HIPAA is a floor, not a fortress. The data practices of telehealth companies vary far more than their privacy pages suggest.
Every telehealth platform's privacy page says some version of the same thing: "We take your privacy seriously. Your data is protected in accordance with HIPAA." What most patients do not realize is that HIPAA is a floor, not a fortress — and the data practices of telehealth companies vary far more than their privacy pages suggest.
HIPAA (the Health Insurance Portability and Accountability Act) establishes minimum standards for how covered entities — healthcare providers, health plans, and healthcare clearinghouses — handle protected health information (PHI). The core requirements are access controls (who can see patient data), encryption standards (data in transit and at rest), breach notification (informing patients within 60 days of a breach), and business associate agreements (contracts with third parties who handle PHI).
What HIPAA does not do is prevent a covered entity from sharing de-identified data, regulate health apps that are not covered entities, address data practices of advertising technology integrated into telehealth platforms, or prohibit internal data use for "treatment, payment, and health care operations."
The privacy risks in telehealth are less about hackers stealing medical records and more about the routine data practices of the platforms themselves:
Patients are not powerless, but protection requires active steps: review the platform's privacy policy (specifically, look for language about data sharing with "business partners" or "analytics providers"), use the platform's web interface rather than the mobile app when possible (apps collect more device and location data), opt out of marketing communications and data sharing where the option exists, use a separate email address for telehealth accounts, and ask directly how your data is stored and who has access.
Some states offer stronger health data privacy protections than HIPAA alone. Washington's My Health My Data Act, California's CCPA/CPRA, and similar state laws extend privacy protections to health data held by non-covered entities — including some health apps and telehealth platforms that might not be subject to HIPAA.
Telehealth is not inherently less private than in-person care — the data exposure is just different. In-person care generates paper records that can be lost and electronic records that can be breached. Telehealth generates digital behavioral data that can be tracked, analyzed, and monetized. Understanding the difference is the first step toward protecting yourself in either environment.
Affiliate Disclosure: Virtual Health Visits earns commissions when readers sign up through certain links. This does not influence our coverage, rankings, or editorial independence. We review providers with and without affiliate programs equally.
Medical Disclaimer: This content is for informational purposes only and does not constitute medical advice. Always consult a licensed healthcare provider before starting any medication or treatment program.