HIPAA compliance in telehealth is not a single switch — it is a set of configuration decisions across access, logging, encryption, and vendor agreements. This checklist mirrors the verification pass we run on every platform we configure.
Access & identity
Confirm role-based access is enabled, least-privilege permissions are applied, multi-factor authentication is required for staff, and inactive accounts are deactivated promptly.
Auditing & monitoring
Verify audit logs capture access to patient records, that logs are retained, and that someone owns reviewing them.
Encryption & data handling
Check encryption in transit and at rest, confirm no patient data lives in unmanaged exports, and document where data is stored.
Vendor agreements
Ensure a Business Associate Agreement is in place with every vendor that touches patient data — including your video and messaging providers.
