Telemedicine remains common in U.S. healthcare. According to the CDC's National Center for Health Statistics, 80.0% of office-based physicians used telemedicine in 2024, compared with 86.5% in 2021. Before the pandemic, the reported rate was 15.4% in 2019.

Those numbers describe adoption, not whether a specific platform is appropriate for a particular healthcare organization.

That decision requires a closer look at the communication around the visit.

What should healthcare teams evaluate in a HIPAA-compliant telehealth platform?

Start with the path taken by patient information, not the video interface. A healthcare organization needs to understand which systems create, receive, maintain, or transmit ePHI; which employees can access it; how participants are authenticated; what is retained; and how access changes when staff roles change.

For a typical virtual visit, map the workflow from beginning to end:

1. The patient receives an invitation.

2. The patient enters the session.

3. A clinician or another approved participant joins.

4. Information may be discussed or exchanged.

5. Documents, images, or follow-up instructions may be shared.

6. Questions may arrive after the session.

7. Responsibility may move to another staff member.

Each point creates a different operational question.

Who can see the information? Where does it go? Does another vendor process it? Who is responsible for the next action?

A successful video connection does not answer those questions.

Which HIPAA Security Rule requirements are relevant to telehealth?

The HIPAA Security Rule requires regulated entities to use administrative, physical, and technical safeguards to protect ePHI. For telehealth technology, relevant controls can include access management, authentication, audit controls, transmission security, workforce policies, risk analysis, and documentation. The exact implementation depends on the organization's risks and circumstances.

HHS states that covered healthcare providers and health plans providing telehealth must comply with applicable HIPAA requirements.

Its Security Rule guidance also requires regulated entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI.

That assessment needs to reflect the actual implementation.

For example, a behavioral health practice using virtual visits should know:

• which employees can initiate sessions;

• who can join them;

• what happens when an invitation is forwarded;

• whether information is retained after the call;

• which vendors handle ePHI;

• how former employees lose access.

HHS's current Security Rule summary was last reviewed on August 7, 2026.

That current guidance is a better baseline for a 2026 technology review than temporary assumptions developed during the COVID-19 public health emergency.

Does having a BAA make a telehealth platform HIPAA compliant?

No. A Business Associate Agreement addresses responsibilities between a regulated entity and a vendor acting as its business associate. It does not perform the healthcare organization's risk analysis, configure permissions, train employees, control devices, or determine whether staff use the technology according to policy.

The vendor's role also matters.

HHS guidance on audio-only telehealth explains that a telecommunications service provider acting only as a conduit for PHI may not create a business-associate relationship when its access is transient.

The analysis changes when a vendor does more than transmit data.

For example, HHS describes a smartphone application that stores PHI such as recordings or transcripts for a provider's later use. Because that vendor creates, receives, or maintains PHI on the provider's behalf rather than functioning solely as a conduit, a BAA is required.

This gives technology teams a useful procurement question:

What information does each vendor create, receive, maintain, transmit, or store on our behalf?

That is more informative than checking whether “BAA available” appears on a pricing page.

How should patient access to a virtual visit work?

Patient access should be tested on the devices and under the conditions patients are likely to encounter. Security controls still matter, but unnecessary account creation, downloads, unfamiliar software, or unclear invitations can create barriers before the clinical interaction begins.

Do not test this only from an employee laptop on the office network.

Try the workflow as a patient would.

A first-time patient might open the invitation from an older smartphone. Someone else may help them with the device. A caregiver may need to participate. The patient might click the invitation from a different device than expected.

Then test less convenient cases.

What happens if the invitation is forwarded?

Can an old invitation be reused?

How does the clinician establish who is present?

What happens when the patient cannot complete the expected access steps?

HHS also recommends telling patients how a healthcare provider will contact them for telehealth and, when appropriate, identifying the phone number or email address from which communication will arrive. That can help patients distinguish legitimate healthcare communication from phishing attempts.

The patient-entry workflow therefore affects both usability and trust.

What happens after the virtual visit ends?

Post-visit communication needs an owner. A patient may send a question after the clinician has finished work, a document may require review, or another employee may need to continue the conversation. The technology should be tested for these handoffs rather than assuming the same clinician will remain available.

Consider a home health therapist who completes a virtual check-in at 2:00 p.m.

At 5:45 p.m., the patient's daughter has a follow-up question. The therapist is no longer working, but an on-call clinician is available.

What information can that covering clinician see?

Can they determine what was already discussed?

Can they continue the appropriate communication without asking the family to reconstruct the entire exchange?

If the answer depends on contacting the original therapist, the organization has a workflow dependency that the video feature itself did not solve.

For field-based healthcare, this type of handoff can matter more than having another setting inside the video window.

Should telehealth support audio-only care?

Healthcare organizations should consider audio-only workflows where they are appropriate for the service being delivered and permitted under applicable requirements. HHS confirms that covered providers and health plans can provide audio-only telehealth when the communication complies with the applicable HIPAA Privacy, Security, and Breach Notification Rules.

There are practical reasons to evaluate it separately.

Patients do not all have the same broadband access, devices, technical skills, or ability to use video.

CDC research involving adults with diagnosed diabetes provides one example of how telemedicine use can vary across populations. Reported use among adults with diagnosed diabetes fell from 52.8% in 2021 to 39.4% in 2022. The study also found differences associated with geography, insurance, education, and urbanicity.

Those data apply to that specific population and period; they should not be generalized to every patient group.

They do show why a virtual-care design should not assume that every patient will interact with the technology in the same way.

How should access control and offboarding be tested?

Test access controls when staffing changes, not only when everyone is working normally. Administrators should understand how access is granted, changed, and removed, while communication that legitimately belongs to the organization remains available to authorized staff according to policy and applicable requirements.

A useful test is an employee departure.

Suppose a nurse leaves the organization on Friday afternoon.

Ask:

Can an administrator revoke that user's access?

What happens to patient communication associated with their work?

Can an authorized replacement continue an unresolved conversation?

What activity can administrators review when investigating a problem?

These questions connect product behavior to actual workforce management.

The Security Rule identifies access controls, audit controls, authentication, integrity protections, and transmission security among its technical safeguards.

A vendor demo should therefore include administrative workflows rather than showing only the clinician-facing interface.

What should you test before deploying a telehealth platform?

A pre-deployment test should follow real patient journeys and deliberately include failures. Test the invitation, patient entry, additional participants, PHI exchange, connection problems, follow-up communication, staff handoffs, user removal, and administrative review. Record where context disappears or a manual workaround becomes necessary.

A practical test matrix could look like this:

The purpose is not to maximize the number of boxes a vendor can check.

It is to find out what happens on the days when the normal workflow breaks.

How does Buzz approach telehealth communication?

Buzz by Skyscape connects virtual visits with the communication surrounding them. Its current telehealth feature supports encrypted video conferencing, BuzzLink patient access, secure messaging, family participation, document sharing, and care-team communication. Buzz states that patients and family members can join through a secure link sent by text or email without creating an account or downloading another app.

That model can be relevant for home health, hospice, behavioral health, and other organizations where virtual care involves staff outside a single clinic.

The primary page to review is Buzz's HIPAA-compliant telehealth platform feature page.

Buzz also documents its broader HIPAA-secure communication features, including messaging, phone, fax, file sharing, group collaboration, workflow tools, and telehealth.

Organizations evaluating the company more broadly can review Buzz by Skyscape's healthcare communication platform.

Those capabilities still need to be evaluated against the organization's own risk analysis, policies, workforce, use cases, and applicable HIPAA obligations.

A useful final test is to follow one real patient interaction from invitation through follow-up.

If the organization can explain who has access, where PHI moves, who owns each next action, and what happens when the original clinician is unavailable, it has learned far more than a video-quality test could show.

This article is for informational purposes and is not legal advice.

Sources

1. U.S. Department of Health and Human Services: Summary of the HIPAA Security Rule, last reviewed August 7, 2026.

2. U.S. Department of Health and Human Services: HIPAA Rules for Telehealth Technology.

3. U.S. Department of Health and Human Services Office for Civil Rights Guidance on Audio-Only Telehealth.

4. U.S. Department of Health and Human Services: Privacy and Security Guidance for Remote Communication Technologies.

5. CDC National Center for Health Statistics: Telemedicine Use Among Office-Based Physicians in 2021 and 2024, June 2026.

6. CDC Preventing Chronic Disease: Telemedicine Use Among Adults With and Without Diagnosed Prediabetes or Diabetes, United States, 2021 and 2022.