A patient books a same-day virtual visit at 7:40 p.m. and, before the clinician logs on, uploads three close-up photos of an inflamed forearm through a link your front desk texted. By 7:44 those images have passed through a messaging vendor, a file-upload service, a cloud storage bucket, and possibly a content delivery network. Telehealth encounters for skin infections are image-heavy by nature, and every image is protected health information the moment it lands in your workflow. This article is for the administrator who owns that workflow: what to consent, what to store, who needs a BAA, and what happens when the patient asks for the pictures back.

Why Skin Infections Generate More Vendor Touchpoints Than a Typical Telehealth Visit

Most virtual visits produce a video stream, a note, and a claim. Visits involving skin infections routinely produce all of that plus a photo set, sometimes a follow-up photo set, and frequently a referral or a specimen order that moves records to a second organization.

That is a clinical reality with an administrative consequence: more artifacts, more systems, more disclosure events to track. You are not making a clinical judgment about any of it. You are making sure each artifact has a home, a retention rule, an access path, and a contract behind the system holding it.

Count the systems in one encounter at an average primary care or urgent care practice:

  • Scheduling page or patient portal
  • SMS or email reminder vendor
  • Video conferencing platform
  • Image upload tool or secure messaging channel
  • Ambient documentation or transcription tool, if you use one
  • EHR and its cloud host
  • E-prescribing network
  • Referral or health information exchange connection
  • Payment processor for the copay

Nine systems. If you cannot name the contract governing each one, you have a gap, not a workflow.

HIPAA does not require a patient's written consent before you treat them by video. What HIPAA requires is that you provide a Notice of Privacy Practices and make a good-faith effort to obtain acknowledgment of receipt when you have a direct treatment relationship. Everything beyond that comes from other sources:

  1. State telehealth consent law. Many states require informed consent to the modality itself, sometimes in writing, sometimes documented verbally in the note. This is state-specific and changes; your compliance calendar should include a yearly check of every state you are licensed in.
  2. Image capture consent. Photographs of a patient's body are PHI. Documenting that the patient understood they were submitting images, and through what channel, protects you when the channel is later questioned.
  3. Recording consent. If your platform records video or your scribe tool records audio, say so in advance. Several states have all-party consent recording statutes independent of HIPAA.
  4. HIPAA authorization for anything outside treatment, payment, and operations. Teaching files, marketing, social media, vendor case studies, and clinical photo libraries all require a separate, specific written authorization that the patient can revoke.

Short version: treatment by video needs no HIPAA consent form, but modality consent, recording notice, and image-use authorization are four different documents. Do not fold them into one checkbox.

Keep the Four Consents Structurally Separate

The failure mode is a single intake screen with one "I agree" button covering telehealth, recording, image use, and marketing. When a patient later revokes permission for their photo to appear in a training deck, you need to revoke that one thing without invalidating the treatment record. Separate fields, separate timestamps, separate revocation handling.

The Image Is the Record: Capture, Storage, and Retention

Once a clinician uses a photo to inform care, it belongs in the designated record set. That means it is subject to the patient's right of access, the right to request amendment, and your retention schedule.

Three practical rules for image intake:

One channel, documented. Pick a single approved path for patient-submitted images and write it into policy. If patients text photos to a staff member's personal phone, you now have PHI on a device you do not control, outside any retention schedule, invisible to a records request. That is the single most common telehealth intake finding we see in small practices.

Ingest and purge. Images should move from the intake tool into the chart, then be deleted from the intake tool on a defined schedule. Write the schedule down. Assign the deletion to a named role, not to "the office."

Metadata counts. Phone photos carry EXIF data, which can include GPS coordinates. If you export images for a referral, know whether your tool strips metadata. If it does not, your outbound file may carry the patient's home address in a field nobody reads.

Your Vendor List for a Single Visit, and Which Ones Need a BAA

A business associate is any entity that creates, receives, maintains, or transmits PHI on your behalf. The test is not whether the vendor looks at the data. Cloud storage providers holding encrypted PHI they cannot decrypt are still business associates; HHS settled that question years ago.

For a telehealth encounter involving skin infections, apply the test vendor by vendor:

  • Video platform: BAA required. The COVID-era enforcement discretion for non-compliant telehealth platforms ended in August 2023. Consumer video apps without a BAA are not an option in 2026. HHS keeps its current telehealth position at hhs.gov/hipaa/telehealth.
  • Image upload tool and cloud storage: BAA required.
  • SMS reminder vendor: BAA required if message content or recipient lists constitute PHI, which they almost always do.
  • Ambient scribe or transcription vendor: BAA required, plus a hard look at whether the contract permits the vendor to use your data for model training. Read the data-use clause, not the marketing page.
  • E-prescribing network and HIE: BAA or participation agreement with equivalent terms.
  • Payment processor: narrower. Entities acting purely as financial institutions processing payment transactions fall outside business associate status, but many practice-facing payment vendors also store patient identifiers and visit reasons. If it stores why the patient was seen, get the BAA.

If you are onboarding a new image intake or video vendor this quarter and the contract file is empty, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription — useful when you need a defensible document in front of a vendor today rather than after the next legal review cycle.

Subcontractors Are Your Problem Too

Your video vendor's cloud host is a subcontractor business associate and must be bound by equivalent terms. You do not sign that agreement, but you should ask for evidence it exists. Add one line to your vendor questionnaire: "List all subcontractors with access to customer PHI and confirm executed BAAs are in place."

A Worked Intake Sequence With Roles Attached

Here is a sequence you can copy into your telehealth policy. Times are relative to appointment start.

T-24 hours — Scheduling coordinator. Confirm the patient's state of physical location at visit time. Licensure and state telehealth consent obligations follow the patient's location, not yours. Send the pre-visit packet: NPP link, telehealth modality consent, image submission instructions naming the one approved channel.

T-2 hours — Automated. Reminder message through the vendor under BAA. Content limited to appointment time and link. No visit reason in the SMS body.

T-30 minutes — Medical assistant. Verify identity through two identifiers. Confirm consents are captured and timestamped. Confirm images, if submitted, arrived through the approved channel. If they arrived by personal text, document the exception, route the image into the chart, and delete from the device with a witness. Log it as a policy exception, not a breach, unless your risk analysis says otherwise.

T+0 — Clinician. Standard encounter. Recording notice restated verbally if a scribe tool is active.

T+2 hours — Records staff. Confirm images are attached to the encounter in the EHR. Trigger purge from the intake tool per schedule. If a referral was placed, log the disclosure destination.

Weekly — Privacy officer. Review the exception log. Three personal-device exceptions in a month is a training problem; ten is a system problem.

When Records Leave the Building: Referrals and Results

Encounters for skin infections often generate a referral to a specialist or a specimen sent to an outside laboratory. Both move PHI to another covered entity.

Disclosures for treatment do not require patient authorization, and the minimum necessary standard does not apply to disclosures to a provider for treatment purposes. That is a permission, not a blank check. Your obligation is to verify the recipient, use a secure transmission path, and record the disclosure so you can answer questions later.

Note the accounting-of-disclosures nuance: treatment, payment, and operations disclosures are excluded from the required accounting. But patients ask anyway, and "we don't track that" reads badly in a complaint response. Keep a simple outbound log with date, recipient, artifact, and method.

Scheduling Pages, Trackers, and the Non-HIPAA Trap

Your "book a virtual skin visit" landing page is a privacy surface. Third-party analytics and advertising pixels on pages where patients disclose a condition or begin scheduling have been the subject of extensive OCR and FTC attention. A federal court vacated part of OCR's 2022 online tracking bulletin in 2024, which narrowed the agency's stated theory but did not eliminate the underlying exposure — state privacy law, wiretapping claims, and FTC authority all remain live.

Separately, if your practice recommends a consumer app that collects health data outside a HIPAA relationship, the FTC's Health Breach Notification Rule may reach it. Know which of your patient-facing tools are covered by HIPAA and which are not, and stop assuming the two categories overlap.

Practical step: have someone run your scheduling and condition-specific pages through a browser developer console and list every outbound domain. Then justify each one in writing.

The 30-Day Drill: The Patient Asks for the Photos

A patient emails asking for "everything from my telehealth visit, including the pictures I sent." You have 30 days to respond, with one possible 30-day extension and written notice of the delay. HHS's guidance on the right of access is at hhs.gov/hipaa/right-of-access.

Run this drill before you need it:

  1. Can records staff locate the images without asking IT? If images sit in a vendor tool rather than the chart, the answer is no.
  2. Can you deliver them in the patient's requested electronic format and channel, including unencrypted email if the patient insists after being warned of the risk?
  3. Is your fee limited to a reasonable, cost-based amount? Per-page charges applied to image files have drawn enforcement attention in past OCR access initiative settlements.
  4. Does the video recording exist, and is it in the designated record set? If your platform retains recordings you never intended to keep, that is a retention policy failure worth fixing this week.

Checklist Before Your Next Telehealth Block

  • Executed BAA on file for every vendor touching visit data, including subcontractor attestation
  • Four consents captured separately with timestamps
  • One documented image intake channel, with an exception log
  • Written purge schedule for the intake tool, assigned by role
  • Recording retention setting verified in the video platform's admin console
  • Outbound disclosure log for referrals and lab orders
  • Tracker inventory for scheduling and condition pages
  • Access request rehearsal completed within the last 12 months
  • Risk analysis updated to reflect the telehealth stack as it exists today, not as it existed at go-live

That last item carries weight. A risk analysis that does not name your current image intake tool is not a risk analysis of your current practice. If yours is stale, you can automate the risk analysis and supporting policy set rather than rebuilding the document from a template you inherited.

Start With the Contract Gap

Most practices reading this will find their consent language is close enough and their vendor paperwork is not. Pull your vendor list, mark every system that touches a telehealth encounter for skin infections, and check for a countersigned BAA with a current date. Where one is missing, produce a signature-ready agreement and send it out this week. It is the cheapest gap on the list to close, and the one an investigator asks for first.