 2 requirements apply to substance use disorder records?

Part 2 applies to records held by qualifying federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment, and some requirements also affect organizations that receive those records. It generally restricts the use and disclosure of identifying records, subject to permitted disclosures and applicable consent or court-order requirements. Review whether your organization is a Part 2 program, whether the records you handle are protected, and how Part 2 interacts with HIPAA and state law.

When did compliance with the 2024 Part 2 Final Rule become required?

Compliance with the 2024 Part 2 Final Rule was required by February 16, 2026. The rule became effective on April 16, 2024.