Your telehealth platform can win over clinicians in the demo and still stall at the hospital’s security review. What stalls it is usually three documents. A signed BAA, a recent penetration test and a SOC 2 Type II report. For telehealth vendors SOC 2 Type II and HIPAA compliance is now the price of entry to hospital contracts.
The SOC 2 Type II report is the one that catches vendors out. An auditor can only issue it after 3 to 12 months of evidence, so a vendor who starts when the hospital asks is already months behind. The “HIPAA compliant” badge on your website won’t bridge that gap. HHS certifies no one, so hospital security teams give the badge no weight.
However, the two frameworks overlap, so one program can satisfy both if you build it around what hospital security teams actually check.
What Is a Telehealth Vendor, and Why Does Compliance Apply to You?
A telehealth vendor is any company whose technology delivers, supports or records remote care for a healthcare provider.
What Types of Companies Count as Telehealth Vendors?
Most telehealth companies fall into one or more of these groups:
- Virtual visit and video consultation platforms
- Remote patient monitoring (RPM) and connected-device companies
- Asynchronous care, e-visit and patient messaging apps
- E-prescribing, scheduling and patient intake tools
- AI scribes and clinical documentation tools
- Telehealth APIs and infrastructure built into EHRs
In each case, patient data passes through or sits inside systems you run.
Is a Telehealth Vendor a HIPAA Business Associate?
If your product creates, receives, stores or sends patient health information on a provider’s behalf, HIPAA treats you as a business associate.
As a business associate, you sign a business associate agreement (BAA) and take direct legal liability under the HIPAA Security Rule. Any supplier of yours that handles the same data needs a BAA with you too.
HIPAA has one narrow exception. It covers “conduits” that pass data along without storing or accessing it, such as an internet service provider. Most telehealth platforms don’t qualify, because they store session recordings, chat logs, clinical notes or device readings.
Why Are Telehealth HIPAA Compliance Reviews Getting Stricter?
During the pandemic, HHS let providers run telehealth visits over everyday apps such as FaceTime and Skype without penalty. That allowance ended in August 2023. Providers are again responsible for choosing compliant vendors, and hospital security teams now check every telehealth vendor before a pilot.
The next step is already proposed. HHS’s Security Rule update would require annual penetration tests and multi-factor login. It would also require providers to get written confirmation from each business associate, every year, that its security safeguards are in place. In practice, hospitals will send you that request annually. The final rule is expected in July 2027, and vendors who meet it now will clear reviews without rework.
The question for telehealth vendors is how to meet HIPAA and SOC 2 Type II without doing the work twice. It starts with knowing what hospitals expect from each.
Telehealth HIPAA compliance:What Hospitals Ask Beyond the SOC 2 Report
Hospitals often start by asking for a signed Business Associate Agreement (BAA) and a SOC 2 Type II report. But for telehealth vendors, the review usually goes further.
Hospitals want to know where patient data goes, who can access it, what your AI tools record, and whether your platform meets privacy laws beyond HIPAA.
HIPAA has no official certificate, so this report is your proof. A Type 1 report can get you a pilot. For a full contract, you’ll need Type 2. Our SOC 2 vs HIPAA guide explains how the two frameworks differ.
How Do You Prove the Patient Data You Capture Is Secure?
Hospitals may ask for a diagram showing where patient information goes, from the first video consultation to its eventual deletion.
Your diagram should cover how you collect, transfer, store, share, and delete patient data. Include copies kept in recordings, backups, support tickets, and AI tools.
Your data map should cover:
- Data collection: Where patients enter information, such as a mobile app, website, or monitoring device.
- Data transfer: How patient information moves between your platform and other services.
- Data storage: Where you keep patient records, recordings, and backups.
- Additional copies: Whether patient data appears in error logs, support tickets, analytics tools, or AI services.
- Data deletion: When you delete patient information and whether you remove copies from other systems.
One way to check your diagram is to complete a test consultation and search your systems for the test patient’s information. You may find unexpected copies in error logs, support tickets, or employee screenshots.
HHS has also proposed requiring organizations to maintain written records of where electronic patient information is stored and how it moves.
Can You Use Real Patient Data for Testing?
Using real patient data in development or testing creates unnecessary privacy risks.
Developers sometimes copy patient records into test systems to reproduce bugs or demonstrate features. However, these systems may not have the same security measures as the live platform.
HIPAA protections still apply to patient information, even when you use it for testing. Use made-up or properly de-identified records whenever possible. If developers need real data to investigate a problem, limit access and record their activity.
What Do Hospitals Scrutinize in Voice AI and Ambient AI Scribes?
Voice AI introduces privacy and security concerns that hospitals may not encounter with ordinary text-based features.
Hospitals usually examine four areas.
1. What Information Does The AI Record?
A voice recording can identify a patient even when you remove their name from the written transcript.
Patients may say their names, dates of birth, or other personal details during a consultation. Their voices may also contain information that identifies them.
HIPAA includes voice prints among the identifiers that organizations must remove when using its Safe Harbor method of de-identification.
Hospitals want to know what your platform records, how long it keeps recordings, and who can listen to them.
2. Does The AI Record Other People In The Room?
An AI medical scribe may capture conversations with family members, caregivers, or interpreters.
In shared spaces, it might also record people who are not part of the consultation.
Hospitals may ask when recording begins, when it stops, and how clinicians control what the AI captures.
3. Which AI Companies Receive The Recordings?
Your platform may send audio to one company for transcription and another to generate clinical notes.
Each company that handles protected patient information needs appropriate HIPAA agreements and safeguards.
Hospitals may also ask whether those providers store recordings or use patient information to train their AI models.
Your contracts should clearly explain how each provider can use, retain, and delete the information.
Our AI BAA compliance guide covers the contract terms you should review.
4. Can Someone Trick The AI Into Revealing Patient Information?
AI systems can respond to instructions hidden in patient conversations or written messages.
For example, someone might try to make an AI assistant retrieve another patient’s information or ignore restrictions on what it can share.
Hospitals may ask whether you have tested these scenarios. A regular penetration test may not cover attacks that specifically target AI features.
You should also have a clear policy for deleting voice recordings. If your platform only needs the approved clinical note, keeping the original recording longer than necessary creates additional risk.
Can Offshore Teams Access Patient Data?
HIPAA does not generally prohibit employees or vendors outside the United States from accessing patient information.
However, your hospital contracts and state laws may place additional restrictions on where you store data and who can access it.
For example, certain Texas Medicaid contracts restrict offshore access to state data. Florida also limits where certain healthcare providers can store electronic patient records. Those requirements can affect vendors working with these organizations.
If you have developers, support employees, or service providers outside the United States, hospitals may ask:
- Which employees can access patient records?
- Which countries do they work from?
- What information can they view or change?
- Do any outside companies have access to the same records?
Review your hospital contracts before giving offshore teams access. Your BAA needs to include restrictions that go beyond HIPAA’s general requirements.
How Do Telehealth Apps Prevent Accidental Patient Data Exposure?
Hospitals also review how your mobile app displays and stores patient information.
For example, a patient might receive an appointment notification while someone else is holding their phone. If that notification includes a diagnosis or test result, it could reveal sensitive information.
The same risk applies when patient details remain visible after someone closes the app.
Hospitals may check whether:
- Notifications protect privacy. A message says “You have a new message” instead of displaying a diagnosis or test result.
- Patient information stays protected after logout. The app removes or securely protects locally stored records, images, and files.
- Other apps cannot easily reveal patient screens. The app hides sensitive information when someone switches between apps.
- Inactive sessions expire. The app asks users to sign in again after a period of inactivity.
These details matter because patients often use telehealth apps on personal phones that other people may see or access.
How Should Telehealth Platforms Handle Proxy Access and Minors?
Parents and caregivers should have separate accounts instead of sharing the patient’s login. This helps hospitals see who accessed each record.
For minors, access depends on state law and the type of treatment. Some states allow teenagers to receive certain mental health, sexual health, or substance use services without parental consent.
Your platform must be able to restrict parental access where the law requires it.
Which Rules Apply to Telehealth Vendors Beyond HIPAA?
Three additional rules may affect your telehealth platform:
- 42 CFR Part 2: Certain substance use disorder treatment records have additional consent and disclosure requirements. Compliance with the updated rule was required by February 16, 2026.
- State privacy laws: California’s Confidentiality of Medical Information Act and Washington’s My Health My Data Act can cover health information and businesses beyond HIPAA’s scope.
- FTC Health Breach Notification Rule: Some direct-to-consumer health apps fall outside HIPAA but must follow separate breach notification requirements.
If your company offers both hospital software and a consumer health app, different rules may apply to each service. Auditors will also want to see how your platform manages video consultations, recordings, and outside vendors in practice.
What SOC 2 Type II and HIPAA Auditors Check on a Telehealth Platform
On a telehealth platform, auditors and hospital security teams focus on four things. How video is encrypted, how recordings are stored and deleted, which providers have signed BAAs, and whether your controls ran every day of the audit period. Most of these questions first reach you through the hospital’s security questionnaire.
What Security Questionnaires Do Hospitals Send Telehealth Vendors?
Expect one before any contract or pilot. Some hospitals write their own. Many use standard ones: the SIG (Standardized Information Gathering) questionnaire, its shorter SIG Lite version, or the Cloud Security Alliance’s CAIQ for cloud services.
A current SOC 2 Type II report takes a large share of the questions off the table, because the hospital can read the tested answer instead of your written one. The questions left over are usually HIPAA-specific: your BAA terms, your breach notification process, encryption and data retention. The next three sections cover each one.
Does HIPAA Require Encryption for Telehealth Video?
Today, HIPAA lists encryption as “addressable”. You must encrypt patient data unless you document why it isn’t reasonable and use an equivalent safeguard instead. For telehealth video, that argument rarely holds up. HHS’s proposed Security Rule update would make encryption of patient data, both in transit and in storage, a firm requirement.
Encryption also protects you after an incident. Under HHS rules, if lost or stolen patient data was properly encrypted and the key wasn’t exposed, the loss isn’t a reportable breach.
Most browser-based video already encrypts audio and video in transit by default. The question hospitals actually ask is where the video is decrypted. On most platforms your servers can see the stream, which you need for recording, transcription or AI notes. With end-to-end encryption, only the participants can see it, but you usually lose those features.
How Should a Telehealth Vendor Store Session Recordings?
Treat every recording as patient data. Record only when the provider turns recording on, limit access to named roles, log every view and download, and delete on a set schedule.
HIPAA doesn’t set a retention period for recordings. The six-year rule people quote applies to your HIPAA policies and compliance documents, not to patient records. Retention for medical records comes from state law and the provider’s own policy. As a vendor, follow the retention terms in your BAA, and return or destroy the data when the contract ends.
Two details often get missed:
- Copies: Deletion must cover backups, transcripts, AI-generated notes, and files sent to transcription services, not just the original video.
- Consent: Some US states like California, Florida, Maryland, Washington etc. require every participant’s consent before a call is recorded. Telehealth calls often cross state lines, and the strictest state’s rule usually applies, so ask every participant for consent on every recording. Show the request on screen and log each “yes” with the session record. That log is your evidence if a recording is ever challenged.
Which BAAs Does a Telehealth Vendor Need with Video and EHR Providers?
Beyond your BAA with each healthcare provider, you need a BAA with every vendor that can touch patient data. For a telehealth platform, that usually includes:
- Video and communications providers: Many offer a BAA only on specific paid plans. Confirm this before you build on them.
- Cloud hosting and databases.
- AI transcription and note-taking services.
- Logging, error-tracking and analytics tools: These often capture patient names or IDs from web addresses and error messages without anyone noticing. Either sign BAAs with these tools or strip out patient data before it reaches them. Tracking scripts on pages behind a patient login create the same risk.
However, the EHR connections work differently. The EHR company works for the hospital, so your BAA is with the hospital, not the EHR company. If you connect through an integration platform that sits between you and the EHR, that platform is your supplier and needs a BAA with you.
How Do Auditors Test Controls During a SOC 2 Type II Audit Period?
Auditors don’t take your word that a control ran. They ask for a full list of every time it should have happened, pick a sample, and check the evidence for each one.
For example, the auditor asks for everyone who left your company during the period, picks several names, and checks that each person’s access was removed within the time your policy sets. On a telehealth platform, auditors commonly test the same way for:
- Multi-factor login on every account that can see patient data
- Session links that expire, and waiting rooms that stop uninvited guests
- Regular reviews of who has access to recordings and notes
- Log reviews, backup restore tests and security training
- Follow-up on penetration test findings
Three things follow:
- Every control must run from day one of the period. A control you start halfway through can’t be tested for the whole period.
- Any missed occurrence becomes an “exception” in your report. Hospitals read the exceptions section closely.
- Evidence must be dated and kept. That means screenshots, tickets, meeting minutes and sign-offs. A control that ran but left no record counts as a control that didn’t run.
If you also need HIPAA covered, a SOC 2 + HIPAA report tests the HIPAA Security Rule requirements in the same period, with one round of evidence requests and one report to send hospitals. It still doesn’t cover your Privacy Rule or breach notification duties, so handle those separately.
What Is a SOC 2 Bridge Letter?
A bridge letter covers the gap between the end of your last SOC 2 audit period and today. Your management writes and signs it, not the auditor. It confirms that no major changes or security incidents have happened since the period ended.
Hospitals ask for one when your report is a few months old, and most accept a bridge letter for a short gap only. Plan your audit cycle so you always have a current report when a hospital review starts.
A clean audit tells hospitals what you do. Getting there is faster with a team that has run these audits before.
How KLEAP Helps Telehealth Vendors Get Audit-Ready
KLEAP takes telehealth vendors from their first gap assessment to a SOC 2 Type II report that hospitals accept. Every client gets one dedicated lead, and we build only what your buyers and regulators ask for.
- Gap assessment: We check your current practice against every SOC 2 and HIPAA requirement, then give you a prioritized list of what to fix before your audit period starts.
- SOC 2 implementation: Policies written from how your team actually works, plus the processes that produce the evidence auditors sample.
- Manual penetration testing: Web, mobile, API, cloud and AI testing. Every finding is confirmed by hand and documented with proof, so hospitals see real risk, not scanner output.
- Ongoing advisory: Virtual CISO support and risk assessments that keep controls running between audits, so your next report has no exceptions to explain.
Talk to us about SOC 2 Type II and HIPAA for your telehealth platform.
Frequently Asked Question
How much does SOC 2 Type II cost for a telehealth vendor?
Budget for four separate costs: the CPA firm’s audit fee, readiness and implementation work, a penetration test, and any compliance software. All four recur every year, because hospitals expect a new report annually. Compliance platforms often charge around $6,000 a year, plus $6,000 to $10,000 for the auditor’s sign-off, before any implementation work. KLEAP’s manual penetration tests start at $800 for a small web application.
Can a telehealth vendor fail a SOC 2 audit?
Not in a pass-or-fail sense. The auditor issues an opinion. A “clean” (unqualified) opinion means your controls worked. A “qualified” opinion means some failed badly enough to affect the result. Hospitals treat a qualified opinion as a red flag. Individual exceptions in a clean report are usually accepted if each one comes with your explanation and fix.
Can you share a SOC 2 report publicly?
No. A SOC 2 report is shared only under a non-disclosure agreement, usually after a hospital signs one. For your website, ask your auditor for a SOC 3 report, a short public summary of the same audit. It won’t replace the SOC 2 report in a security review, but it tells hospitals early that one exists.
Who can perform a SOC 2 audit?
Only a licensed CPA firm can issue a SOC 2 report. The firm that helps you prepare can’t also audit you, because the auditor must be independent. KLEAP prepares you for the audit and runs your penetration testing. A separate CPA firm issues the report.
How long is a SOC 2 report valid?
A SOC 2 report has no formal expiry date. In practice, hospitals expect a report whose audit period ended within the last 12 months. Between reports, a bridge letter covers the gap.
