# Telehealth Privacy Compliance Checklist — Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | |
| Telehealth Program Director | |
| Privacy Officer | |
| Assessment Date | |
| States of Operation | |

---

## Platform Compliance

### Approved Telehealth Platforms
| Platform | Vendor | BAA Executed | Security Assessment Date | Status |
|----------|--------|-------------|------------------------|--------|
| | | | | |

### Platform Security Requirements
- [ ] End-to-end encryption (AES-128+ / AES-256 preferred)
- [ ] TLS 1.2+ for all connections
- [ ] No unencrypted fallback
- [ ] Unique user authentication for providers
- [ ] Patient identity verification
- [ ] MFA for provider access
- [ ] Automatic session termination
- [ ] Session event logging
- [ ] Recording access audit logging
- [ ] Tamper-resistant logs
- [ ] 6-year log retention

---

## Recording Consent

### Two-Party Consent State Compliance
- [ ] Two-party consent states identified (CA, CT, DE, FL, IL, MD, MA, MI, MT, NH, PA, WA)
- [ ] Recording consent process configured per patient location
- [ ] Consent decision documented in encounter record
- [ ] Provider training on state-specific recording requirements

---

## Cross-State Practice

### Provider Licensing
| Provider | Home State | Licenses Held | Compact Member | Telehealth States Authorized |
|----------|-----------|--------------|----------------|----------------------------|
| | | | | |

### Prescribing Compliance
- [ ] Ryan Haight Act requirements documented and enforced
- [ ] State PDMP integration configured for patient's state
- [ ] E-prescribing platform HIPAA-compliant
- [ ] Controlled substance prescribing protocol documented

---

## Provider Environment

- [ ] Private room with closed door required
- [ ] No visible patient information behind provider
- [ ] Headphones/earbuds required
- [ ] Only managed/approved devices permitted
- [ ] No public locations for telehealth visits
- [ ] Workstation lock when stepping away

---

## Remote Patient Monitoring

- [ ] RPM vendor BAAs in place
- [ ] Patient informed consent obtained
- [ ] Device-to-cloud encryption verified
- [ ] Data collection limited to clinically necessary
- [ ] Minimum necessary notifications (minimize PHI content)
- [ ] Disenrollment and device wipe procedures documented

---

## Approval

| Role | Name | Date |
|------|------|------|
| Privacy Officer | | |
| CISO | | |
| Telehealth Program Director | | |