# Telehealth Privacy — Standards and References

## Primary Legal Sources

### Federal
- **HIPAA Privacy Rule (45 CFR Part 164, Subpart E)** — applies to all telehealth encounters creating, transmitting, or storing PHI
- **HIPAA Security Rule (45 CFR Part 164, Subpart C)** — technical safeguards for telehealth platforms (encryption, access controls, audit logs)
- **HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D)** — notification required for breaches of telehealth ePHI
- **Ryan Haight Online Pharmacy Consumer Protection Act** (21 USC §829(e)) — telehealth prescribing of controlled substances; in-person evaluation requirement with exceptions
- **DEA Proposed Rule on Telehealth Prescribing** (2024) — proposed pathways for initial telehealth prescribing of Schedule III-V controlled substances

### OCR Enforcement Discretion
- **85 FR 22024** — OCR Notification of Enforcement Discretion for Telehealth (March 17, 2020)
- OCR enforcement discretion expired August 9, 2023 (90 days after PHE ended May 11, 2023)

### State Laws
- **Interstate Medical Licensure Compact (IMLC)** — expedited multi-state physician licensure (42 states + DC + Guam)
- **Nurse Licensure Compact (NLC)** — multistate RN/LPN license (41 states)
- **Psychology Interjurisdictional Compact (PSYPACT)** — telepsychology across member states (42 states)
- **State recording consent laws** — two-party (all-party) consent states: CA, CT, DE, FL, IL, MD, MA, MI, MT, NH, PA, WA
- **State telehealth practice acts** — individual state requirements for telehealth practice, consent, and standard of care

## Platform Security Standards
- **NIST SP 800-66 Rev. 2** — HIPAA Security Rule implementation guide
- **SRTP (RFC 3711)** — Secure Real-time Transport Protocol for encrypted media streams
- **WebRTC Security Architecture** — browser-based telehealth encryption standards
- **SMART on FHIR** — authorization framework for EHR-integrated telehealth