Making patient privacy and data security a priority in telehealth delivery

Telehealth plays a crucial role in health care delivery across various practice settings. The integration of telehealth services into health care practices has revolutionized the way psychologists connect with their patients. Telehealth provides a convenient way to connect, overcoming common barriers like scheduling and access to in-person appointments. Whether you offer a combination of in-person and virtual sessions or exclusively provide telehealth services, it is essential to understand and comply with state and federal laws governing telehealth.

Licensure is a fundamental aspect of health care delivery, and psychologists must be licensed in the state where the patient is located at the time of the telehealth session. To meet the increasing demand for mental health care, PSYPACT was created to facilitate the practice of telepsychology across state boundaries, streamlining the process and enabling licensed psychologists to practice legally and ethically from their PSYPACT home state into other PSYPACT states once the psychologist completes the registration process.

When it comes to choosing the right teletherapy platform for your practice, the options available can be overwhelming. Consider asking yourself the following questions to best select the most suitable platform for your practice.

• Does your platform of choice meet HIPAA requirements? If yes, can they provide you with a Business Associate Agreement (BAA)?
• What are the security features? Does it include end-to-end encryption?
• Is it compatible and accessible with all types of web browsers or smart devices?
• Is it easy to navigate? Will patients be able to access the platform with ease?
• Does the vendor provide real time support and assistance with software updates?

With the exchange of protected health information (PHI), it is essential the platform used for telehealth sessions, scheduling, billing, or medical records comply with HIPAA guidelines. Be sure to obtain a written contract with the vendor to include a BAA, which ensures the vendor complies with HIPAA standards to protect your patients’ PHI.

It’s no secret using technology increases the risk for cyber security incidents. Practicing good cyber hygiene can help to reduce your risk to these incidents. Here are a few common tips to mitigate unauthorized disclosure of data (PDF, 505KB)opens in new window.

• Use encryption to protect mobile devices such as smartphones, laptops, and handheld devices.
• Use a secure internet connection with firewall protection.
• Install antivirus software on electronic devices.
• Plan for an unexpected event, have a back-up to your data.
• Control who has access to PHI using credentials, passwords, and two-step verification, such as a PIN code.
• Use strong passwords and change them frequently.

Clinical documentation helps demonstrate medical necessity for billing, regulatory compliance, and, if needed, to defend the psychologist in the event of a licensing board compliant or professional liability matter. While documentation requirements for telehealth visits are the same as for in-person visits, a few additional requirements are needed for telehealth visits. In addition to documenting the clinical encounter, telehealth documentation should include:

• Date and time of the session
• Method of telehealth. For example, “secure interactive audio-video session” or “audio only session”
• Any technology malfunction which may have disrupted the treatment session
• The stated location of the patient–town or facility

Verification of location is important for these reasons:
1. It establishes which state licensing laws apply.
2. In the event of an emergency, patient location is important.
3. Mandatory reporting requirements (duty to warn).
4. Reimbursement may be tied to where the provider/patient is located.

• Patient consent and confirmation of the patient’s identity
• Name and relationship of any individuals present during the visit (family member, health care provider, or interpreter)

Technology comes in many forms and includes texting, email, scanning, or faxing. To protect patient confidentiality and maintain compliance with HIPAA, take the following steps:

• Include in the consent form if the patient opts in or out of electronic communication via text or email. Note, patients have the right to opt out at any time.
• Be mindful that email and text are not secure or confidential when transmitting; it is important to advise patients you are not able to guarantee security unless using an encrypted patient portal or encrypted email to message patients.
• Unsecured or conventional email or text should not be used to communicate PHI such as treatment discussions.
• All email and text communications related to care and treatment must be stored in the patient’s medical record.
• If faxing, confirm the recipient’s fax number prior to sending.

Some of the most common risks when using social media involve privacy, boundaries, and professionalism. It is important to remember the following principles of ethics:

• It is best to avoid any patient “friends” or “followers” with your personal social media accounts. This practice should be adhered to by your staff as well to avoid any connection to your practice which could result in a HIPAA violation.
• If you have a professional social media account, avoid displaying patient information publicly to protect the privacy of patients. In addition, professional boundaries may become blurred when having interactive dialogue with patients in social media forums. Interactive chats should not include medical advice to avoid misinterpretation of information.
• If patients post online reviews about your practice, it is best to ignore them. Responding publicly to online reviews is oftentimes a violation of HIPAA even if the patient provided their name. HIPAA violations may result in significant fines or penalties. For example, in June 2023, the Office of Civil Rights settled an action involving a mental health practice that responded to a patient review onlineopens in new window which resulted in a significant monetary penalty.

Psychologists can use a professional website listing the providers and services available. It is important to avoid copyright infringement when utilizing information and photographs found on the internet. It is a misconception that all information listed on the internet is free for public use. Photographs and other content posted on a professional website should be original content created by the office practice owner to avoid claims involving copyright infringement. In addition, is important to understand the data collected or stored by the domain or web hosting site you use. According to Wired magazine’s February 18, 2023, edition, the world’s fifth largest web host reported a breach to their systemopens in new window.

Understanding the risk for patient data to be accessed in the event of a website breach is a key element of good cyber hygiene. Consult with an IT professional (which requires a BAA if they will have access to patient data) who can provide advice on managing your practice website and can advise you on the best way to safely utilize the functions within your practice’s website.

If there is any exchange of PHI collected through the billing software or application, you must ensure such software application is HIPAA-compliant and offers a BAA. If the patient’s information is deidentified and no PHI is collected or stored, the software must still comply with the payment card industry (PCI) data security standards to protect a person’s personal identifiable information (PII). If superbills are provided through the payment system, which typically include dates of service, patient’s name, diagnosis, and the provider’s name or identification number, it is best practice to use HIPAA-compliant billing software or provide the superbill in a HIPAA-compliant manner. When contracting with a billing company, it is important to obtain a BAA.

• Does the technology platform need to be HIPAA-compliant? Is there an exchange or storage of PHI?
• Does the platform sell consumer information to others, which may violate the patient’s right to privacy? Does the platform share deidentified information with other parties? If so, for what purposes?
• Do I need to use a technology platform that offers a BAA?
• Is the technology user friendly?

Whether a psychology practice has one or multiple providers, if there is an exchange of information with patients or about patients electronically, or PHI is stored in an electronic format, it is important to consider cyber liability insurance. Most professional liability insurance policies either don’t offer coverage under the professional policy or have very limited coverage for cyber-related events. When purchasing cyber insurance, consider:

• Consulting with an insurance broker to explain the types of policies available
• Comparing what each policy covers and doesn’t cover
• Reviewing the policy limits that are available, including events that only offer sublimited coverage

Take the time to compare the different types of cyber insurance policies and find the one that best fits the needs of the practice

It is important for psychologists to put patient privacy and data security first. Utilizing HIPAA-compliant technology will protect patient privacy and safeguard your practice in the event of a cyber-related attack. Consider purchasing cyber coverage as an important risk mitigation tool just like you secure professional liability insurance for your psychology private practice. Seeking guidance from an attorney, insurance broker, risk management professional, and an IT health care professional will provide you with the essential resources and information to mitigate risk and reduce your practice’s exposure to a privacy or cyber related incident.