HIPAA and Telemedicine: Compliance Basics for Providers Expanding Into New States

When providers plan a move into a new state, the conversation usually centers on licensing, DEA registration, and payer enrollment. HIPAA gets less airtime because it is federal and feels settled. The same rules apply in Phoenix and Philadelphia, so the thinking goes, and your compliance program already covers it. That is partly true. It is also why gaps appear. Adding a state usually means adding clinicians, vendors, devices, and patients whose home states have their own privacy rules, and each of those changes can quietly outrun the program you wrote three years ago.

HIPAA Travels With You, But State Law Sits On Top

HIPAA sets a federal floor. It does not cancel a state law that protects patient information more strictly, and many states do. Rules on mental health records, substance use treatment, HIV status, reproductive care, and minors’ records differ from state to state, as do consent requirements and breach notification deadlines. Federal rules for substance use disorder records under 42 CFR Part 2 add another layer if you treat those patients.

Before you take your first patient in a new state, have counsel or a qualified compliance consultant check that state’s privacy and records laws against your current policies. For most practices this is a few hours of work, and it is far cheaper than finding out from a complaint.

Every Vendor That Touches Patient Data Needs A Business Associate Agreement

Your video platform, EHR, e-prescribing tool, cloud storage, billing company, answering service, and texting vendor all handle protected health information on your behalf. Each one needs a signed business associate agreement before it sees a single patient record.

The pandemic-era enforcement discretion that let providers use everyday video apps ended in August 2023, and it is not coming back. Check the details of what you bought, too. Vendors often cover only certain plan tiers under their BAA, and a free or consumer-level account may fall outside it. Put a yearly reminder on the calendar to confirm each agreement is current and each vendor still meets your standards.

The Risk Analysis Is The First Document Regulators Ask For

The Security Rule requires an accurate and thorough analysis of the risks to patient information your organization holds. When the HHS Office for Civil Rights announces a settlement, a missing or outdated risk analysis shows up again and again in the findings. Many practices wrote theirs before telehealth was a core part of the business and never revisited it.

A useful analysis follows the data. Where does a video visit start, where do notes go, which devices are involved, who can see what, and what happens when a clinician logs in from a home office or a hotel? New states, new staff, and new software are all reasons to update it. Date it, keep it, and record what you did about the risks it found.

Remote Clinicians Are Where Most Practices Are Exposed

Telemedicine clinicians work from wherever they work, and that is where the practical risks live. A short written standard goes a long way: multifactor authentication on every system that holds patient data, encrypted laptops, automatic screen locks, no shared family computers, a private room with a door for every visit, and a rule against public Wi-Fi without a VPN. Decide in advance what happens when a device is lost or stolen, and who the clinician calls.

Text messaging deserves its own policy. Appointment reminders that include identifiable health details are patient information, and the patient’s consent and your platform’s security both matter.

Know Where The Security Rule Is Heading

In January 2025, HHS proposed the first major rewrite of the Security Rule in more than a decade. The proposal would make encryption and multifactor authentication mandatory, require network segmentation and annual penetration testing, call for written incident response plans that are tested every year, and require covered entities to verify their business associates’ safeguards. It drew thousands of comments, and many provider groups asked HHS to withdraw it.

Federal regulatory agendas have since pushed the target for a final rule out to July 2027, and the final text may differ from the proposal. You do not need to wait. Most of what it describes is already sound practice, and a program built toward it will hold up whichever way the final rule lands.

Plan For The Breach Before It Happens

If unsecured patient information is compromised, you generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also go to HHS and the media on that timeline, and some states set shorter clocks or require notice to the attorney general. Write a one-page response plan now. Include who decides whether an incident is a breach, who contacts patients, and how you document it. Practice it once with a realistic scenario, such as a wrong patient joining a video visit or a clinician’s laptop left in a rental car.

Keep The Paperwork Consistent

Your notice of privacy practices, your designated privacy officer, and the practice address on your registrations should agree with each other. If you operate across state lines, make sure patients in each state can reach a real contact person. Inconsistent records invite questions from boards, payers, and auditors.

For providers working out the Arizona piece, Viva MedSuites offers qualified physical medical addresses for telemedicine practices that need an Arizona location for DEA registration, Medicare enrollment, or state licensing. Telemedicine memberships start at $199 a month. You can learn more at vivamedsuites.com/telemedicine-az-address/ or call 480-616-2400.

John Groberg is the founder of Viva MedSuites, Arizona’s largest medical coworking community, with locations in Scottsdale and Mesa serving independent practitioners since 2017.