OCR Issues Resources to Educate Patients about Telehealth and the Privacy and Security of Protected Health Information

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services has issued two resource documents to help explain to patients the privacy and security risks to their protected health information (PHI) when using telehealth services and ways to reduce these risks.

The first resource is for healthcare providers titled “Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth.” Although healthcare providers are not required by the HIPAA Rules to provide this education, the resource supports the continued and increased use of telehealth by providing information to help healthcare providers who choose to discuss telehealth privacy and security with patients. The resource provides suggestions for discussing telehealth options offered; risks to PHI when using remote communications technologies; privacy and security practices of remote communication technology vendors; and applicability of civil rights laws

OCR also issued a resource for patients titled “Telehealth Privacy and Security Tips for Patients,” which provides recommendations that patients can implement to protect and secure their health information such as conducting a telehealth appointment in a private location; turning on multi-factor authentication if available; using encryption when available; and avoiding public Wi-Fi networks.

“Telehealth is a wonderful tool that can increase patients’ access to healthcare and improve healthcare outcomes,” said OCR Director Melanie Fontes Rainer. “Healthcare providers can support telehealth by helping patients understand privacy and security risks and effective cybersecurity practices so patients are confident that their health information remains private.”

The Guidance on Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth can be accessed at www.hhs.gov/hipaa/for-professionals/privacy/guidance/resource-health-care-providers-educating-patients/index.html.

The Guidance on Telehealth Privacy and Security Tips for Patients can be accessed at www.hhs.gov/hipaa/for-professionals/privacy/guidance/telehealth-privacy-security/index.html.