HCIS 352 Week 5 Healthcare Information Data Compliance Example

After the Emergency Rules Ended: Bringing a Behavioral Health Clinic's Telehealth Video, Chat and Recording Practices Into Data Compliance

[Student Name]

University of Phoenix

HCIS/352: Foundations of it in the Health Care Environment

Week 5 Assignment

[Instructor Name]

[Date]

The clinic, its practices and its changes are composites written for a model paper; legal requirements come from the sources listed.

In March 2020, a composite outpatient behavioral health clinic with 14 therapists and two psychiatric nurse practitioners moved almost overnight to video visits. Therapists used whichever popular video and messaging apps their clients could manage. Some recorded sessions, with consent, so supervisors could review trainees' work. Clients texted therapists' personal phones to reschedule. The arrangement kept care going through the pandemic. Three years later, the clinic's new compliance officer asked a simple question: where is all of this data, and are we allowed to keep it this way? This paper answers her question.

What the Emergency Rules Allowed

During the COVID-19 public health emergency, federal regulators said they would not penalize providers who used everyday video chat tools for telehealth in good faith, even without business associate agreements. That enforcement discretion ended in May 2023, after a transition period, and providers were expected to use platforms that meet HIPAA's requirements (U.S. Department of Health and Human Services, 2023). The clinic had never gone back to check.

Live Video

Telehealth platforms that transmit and store protected health information for the clinic are business associates and must sign a business associate agreement and meet the Security Rule's safeguards. The clinic's therapists used three different consumer apps, none under an agreement. The fix is to adopt a single telehealth platform, sign an agreement, configure waiting rooms and access controls and retire the consumer apps for clinical use.

Recordings

Session recordings are among the most sensitive data a behavioral health clinic holds. The review found 340 recordings stored in a consumer cloud folder shared by supervisors, some more than two years old. A recording kept for training but never deleted becomes a store of intimate conversations that serves no current purpose and carries risk every day it exists. The fix is a recording policy: record only for defined supervision purposes with written consent, store recordings only in the approved platform, restrict access to the supervisor and trainee, and delete them within 60 days of review.

Chat and Text Messages

Scheduling texts to personal phones mixed protected health information with personal devices. The clinic will move client messaging to the patient portal and the telehealth platform's messaging feature, and therapists will stop using personal numbers for client contact. Old messages on personal phones will be deleted after any clinically relevant content is summarized in the record, and therapists will confirm the deletion in writing to the compliance officer.

Scheduling and Other Data

The online scheduling tool, reminder texting service and a transcription feature therapists tried briefly all handled client data. Each vendor must either sign a business associate agreement or be removed.

Patient Access and Information Blocking

Clients may obtain the records in their designated record set, and federal policy now expects electronic health information to be shared with patients without unreasonable barriers. Rosenbloom et al. (2019) explained that three federal laws, HIPAA, HITECH and the 21st Century Cures Act, each push toward letting patients get their records electronically without charge, while noting inconsistencies in how the laws define what information is included. The clinic's policy will state which telehealth data, such as visit notes and messages that inform care, belong to the record and are available to clients, and which, such as supervision recordings deleted after review, do not.

Additional Protections for Behavioral Health

Psychotherapy notes kept separately by a therapist have special protection under HIPAA and are generally excluded from the right of access. State laws may add consent requirements for mental health information. The clinic's attorney will review its policies against state law.

Training and Accountability

Policies change nothing unless therapists know them. Every clinician will complete a 30-minute training on the new platform, recording and messaging rules, and each will sign an attestation that personal phones no longer hold client messages. Supervisors will confirm that recordings are deleted after review. The clinic director will hear quarterly from the compliance officer on training completion and any incidents, and a missed deletion or a personal-phone message will be handled first as a coaching conversation, then as a policy violation if it repeats.

Retention and Disposal

The clinic will adopt a retention schedule: clinical records kept for the period state law requires, supervision recordings for 60 days, scheduling messages for one year. Disposal will be documented, and vendors will certify deletion when contracts end.

Security Settings on the New Platform

Choosing a compliant platform is only the start; it must be configured well. The clinic will require multifactor login for clinicians, lock virtual waiting rooms so only invited clients enter, disable local downloading of recordings, set automatic logout after inactivity and turn on audit logging. Clients will join through links sent from the portal rather than by email or text. These settings put the Security Rule's technical safeguards into practice on the tool therapists use every day.

A Compliance Inventory

The compliance officer will maintain an inventory listing each system that holds client data, its vendor, whether a business associate agreement is signed, what data it holds, its retention rule and its owner. The inventory is the backbone of the program because the clinic cannot protect data it does not know it has.

Annual Audit Cycle

Each year the compliance officer will update the inventory, check a sample of recordings and messages for policy compliance, review access logs on the telehealth platform, confirm business associate agreements and report results to the clinic director. The Security Rule's requirement for ongoing risk analysis and review of safeguards (U.S. Department of Health and Human Services, 2022) will be met through this cycle.

Conclusion

Telehealth kept the clinic open in a crisis, but it scattered sensitive data across consumer apps, personal phones and shared folders. With the emergency rules ended, the clinic must bring each data type under agreements, access controls, clear retention and deletion, patient access policies and an annual audit, so that remote care can continue on a compliant footing.

References

Rosenbloom, S. T., Smith, J. R. L., Bowen, R., Burns, J., Riplinger, L., & Payne, T. H. (2019). Updating HIPAA for the electronic medical record era. Journal of the American Medical Informatics Association, 26(10), 1115-1119. https://doi.org/10.1093/jamia/ocz090

U.S. Department of Health and Human Services. (2022). Summary of the HIPAA security rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

U.S. Department of Health and Human Services. (2023). HIPAA and telehealth. https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html