West Virginia Telehealth Kiosk Privacy Laws: A Guide for Operators

A telehealth kiosk does not have a separate privacy code. The rules depend on who provides the care, who handles patient information, the type of service, and whether the visit is billed to West Virginia Medicaid. Operators should consider HIPAA protected health information safeguards alongside applicable West Virginia licensing rules, Medicaid policies, and any additional protections for sensitive records.

Which privacy laws apply to telehealth kiosks in West Virginia?

HIPAA applies to covered entities—such as certain health care providers, health plans, and clearinghouses—and their business associates. A kiosk is not automatically a HIPAA-regulated entity simply because it is used for health care. However, a vendor that creates, receives, maintains, or transmits protected health information on a provider’s behalf may be a business associate and may require a written business associate agreement. See HHS guidance on HIPAA covered entities and business associates handling electronic health information.

West Virginia’s telehealth requirements also depend on the practitioner’s profession. State law and professional-board rules govern matters such as provider qualifications, consent, records, and standards of care. For Medicaid visits, operators must also check the applicable West Virginia Bureau for Medical Services (BMS) telehealth policy and the service-specific provider manual. If the service involves records from a federally assisted substance use disorder program, additional confidentiality requirements under 42 CFR Part 2 may apply.

Who may operate telehealth equipment under Medicaid policy?

West Virginia Medicaid’s Chapter 519.17 telehealth policy says the telehealth equipment operator must be an enrolled provider or an employee of the enrolled provider, for confidentiality and quality-assurance purposes. This addresses who may operate the equipment; it does not authorize that person to perform clinical work outside their training, credentials, or scope of practice. Review the BMS Chapter 519.17 policy and the manual for the specific service.

A kiosk location is not automatically an eligible Medicaid originating site just because a qualified employee operates it. BMS lists approved originating-site categories, so operators should confirm that the location and service meet the applicable coverage requirements before scheduling or billing a visit.

What consent must patients give before a telehealth visit?

Under BMS Chapter 519.17, a Medicaid member’s consent to telehealth treatment must be obtained and may be included in the member’s initial general consent for treatment. The policy also calls for verbal and written consent from the practitioner responsible for the patient’s care, covering the right to withdraw, telemedicine’s risks and benefits, confidentiality protections, the patient’s right to documentation of transmitted medical information, and restrictions on sharing patient images or information with other entities without further written consent.

For teledentistry, West Virginia law separately requires informed written consent before care, documented in the patient’s record. The patient or authorized decision-maker must be informed about the services and their limitations, provider information, and precautions for a technology failure or emergency. See West Virginia Code §30-4-8b. A general treatment-consent form should not be assumed to satisfy this teledentistry-specific requirement unless it contains the required information and documentation.

Consent to receive care by telehealth is different from HIPAA authorization to use or disclose information for purposes that HIPAA does not otherwise permit. Operators should make the purpose and scope of each consent clear.

How must operators protect records and patient access?

Medicaid telehealth documentation must follow the same general progress-note requirements as in-person care, with the mode of communication identified. HIPAA gives individuals a right to inspect or obtain copies of protected health information in a covered entity’s designated record set, subject to limited exceptions. A covered entity generally must act on an access request within 30 days. See 45 CFR §164.524.

For teledentistry, West Virginia law requires a complete record of each encounter, maintained under applicable state and federal requirements. The active Board of Dentistry rule also addresses record access and retention. For physicians covered by West Virginia Code §30-14-12d, telemedicine records must be accessible and documented for both the physician and patient, and a physician providing services solely by telemedicine must make encounter documentation easily available to the patient. See the West Virginia Board of Dentistry’s Teledentistry Rule and West Virginia Code §30-14-12d.

As a practical safeguard, configure kiosks to prevent the next user from seeing the prior patient’s information. Use individual logins, automatic session termination, controlled access to stored files, and a process for securely clearing any local data after a visit.

What safeguards reduce incidental disclosures in public settings?

HHS expects providers ordinarily to conduct telehealth in private locations. Patients should not receive services in public or semi-public settings without their consent or exigent circumstances. If a private setting is unavailable, covered providers must still use reasonable safeguards to limit incidental disclosures. HHS examples include lowering voices, avoiding speakerphone, and moving a patient a reasonable distance from other people. See HHS guidance on telehealth locations.

For a kiosk, practical safeguards can include a private room or enclosed booth, sound control, a privacy screen, positioning the display away from passersby, and a clear way for the patient to pause or end the session. Staff should avoid discussing a patient’s name, diagnosis, or visit details where others can hear. HIPAA does not require eliminating every possible incidental disclosure, but it does require reasonable safeguards appropriate to the circumstances.

What privacy protocols and encryption apply to teledentistry?

West Virginia’s active Board of Dentistry rule requires written or electronic teledentistry protocols covering informed consent, privacy safeguards, documentation, and appropriate encryption when transmitting patient health information. It also requires secure electronic or digital communications and includes explicit patient or legal-guardian consent for forwarding patient-identifiable information to a third party. The Board’s Teledentistry Rule, Series 5-16, works alongside West Virginia Code §30-4-8b, which requires HIPAA-compliant communications technology and a complete encounter record.

HIPAA’s Security Rule requires transmission-security measures and identifies encryption and decryption as addressable implementation specifications. “Addressable” does not mean an operator can ignore encryption: the covered entity or business associate must assess what is reasonable and appropriate for its circumstances, implement the specification when appropriate, or document why it is not and use an equivalent alternative where required. See 45 CFR §164.312 and 45 CFR §164.306.

BMS Chapter 519.17 also describes VPN use for member personal-computing devices and web- or smartphone-based telehealth applications. Operators should check the current BMS policy and service-specific requirements when selecting a kiosk network or platform; a vendor’s claim that a product is “HIPAA compliant” does not by itself establish that the operator’s full configuration and practices meet their obligations.

What are the limits on sharing identifiable patient information?

HIPAA permits certain disclosures without a separate patient authorization, including disclosures for treatment, payment, and health care operations, subject to the applicable rules. The minimum-necessary standard generally does not apply to provider-to-provider treatment disclosures. Other uses or disclosures may require a valid HIPAA authorization or another specific legal permission. See 45 CFR §164.502.

West Virginia’s Medicaid telehealth policy and teledentistry rule may impose additional consent requirements for sharing images or identifiable information with other entities. In particular, the teledentistry rule calls for explicit consent to forward patient-identifiable information to a third party. If the information is a Part 2 record, its additional confidentiality rules may also apply; HHS explains that Part 2 generally limits disclosure of information identifying a person as having or having had a substance use disorder, subject to consent and specified exceptions.

In practice, share only through approved channels, confirm the recipient and purpose, and follow the consent terms and the rules that apply to the service. The key operator duties are to use an eligible Medicaid site and operator where required, obtain appropriate consent, protect records and patient access, reduce public exposure, and apply the stricter applicable privacy and encryption requirements.

FAQs.

Can an employee of an enrolled provider operate a Medicaid telehealth kiosk?

Yes. BMS Chapter 519.17 says an employee of the enrolled provider may operate the telehealth equipment. A person employed only by the kiosk’s host location should not be assumed to qualify. The operator must also follow confidentiality and quality-assurance procedures, and the kiosk site must independently meet the applicable Medicaid originating-site requirements.

Can telehealth treatment consent be included in general treatment consent?

Yes. BMS Chapter 519.17 says telehealth treatment consent may be included in the member’s initial general consent for treatment. The consent must still cover the required telehealth information. Teledentistry has a separate informed-written-consent requirement under West Virginia law and should be documented accordingly.

Can a patient withdraw consent and stop a technology-based service?

Yes. Under BMS Chapter 519.17, if a member or legal guardian indicates they want to stop using the technology, the service should cease immediately and an alternative method of service should be arranged.

Must telehealth encounter documentation be made available to the patient?

Generally, patients have a HIPAA right to access protected health information in the designated record set, subject to limited exceptions. West Virginia’s Medicaid policy recognizes a right to documentation regarding transmitted medical information, and state law or Board of Dentistry rules may add requirements for particular services. The precise scope depends on which records are maintained and which laws govern the provider and service.