Telehealth Privacy Risks: 3 Threats, HIPAA vs. FTC, and Your Checklist

Learn More
Learn More
Get started today
Learn More

The main telehealth privacy risks fall into three buckets: environmental (being overheard or recorded at home), technical (weak links, unpatched apps, hidden tracking tools), and operational (staff errors, vendors without proper agreements). HIPAA and the FTC’s Health Breach Notification Rule oversee different parts of this landscape, so protection varies by app. The fastest way to lower your exposure: use a private space and your own device, keep software updated with multi-factor authentication turned on, and ask your provider directly about HIPAA coverage and data-sharing practices.

TL;DR:

  • HIPAA covers providers and contracted vendors through Business Associate Agreements; many standalone health apps instead fall under the FTC’s Health Breach Notification Rule.
  • Use your provider’s verified link on an updated device, enable multifactor authentication, and choose a private home network over public or shared connections.
  • For video visits, choose a private background; chat creates a stored written record, while audio removes visual exposure but still carries encryption and metadata risks.
  • After a breach, check whether notices identify exposed information; report HIPAA complaints to HHS’s Office for Civil Rights and consumer app complaints to the FTC.
Zealthy
Choose Virtual Care With Confidence
Zealthy brings primary care, mental health services, and specialized treatments together in one virtual healthcare platform.
Visit Zealthy

Table of Contents

Risk categories explained: environmental, technical, and operational

A systematic review of telehealth privacy and security research grouped the major risk factors into three categories, and that framework still holds up well for patients trying to make sense of what could go wrong during a virtual visit.

Environmental risks involve your physical surroundings. If you take a therapy call in a shared living room, a roommate or family member can overhear details you’d rather keep private. Smart speakers and connected cameras in the room may passively record audio. Using a work laptop for a personal health visit also creates risk, since employers can sometimes access browsing history or files on company-owned devices.

Technical risks live inside the software and infrastructure. An insecure video link, meaning one that isn’t properly encrypted, can expose the content of your session to interception. Unpatched apps and operating systems leave known security holes open longer than necessary. Many telehealth and health information websites also embed tracking pixels and cookies that quietly collect metadata about your visit, sometimes without clear disclosure.

Operational risks come from how a healthcare organization or vendor actually runs its systems day to day. These include staff accidentally viewing or sending records to the wrong patient, misconfigured patient portals that expose more data than intended, and third-party vendors receiving access to health information without a signed Business Associate Agreement obligating them to protect it.

  • Environmental: overheard conversations, smart-home devices recording nearby, shared or work-issued devices used for personal visits.
  • Technical: insecure or unencrypted video links, outdated software, tracking pixels and cookies collecting visit metadata.
  • Operational: staff access mistakes, misconfigured online portals, vendors handling data without a Business Associate Agreement in place.

The same review found that operational and environmental failures, things like training gaps and the absence of a private space, show up in practice more often than the dramatic hacking incidents that make headlines. That matters because it means your own habits, not just a provider’s cybersecurity budget, play a real role in how protected your information stays.

Regulatory and enforcement overview: HIPAA, the FTC, and HBNR

Understanding who regulates your telehealth data starts with a simple distinction: not every health app is covered by HIPAA.

HIPAA applies to “covered entities,” meaning doctors, clinics, hospitals, and health plans, along with their “business associates,” the vendors and contractors who handle protected health information on their behalf. When a covered entity shares data with a vendor, a Business Associate Agreement legally binds that vendor to HIPAA’s privacy and security standards, including breach notification obligations. If your provider doesn’t confirm a BAA is in place with the tools they use, that’s worth asking about directly.

Plenty of popular health apps, though, fall outside HIPAA entirely because they aren’t run by a covered entity or business associate. Think of standalone wellness apps, period trackers, or symptom checkers you download directly. These fall under the Federal Trade Commission’s jurisdiction instead, including the Health Breach Notification Rule, which the FTC updated to clarify that it covers health apps and to expand notification requirements when personal health records are breached.

Enforcement has made this distinction concrete rather than theoretical. The FTC banned BetterHelp from sharing users’ sensitive health-related data with advertisers after finding the company had done so without adequate consent. That action signaled that regulators are treating metadata about mental health and medical concerns as sensitive information deserving real protection, even when it isn’t technically “protected health information” under HIPAA.

  • HIPAA covers doctors, clinics, and their contracted vendors through Business Associate Agreements.
  • FTC and HBNR rules cover many consumer-facing health apps that HIPAA doesn’t reach.
  • Both frameworks require some form of breach notification, though the specifics differ.

One enforcement action from the FTC banned a major telehealth platform from sharing sensitive health data for advertising purposes, a signal that regulators are closing the gap between what HIPAA covers and what consumers actually expect from any app handling their health information.

Common incidents and anonymized examples from enforcement and literature

Reviewing documented patterns in enforcement actions and research helps make these abstract risk categories concrete.

  1. Metadata shared through tracking pixels. Health platforms have embedded advertising pixels that pass along details about a visit, sometimes including what condition a user searched for or sought care about, to ad networks without clear consent, enabling targeted advertising or even identification.
  2. Portal misconfiguration exposing records. Technical errors in patient portal setup have allowed overlapping sessions or incorrect permissions, letting one patient’s records become visible where they shouldn’t be.
  3. Employee access and account control failures. FTC enforcement against Cerebral highlighted operational failures including inadequate controls over who could access sensitive records internally, along with data-sharing practices that weren’t disclosed to patients, and even difficulty for some patients in canceling subscriptions and closing accounts.

These examples share a common thread: the failures weren’t exotic hacking operations. They were disclosure gaps, access control oversights, and unclear data practices, the kind of operational weak points that a patient asking the right questions upfront can sometimes catch before they become a problem.

Actionable patient safeguards: a checklist for before, during, and after telehealth visits

Protecting your information during telehealth doesn’t require technical expertise. HHS/OCR guidance outlines specific, practical steps patients can take at each stage of a virtual visit, and providers are encouraged to walk patients through vendor practices as part of that process.

Before your appointment:

  • Review the platform’s privacy policy to see what data it collects and whether it shares information with third parties.
  • Confirm you’re using the vendor and link your provider actually sent, rather than a forwarded or bookmarked alternative.
  • Enable multi-factor authentication on your patient portal account if it’s offered.
  • Update your device’s operating system and any telehealth apps before the visit, since outdated software is more vulnerable to known exploits.

During your appointment:

  • Take the call from a private room, or use headphones if privacy isn’t fully available.
  • Turn off or move away from smart speakers, voice assistants, and connected cameras in the room.
  • Double-check that the meeting link matches what your provider’s office confirmed, especially if you received it by text or email.

After your appointment:

  • Delete any recordings, screenshots, or downloaded files related to the visit that you no longer need stored locally.
  • Monitor your patient portal and any linked financial accounts for unusual activity in the following weeks.
  • If you want your data removed or want to understand how long it’s retained, ask your provider about their retention policy directly; you have the right to ask.

Pro Tip: Create a dedicated, strong password for your patient portal rather than reusing one from another account, since a breach anywhere else online won’t put your health records at risk too.

Our own patient checklist on telehealth privacy walks through these same before-during-after steps in more detail, including how to verify a provider’s identity before your first virtual visit.

Small habits compound. A private room and an updated phone won’t stop every risk, but together with a provider who takes transparency seriously, they close off the most common and most preventable gaps.

Provider responsibilities and questions patients should ask

Providers carry real obligations here, and you’re entitled to ask direct questions before committing to a platform or a visit.

  1. Ask whether your provider is a HIPAA-covered entity, and whether they sign Business Associate Agreements with every vendor that touches your health information, including scheduling tools, messaging apps, and prescription delivery partners.
  2. Ask what third-party vendors are involved in your care, whether any tracking technologies like pixels or analytics cookies are active on the platform, and how long your records are retained after your relationship with the provider ends.
  3. Ask about staff training and access controls, including who within the organization can view your records, and what the process looks like if a breach or complaint occurs.

HHS guidance frames this as a shared responsibility: providers should proactively disclose vendor names and privacy practices, while patients handle the location and device precautions on their end. A provider who hesitates or can’t answer basic questions about vendor agreements and data handling is giving you useful information, even if it’s not the answer you wanted.

These same questions apply to administrative processes connected to your care, like prior authorization workflows, where your information often passes through additional systems beyond the video visit itself.

Technical controls explained for patients: encryption, MFA, and secure Wi-Fi

A few technical terms show up constantly in telehealth privacy discussions, and understanding them helps you evaluate what a provider or app is actually promising.

Encryption in transit, typically via TLS (Transport Layer Security), protects the content of your video call or messages while they travel between your device and the provider’s server. Encryption at rest, often AES-256, protects your records once they’re stored on a server or backup system. NIST guidance treats these as distinct safeguards, so when a platform claims “secure” communication, it’s reasonable to ask which type of encryption they mean and whether both are in place.

Multi-factor authentication adds a second verification step beyond your password, usually a code sent to your phone, and meaningfully reduces the risk that a stolen password alone gives someone access to your account. Pair it with a strong, unique password you don’t reuse elsewhere.

  • Public Wi-Fi networks at coffee shops or airports are easier for others on the same network to intercept, so a private home connection is safer for telehealth visits.
  • Metadata, including your IP address and device identifiers, can reveal your approximate location and device type even if the content of your conversation stays encrypted.
  • Tracking pixels and cookies embedded in a health platform’s website can leak information about what pages you visited or what condition you searched for to third-party advertisers.

None of these controls require you to become a security expert. Knowing the vocabulary is usually enough to ask a provider a pointed question and recognize a vague or evasive answer when you hear one.

Breach response and notification: what to expect if your data is exposed

If a breach affects your telehealth data, the path to notification depends on which regulatory framework covers the platform involved.

Under HIPAA, covered entities and their business associates generally must notify affected patients without unreasonable delay. Under the FTC’s updated Health Breach Notification Rule, many health apps outside HIPAA’s scope now face clarified and expanded notification duties when personal health records are exposed. The exact timeline can vary, but a proper notification should tell you who was affected, what specific information was exposed, and what steps the organization is taking in response.

  • A breach notice should identify what type of data was exposed, such as names, diagnoses, or billing information, not just that “a breach occurred.”
  • You have the right to ask the organization directly what corrective steps they’ve taken and whether law enforcement was involved.
  • Complaints about a HIPAA-covered entity go to the HHS Office for Civil Rights; complaints about a non-HIPAA health app go to the FTC.

One finalized FTC action in 2024 expanded breach notification requirements specifically for health apps that previously sat in a regulatory gray area, closing a loophole that had let some consumer health apps avoid clear disclosure obligations.

If you learn your data was exposed, change your portal password immediately, review connected accounts for unusual activity, and consider a credit freeze if financial information was part of the breach. Filing a complaint with OCR or the FTC also helps regulators track patterns across providers.

How Zealthy addresses telehealth privacy and patient education

We built our telehealth privacy checklist so patients have a practical, step-by-step way to verify protections before a visit rather than taking a platform’s word for it. Our consent to telehealth process explains, in plain language, how we handle out-of-state authorization and what patients agree to before a visit begins.

  • We document our safeguards and consent practices rather than leaving them buried in dense legal text.
  • Our clinicians receive training on handling patient information appropriately across every service line we offer.
  • We encourage patients to ask the same vendor and data-handling questions outlined throughout this article.

Emerging telehealth-specific privacy risks tied to AI and machine learning

Artificial intelligence is increasingly woven into virtual care, from chatbots that triage symptoms to tools that transcribe and summarize visit notes. These tools introduce privacy considerations that didn’t exist in traditional telehealth a few years ago.

An AI system that transcribes your visit needs to process the audio somewhere, and where that processing happens, and how long the transcript is retained, matters. If a third-party AI vendor handles transcription or summarization, that vendor needs the same contractual protections, including a Business Associate Agreement where HIPAA applies, as any other data handler touching your records.

Telehealth audio processed into a retained transcript

Machine learning models trained on patient data also raise a separate question: is your information being used to improve the underlying model, and if so, has that use been disclosed and consented to? Not every platform makes this clear in accessible language. Before relying on an AI-assisted telehealth tool, it’s reasonable to ask your provider whether an AI vendor is involved in your visit at all, what role it plays, and whether your information is used beyond your individual care. The same disclosure principles that apply to any third-party vendor apply here, even though the technology is newer.

Implications of using consumer-grade apps and devices within telehealth sessions

Joining a telehealth visit through a consumer messaging app instead of your provider’s dedicated platform introduces risk that’s easy to overlook. Many popular messaging and video apps weren’t built with healthcare privacy standards in mind, and some may not support a Business Associate Agreement at all, meaning your provider can’t legally use them for protected health information in the first place.

The devices you use matter too. A smart speaker left running in the next room, a fitness tracker syncing health data to its own separate app, or a shared tablet with saved login credentials for someone else can all create unintended exposure. Consumer-grade devices often prioritize convenience features, like voice activation or automatic syncing, over the kind of access controls that healthcare data handling calls for.

The safest approach is sticking to whatever platform or app your provider specifically directs you to use for the visit, confirming it’s the one they’ve vetted, rather than defaulting to whatever messaging app happens to be open on your phone.

Comparing privacy risks across video, chat, and audio telehealth visits

Different telehealth formats carry different privacy trade-offs worth understanding before you choose one.

Video visits carry the richest data, including your image, your home environment visible in the background, and often audio alongside it, making a private, camera-ready space more important than with other formats. Chat-based or messaging visits leave a more permanent written record, which can be useful for your own reference but also means more text-based data sitting in storage somewhere, making encryption at rest and retention policies especially relevant. Audio-only calls reduce the visual exposure risk entirely but still carry the same technical risks around call encryption and metadata collection as video.

No format is inherently risk-free, but matching the format to your comfort level, and asking about the same encryption and retention questions regardless of which one you choose, covers the fundamentals across all three.

Before a telehealth visit, you should be asked to consent not just to treatment, but to how your data will be collected, used, and potentially shared. That consent should be specific enough to tell you whether your information might be shared with advertising partners, analytics vendors, or other third parties, not just a blanket statement about “improving our services.”

You generally have the right to ask what data a platform collects beyond the direct content of your visit, including browsing behavior on their website or app usage patterns. You also have the right to ask about retention: how long your records are kept, and whether you can request deletion once your care relationship ends. HHS guidance frames clear disclosure of these practices as a provider responsibility, not an optional courtesy.

If a consent form uses vague language about data sharing or doesn’t mention third-party vendors by name, that’s worth raising with your provider directly before you proceed.

Evaluating a telehealth platform’s privacy policy and terms of service

A privacy policy that’s hard to find or written in dense legal language is itself a signal worth noting. A policy worth trusting should clearly state what data is collected, who it’s shared with and why, how long it’s retained, and how you can request access or deletion.

Look specifically for language about third-party sharing, since this is where the gap between HIPAA-covered platforms and consumer apps tends to show up most clearly. A policy that mentions sharing data with “partners” or “affiliates” without naming them or explaining the purpose deserves a follow-up question. Also check whether the policy distinguishes between data used for your care and data used for marketing or analytics, since those are fundamentally different uses that should be disclosed separately.

Terms of service agreements sometimes include arbitration clauses or limitations on liability that are worth a quick read, even if the privacy policy looks solid on its own.

Third-party integrations and their impact on patient data privacy

Modern telehealth rarely involves just you and your provider. Prescription delivery services, lab partners, payment processors, and scheduling tools all typically sit somewhere in the chain, and each one represents another point where your data passes through a system outside your provider’s direct control.

When a prescription is sent electronically to a delivery service, that service needs your name, medication details, and shipping address at minimum, information that deserves the same contractual protections as any other health data. Ask whether your provider’s integrated partners operate under a Business Associate Agreement when HIPAA applies, and whether those partners have their own separate privacy policies governing how they use your information.

The more integrations a platform uses, the more parties touch your data, which isn’t inherently a problem but does mean transparency about those partnerships matters more, not less.

A short case for taking telehealth privacy seriously

The steps in this article aren’t complicated, and that’s exactly the point. A private room, an updated phone, and a few pointed questions to your provider close most of the gaps that lead to real incidents. What surprises people is how often the failures trace back to disclosure gaps rather than sophisticated hacking, which means patients who ask questions genuinely shift the odds in their favor.

If something about a provider’s answers doesn’t sit right, trust that instinct and escalate through OCR or the FTC if needed.

— Bryan

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

Will telehealth continue to be available in 2026?

Yes. Telehealth remains a standard part of U.S. healthcare, and Medicare-covered telehealth services are authorized to continue through December 31, 2027. You can read more about what this means for coverage and costs through that period.

Can telehealth platforms track your location?

Some can, through metadata like your IP address and device identifiers, which can reveal your approximate location even when your conversation content stays encrypted. Tracking pixels embedded on a platform’s website may also collect this kind of data, which is why reviewing a privacy policy before your visit matters.

What are the potential dangers of telehealth?

The main dangers fall into environmental, technical, and operational categories, including being overheard at home, insecure video links or tracking technologies, and staff or vendor access errors, according to a systematic review of telehealth privacy research. Most of these risks can be reduced with a private space, updated devices, and direct questions to your provider about vendor practices.

Is telehealth HIPAA compliant?

It depends on the platform. HIPAA applies when your provider is a covered entity and signs Business Associate Agreements with its vendors, but many consumer-facing health apps fall outside HIPAA entirely and are instead regulated by the FTC’s Health Breach Notification Rule. Ask your provider directly whether they’re a HIPAA-covered entity if this matters to you.

How do I protect my privacy during a telehealth visit?

Use a private room, your own updated device, and a secure home Wi-Fi connection rather than public networks, and confirm the meeting link matches what your provider sent. For a more complete walkthrough, our telehealth privacy checklist covers steps to take before, during, and after your appointment, and if you’re considering starting care with us, you can explore our primary care or other services to see how we handle these safeguards directly. For additional preparation tips specific to therapy visits, Alvarado Therapy’s guide to preparing for an online session offers useful complementary steps.

Sources

Get the free Zealthy App
Personalized care in your pocket
Download the App
Download the App
For iOS & Android ->
Services
Weight LossPrimary CareAnxiety / DepressionHair LossSkincareEDBirth ControlSleepEnclomiphene
About
About UsWeight Loss FAQFAQBlogRatings & ReviewsSubscriptions, Cancellations, and Refunds PolicyContact UsCareersLog InPress
Contact
[email protected]30 Irving Pl
New York, NY 10003
(877) 870-0323
© 2023 Zealthy, Inc. All rights reserved.
Terms of Use | Privacy Policy | Notice of Privacy Practices | Consent to Telehealth