I provide telepractice services via videoconferencing. Does the Security Rule apply to these video sessions?
Treatment sessions provided via videoconferencing software is not covered by the Security Rule. In the Final Rule [PDF], it specifically states “because “paper-to-paper” faxes, person-to-person telephone calls, video teleconferencing, or messages left on voice-mail were not in electronic form before the transmission, those activities are not covered by this rule” (page 8342). If, however, the provider records the session and saves a copy, the saved version would be subject to Security Rule provisions for data at rest. Regardless, the treatment session and all related information and documentation are subject to the Privacy Rule provisions. To ensure the patient’s privacy during treatment sessions, clinicians should consider the use of private networks or encrypted videoconferencing software.
