Your Monday grid shows 46 visits. Eleven of them are video. That mix is unremarkable in 2026, and the telehealth benefits behind it are real and measurable: fewer no-shows, tighter provider schedules, panel reach into counties you could never staff a room in.

They also created a second workload that nobody assigned to anyone. New vendors touching PHI. New place-of-service logic your billers have to defend. New record artifacts — recordings, chat logs, scribe drafts — that show up in access requests. This guide is written for the administrator, billing lead, or privacy officer who inherited that second workload. It covers the operating mechanics first, then spells out the vendor, coding-documentation, and records implications.

Where Telehealth Benefits Show Up in Your Operating Numbers

Stop quoting industry averages to your board. Pull your own trailing-12 numbers by modality and you will have a defensible answer in an afternoon.

Three metrics carry most of the weight:

  • No-show and late-cancel rate by modality. Segment by service line — behavioral health, chronic disease follow-up, post-op check — because the gap between in-person and video is rarely uniform across them.
  • Room-hours per provider-hour. Video blocks free exam rooms for procedures and in-person intakes. That is a capacity gain even when your visit volume is flat.
  • Front-desk contact minutes per visit. Video visits move check-in work upstream into pre-visit tasks. If your team hasn't rebuilt the workflow, the minutes don't disappear — they migrate to your medical assistants at the worst possible time.

An illustrative worked example

Say your practice runs 1,200 visits a month. You segment and find in-person no-shows at 8% and video no-shows at 5%. Convert 300 visits a month to video and you recover roughly nine appointments monthly that would otherwise have evaporated. The arithmetic is the point, not my numbers — run it on your own data before you commit staffing to a modality shift.

What the benefit costs you in administrative labor

Every video visit adds pre-visit tasks that in-person visits handle at the counter: identity verification, patient location capture, consent confirmation, connectivity check, and a documented fallback when the platform drops. Budget the labor honestly. Practices that treat telehealth as "the same visit, remotely" end up with a documentation gap that surfaces months later during a payer audit or a records request.

What Makes a Telehealth Visit HIPAA-Compliant?

Short answer: a telehealth visit is HIPAA-compliant when the technology and the workflow around it satisfy the Privacy, Security, and Breach Notification Rules — not when a vendor calls itself "HIPAA compliant." Practically, that means five things are true:

  1. A signed business associate agreement is in place with the video platform, and with every downstream vendor that creates, receives, maintains, or transmits PHI on your behalf.
  2. The connection is encrypted in transit, and any stored recordings or transcripts are encrypted at rest.
  3. Access is unique and authenticated per user, with audit logging you can actually pull.
  4. The visit environment is reasonably private on both ends — your staff's remote workstation setup is your problem, not theirs.
  5. Your risk analysis covers the telehealth stack, and the resulting risk management plan is documented.

The pandemic-era enforcement discretion that let practices use consumer video apps ended on August 9, 2023. There is no telehealth carve-out anymore. HHS maintains a plain-language telehealth and HIPAA resource page that your privacy officer should keep bookmarked, including its guidance on audio-only visits.

Your Vendor List Grew and Nobody Updated the BAAs

Pull your business associate inventory. Now list every system that touched a video visit last week. If the second list is longer, you have exposure, and it is the most common finding I see when practices audit their own telehealth program.

The five telehealth vendors practices routinely miss

  • Remote interpretation services. A live interpreter on a three-way video call hears everything. That is a business associate relationship unless the interpreter is your workforce member.
  • Ambient documentation and transcription tools. If a tool listens to the encounter and drafts a note, it processes PHI. Get the BAA, and get written answers on retention and model training.
  • SMS and email reminder platforms. The appointment link, the provider name, and the specialty in a text message are PHI in combination.
  • Digital intake and e-check-in forms. Often a separate contract from your EHR, often signed by whoever wanted the feature.
  • Analytics and tracking code on your patient-facing scheduling pages. OCR has been explicit that tracking technologies on pages where patients authenticate and schedule can disclose PHI to third parties. Have your web vendor produce a written inventory of every script running on those pages.

The "conduit exception" does not rescue you here. It is narrow — think of a courier that transports sealed information without accessing it. A cloud video platform that stores session data is not a conduit, and neither is a scribe tool that keeps transcripts.

If your inventory turned up vendors operating without paper, close the gap before your next video block. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — which is faster than routing a redline through counsel for a $60-a-month scheduling add-on. Keep the executed copies in one folder, with an owner's name and a renewal date on each.

Place of Service, Modifiers, and the Note That Has to Support Them

This is administrative guidance about process, not a coding determination. Your billing lead and your clinicians own code selection; your job is to make sure the process is written down and the documentation supports whatever they choose.

Three structural facts shape the workflow. Distinct place-of-service codes exist to distinguish telehealth furnished in the patient's home from telehealth furnished elsewhere. Modifiers exist to flag synchronous audio-video and audio-only encounters. And payer policy on all of it varies — Medicare, Medicaid, and each commercial plan can differ, and they change on their own calendars.

Build a payer crosswalk and give it an owner

Maintain a single internal document that maps, for each major payer: which telehealth modalities are covered, which place-of-service and modifier combinations that payer expects, and what documentation elements the payer requires. Name one person who reviews it quarterly and after any published policy update. Date-stamp every revision, because the version in effect on the date of service is what an auditor cares about.

Medicare telehealth authority has moved in short legislative increments over the past several years, including at least one lapse during a funding gap. Do not build a revenue assumption on memory. Check the current rules on the CMS telehealth coverage page before each quarter's schedule build. The same caution applies to DEA telemedicine prescribing flexibilities, which have been extended by temporary rule more than once — confirm the current expiration date before any workflow depends on remote prescribing of controlled substances.

The documentation elements that survive an audit

Whatever your clinicians select, the note should establish: the modality actually used, the patient's physical location during the visit, the provider's location, who else participated, consent to the telehealth encounter, and start/stop or duration where the code family depends on time. If the visit started as video and dropped to audio-only, the note should say so — because that change may drive a different administrative treatment.

The Records Request That Now Includes a Video Recording

A patient asks for "everything from my telehealth visits." Your right-of-access clock is 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. That clock does not pause while you figure out which vendor holds the file.

Decide now, in writing, what belongs in your designated record set:

  • Recordings. If you record visits and use them to make decisions about the patient, treat them as part of the record. Many practices decide not to record at all — a defensible choice that eliminates an entire retrieval and retention problem.
  • In-session chat transcripts. If a clinician sent a dosing instruction in the chat panel, that content is clinical.
  • Ambient scribe drafts. Establish whether the draft is a working artifact deleted after the signed note is filed, or a retained record. Then confirm your vendor's actual deletion behavior matches your policy.
  • Platform-side data. Session metadata, waiting-room logs, and uploaded patient documents that never made it into the chart.

Ask each telehealth vendor four questions in writing: where is the data stored, how long is it retained by default, can we configure retention, and can we export it in a usable format within 15 days. If a vendor cannot answer, you have a records problem masquerading as a technology problem.

Your front desk needs a script, not instincts. At minimum, each telehealth encounter should confirm the patient's identity, capture the patient's physical location for that visit, and confirm the patient is somewhere they can speak privately. Location matters for licensure, for emergency response if the visit goes sideways, and for payer rules.

Staff-side privacy is equally operational. If clinicians or billers work from home, your policy should address screen positioning, headset use, household members, printed material, and device encryption. Put it in the remote-work addendum, train to it, and document the training.

One date to flag on the compliance calendar: the compliance date for the 2024 revisions to 42 CFR Part 2 — the substance use disorder confidentiality regulations — lands on February 16, 2026. If any part of your practice is a Part 2 program, or you receive Part 2 records, your consent forms, notices, and telehealth intake flows need to reflect those changes now, not in March.

Assign These Six Jobs by Name Before Your Next Video Block

  1. Vendor inventory owner. Maintains the list of every system touching telehealth PHI, with an executed BAA and renewal date for each.
  2. Payer policy owner. Maintains the telehealth crosswalk, reviews quarterly, date-stamps revisions.
  3. Records owner. Knows where every telehealth artifact lives and can produce it inside the 30-day access window.
  4. Training owner. Runs the front-desk script and the remote-work privacy module, and keeps the attendance log.
  5. Incident owner. Handles a dropped session that exposed the wrong patient, a recording emailed to the wrong address, or a vendor breach notice. Reviews the HHS breach portal periodically to see what is actually happening to practices your size.
  6. Risk analysis owner. Updates the security risk analysis whenever the telehealth stack changes — not annually by ritual, but on change.

That last one is where most telehealth programs are thinnest. Adding a platform, an interpreter service, and a scribe tool in the same quarter materially changes your risk picture, and the analysis is supposed to reflect it. NIST's SP 800-66r2 guide to implementing the HIPAA Security Rule is the most practical free reference for structuring that work. If you would rather not rebuild the documentation from scratch each time, tools that automate risk analysis reports and the supporting policy set will get you to a defensible baseline faster than a spreadsheet will.

One caution while you plan: HHS proposed significant Security Rule updates in January 2025, including stricter expectations around encryption, multi-factor authentication, and asset inventories. Treat those proposals as a direction of travel, not a current requirement, and watch for a final rule before you rewrite policy around them.

The Trade You're Actually Making

The telehealth benefits your practice enjoys — recovered appointments, freed exam rooms, better continuity for patients who can't take a half-day off work — are paid for in administrative discipline. Vendor paper, coding documentation, records retrieval, and training logs. That is the whole trade, and it is a good one when the second half gets staffed.

Start with the vendor list, because it is the fastest gap to close and the most likely to appear in an OCR data request. Pull the inventory this week, identify which telehealth vendors are operating without executed paper, and produce the business associate agreements you're missing before your next video block goes on the schedule.