Telehealth changed everything. What once required a waiting room, a commute, and a scheduled in-person appointment now happens through a screen. Patients connect with providers from their homes, their cars, and sometimes their offices. Care became more accessible. But that accessibility came with a set of responsibilities that not every telehealth provider fully understands.
The risks behind that shift are real and growing. According to HIPAA Journal, healthcare data breaches have followed an upward trend since 2009, peaking in 2026 when 772 healthcare data breaches affecting 500 or more individuals were reported to the Office for Civil Rights.
The biggest takeaway here is this: being HIPAA compliant in a traditional clinical setting and being HIPAA compliant in a telehealth environment are not the same thing. The rules overlap, but the risks are different. The tools are different. And the gaps where violations tend to occur are different too.
California BRN-approved HIPAA Compliance Training for Telehealth Providers is now available online through AMC, giving telehealth professionals a practical, flexible way to understand and meet their obligations without stepping away from their practice.
HIPAA Compliant Telehealth Requires More Than a Secure Platform
One of the most common misconceptions in telehealth is that using a secure video platform is enough to be HIPAA compliant. It is a start. But it is far from the complete picture.
Equipment and Environment
The device a provider uses, the network it connects to, the physical environment where the session takes place, and the way patient information is stored and transmitted all factor into HIPAA compliance. A provider taking a telehealth call from a public location, using a personal device without proper security settings, or conducting a session where others can overhear patient information may be creating a HIPAA risk without realizing it.
Financial Considerations
Telehealth introduces financial workflows that differ from in-person care. How billing information is collected, stored, and transmitted during a virtual visit carries its own compliance implications. Providers who handle financial data during telehealth sessions need to understand how HIPAA guidelines apply to those interactions.
Telehealth Etiquette and Professional Standards
Being HIPAA compliant in a telehealth setting also involves professional conduct. How a provider conducts a virtual session, manages the session environment, and handles sensitive information during the visit all contribute to whether that session meets HIPAA standards. These are not just best practices. They are compliance considerations.
What HIPAA Compliant Audio-Only Care Actually Looks Like
Video visits get most of the attention in telehealth compliance discussions. But audio-only telehealth, meaning phone-based care without video, has its own distinct set of HIPAA guidelines that providers need to understand.
The Office for Civil Rights issued specific guidance on HIPAA rules for audio-only telehealth. That guidance clarifies what covered healthcare providers must do to remain HIPAA compliant when delivering care through phone calls rather than video platforms.
OCR’s Telehealth Notification
The OCR’s telehealth notification outlines the conditions under which audio-only telehealth can be delivered in a HIPAA compliant manner. Providers who offer phone-based care without understanding this guidance may be unknowingly operating outside the boundaries of what is permitted.
Covered Healthcare Providers and Telehealth
Not every individual or organization offering telehealth services qualifies as a covered healthcare provider under HIPAA. Understanding whether your practice falls under HIPAA’s jurisdiction and what that means for your telehealth operations is a critical first step toward becoming and staying HIPAA compliant.
What AMC’s Training Covers
AMC’s HIPAA Compliance Training for Telehealth Providers gives telehealth professionals a structured, practical understanding of exactly what HIPAA compliance looks like in a virtual care environment.
The course covers:
- An introduction to telehealth and how it operates within the healthcare system
- Telehealth etiquette, including equipment standards and financial considerations
- Common barriers to telehealth and how they affect compliance
- HIPAA guidelines as they apply specifically to telehealth providers
- Enforcement discretion during COVID-19 and how the regulatory landscape has shifted
- Guidance on HIPAA rules for audio-only telehealth, including OCR’s telehealth notification and what covered healthcare providers need to know
Each area of the course connects directly to what telehealth providers encounter in daily practice. The goal is not just awareness but a clear, actionable understanding of what it means to be HIPAA compliant in a virtual care setting.
Built for Busy Telehealth Providers
Telehealth providers are already managing the demands of running a virtual practice. Finding time for compliance training can feel like one more thing on an already full schedule.
AMC’s course is designed around that reality. It takes just 45 minutes to complete, is fully online and self-paced, and awards 0.75 CME credits upon finishing. Providers can complete it at a time that works around their schedule without interrupting their practice.
Upon completion, providers receive a certificate of completion verifying their training. The course carries approval from the California Board of Registered Nursing, Provider #18138, for 0.75 Contact Hours, making it a valid continuing education option for California-based nursing professionals.
The Cost of Getting This Wrong
HIPAA violations in telehealth are not hypothetical. Enforcement actions have followed providers who used non-compliant platforms, failed to secure patient data transmitted during virtual visits, or mishandled audio-only telehealth under the assumption that phone calls carry no HIPAA risk.
The financial penalties for HIPAA violations range from hundreds to millions of dollars depending on the nature and severity of the breach. Beyond the financial cost, a violation damages the trust that patients place in their providers, and in a telehealth practice, trust is everything.
Becoming and staying HIPAA compliant is not just about avoiding penalties. It is about building a telehealth practice that patients can trust and that holds up under scrutiny.
Ready to Make Your Telehealth Practice Fully HIPAA Compliant?
By investing in structured compliance training, your organization can ensure legal compliance, protect patient data, and foster greater trust among the patients you serve virtually.
Enroll your team in our customized, free course development program today and give your telehealth practice the tools it needs to operate confidently, compliantly, and with the trust of every patient on the other side of the screen.
Because a telehealth practice that is not HIPAA compliant is not just a legal risk. It is a patient safety risk.
