Policies for Remote Clinicians: Privacy, Location, Equipment and Emergencies

When the treatment room is a clinician's home, HIPAA's expectations travel there.

On privacy, OCR's telehealth guidance expects providers to deliver telehealth from private settings to the extent feasible.

Where a private setting is not possible — a clinician working from a shared home, say — the same guidance requires reasonable safeguards such as lowered voices and no speakerphone.

Put both halves in writing so clinicians know what 'private enough' means in your practice.

The Security Rule is where a home office gets specific.

It requires an accurate and thorough risk analysis of the risks to electronic protected health information, and OCR says that analysis must cover the remote technologies you use for telehealth.

It also requires workstation-use policies that address the physical surroundings of workstations that can access ePHI, and physical safeguards restricting workstation access to authorized users — for a remote clinician, the room the laptop sits in and who can see its screen.

Access and device rules round it out.

Unique user IDs are required, while automatic logoff and encryption of ePHI are 'addressable' implementation specifications under the current rule.

Devices you issue bring device and media controls with them: policies for the final disposition of ePHI, and for removing ePHI from media before it is re-used — so the laptop a departing clinician returns is wiped by procedure, not by improvisation.

Training and accountability close the loop.

The Security Rule requires a security awareness and training program for all members of the workforce, including management, and sanction policies applied against workforce members who fail to comply with security policies.

Remote staff need the same program as on-site staff, plus the home-specific scenarios — household members within earshot, shared printers, a screen visible from a window.

Our guide to HIPAA training covers what that program should include for behavioral health staff.

Two scope notes keep the policy honest.

The Security Rule reaches telehealth delivered over apps and VoIP, and recorded or transcribed sessions — it does not reach audio-only calls over a traditional landline, so your policy should name which session types clinicians may run.

And the January 6, 2025 proposal to strengthen the Security Rule was still only a proposed rule as of October 7, 2026, with no final rule in the Federal Register — build to the current rule and watch the docket.

The pandemic loosened this area, and the loosening is gone.

During the COVID-19 public health emergency, OCR said it would not impose penalties on covered providers for the lack of a BAA with video communication vendors — a discretion that extended to consumer apps such as FaceTime and Skype.

It expired with the emergency: the notifications lapsed at 11:59 p.m. on May 11, 2023, and the 90-day transition period ended at 11:59 p.m. on August 9, 2023.

Standard HIPAA rules have applied to telehealth ever since.

What the standard rule requires is a business associate agreement before a vendor handles PHI for you.

A covered entity may let a business associate create, receive, maintain or transmit protected health information on its behalf only with satisfactory assurance that the associate will safeguard it (45 CFR 164.502(e)).

HHS's telehealth guidance draws the line by function: a BAA is required with a vendor that is more than a mere conduit for PHI — one that stores recordings or transcripts, for example — while a carrier that only connects the call does not need one.

Write the platform policy so it can be checked at onboarding:

• the list of approved platforms, and a signed BAA on file for each before the first session;
• a prohibition on moving sessions to consumer apps;
• a hold on any feature that stores new session content — automated notes, recordings for supervision, transcripts — until the BAA and your risk analysis cover it.

Treat a vendor's 'HIPAA-compliant' marketing as a claim to verify with a signature, not a substitute for one.

Two things in your policies key off where the client physically sits during a telehealth session.

The first is licensure: the Counseling Compact Commission, for one, states it directly — a counselor must hold a license or compact privilege in the state where the client is located.

The second is the emergency answer: help has to be sent to the client, not to your office.

The licensure side is covered in our guide to hiring remote clinicians in other states; the operational side is the routine below.

A start-of-session routine covers both.

HIPAA's telehealth guidance requires part of it already: if the individual is not known to the provider, the provider must verify the individual's identity, orally or in writing, which may include electronic methods.

Your policy adds what a crisis depends on — the client's physical address during the session, and a phone number that reaches them if the connection drops.

Informed consent is the companion item: telehealth-specific consent is a matter of state board rules, and this guide does not verify each state's consent rule — so confirm your board's requirement before reusing an in-person intake form, and ask whether your board expects the client's location to be documented at each session.

On the emergency plan itself: we found no federal rule that requires a client-location check or a written emergency plan at each telehealth session, so treat this section as risk management rather than a compliance checkbox — and confirm your state board's telehealth expectations in writing.

The plan answers, in advance:

• who the clinician calls, in what order, when a client is at imminent risk — emergency services where the client sits, then the supervisor;
• what the clinician does to keep the client on the line until help is reached;
• how the contact is documented afterward.

Because the clinician may be in a different state from the client, the plan has to work entirely by phone.

One state makes the underlying point explicit: Florida holds telehealth providers to the same professional standard of practice as in-person care in that state.

An emergency plan is how a remote practice keeps that standard from depending on the client being in the room.

Finally, date the assumptions inside the policy.

Medicare's telehealth flexibilities — no geographic restriction, the home as an originating site, an expanded practitioner list — run through December 31, 2027 under the Consolidated Appropriations Act, 2026.

The in-person visit requirement for mental health services delivered by telehealth is delayed until January 1, 2028, and audio-only flexibilities run to January 1, 2028.

A policy that assumes permanent audio-only sessions or home-based clients is written on a clock, so give it a review date that fires before those deadlines do.

Sooner or later a remote clinician asks who pays for the laptop, the headset and the internet line.

Whether you must reimburse any of it is state law, and the two statutes verified for this guide differ.

California's Labor Code section 2802 requires an employer to indemnify an employee for all necessary expenditures or losses incurred in direct consequence of the discharge of their duties.

Illinois' parallel law, 820 ILCS 115/9.5 effective January 1, 2019, requires reimbursing necessary expenditures within the employee's scope of employment and directly related to services performed for the employer, with the employee submitting them — documented — within 30 days, unless a written policy allows longer.

Illinois' statute also shows how much of this is policy design.

Under it, an employer is liable only where it authorized or required the expense, or broke its own written policy — and a written policy may cap reimbursement amounts, but may not provide for no reimbursement or de minimis reimbursement.

The document is doing legal work: which equipment the practice provides and owns, what documentation looks like, what the deadline is, and where the caps sit.

How far either statute reaches into a share of home internet or a personal phone plan is decided by each state's own law and case decisions — the California case law on that question was outside the research for this guide, so route it to employment counsel in the clinician's work state rather than writing an assumption into your policy.

These are two statutes, not a national map: confirm the rules that apply where each remote clinician physically works.

The practical contents are stable whatever the work state requires:

• a list of equipment the practice provides and owns, versus what the clinician supplies;
• an approval path before a clinician buys their own tool;
• a receipt and documentation standard, with the submission deadline;
• the separation tie-in — practice-owned devices come back and get handled under your device disposal and media re-use procedures, not the clinician's.

Pre-licensure staff sharpen the question, because supervision rules are set per profession and per state, and the details that matter remotely — whether video supervision counts, how contact is documented — change by jurisdiction.

Confirm the requirements that apply to each associate with the board or certifying body that issued their title before you rely on a video-only arrangement.

The role-specific detail lives in our guides to RBT supervision for employers, BCaBA supervision and clinical supervision agreements.

Whatever the required dose of supervision, the remote-specific policy items look similar: a standing supervision schedule, held on the same BAA-covered platform as client sessions; a record of each supervision contact; and an escalation path the associate can actually reach mid-session — a supervisor who can be pulled onto a crisis call, or a named backup for the hours they cannot.

An associate working from home with no reachable supervisor is a failure you can design away on a calendar.

For the roles themselves, start from the behavioral health hiring hub.

Recorded sessions used for supervision are the overlap point with your HIPAA work: they are exactly the vendor-stored content that puts a platform beyond mere-conduit status, so the BAA and your risk analysis need to cover them before the first recorded session — and the associate needs to know when recording is allowed under your policy.

The last policy governs the clinicians themselves.

Remote work hands you less visibility and a bigger security surface, and the reflex is monitoring software.

Before you deploy any of it: rules on electronic monitoring of employees are state law, and the specifics were outside the research for this guide — so confirm what each state where your remote staff work requires, including notice obligations, with employment counsel before switching anything on.

Security accountability, at least, is already required of you, and it doubles as the fair way to hold remote staff to your rules.

The Security Rule requires security awareness and training for the whole workforce and sanction policies for workforce members who fail to comply with security policies — a written rule, training on it, and consistent consequences when it breaks.

That framework covers the home-office behaviors that matter: the private setting, the approved platforms, the locked device.

None of those safeguards requires watching anyone's screen.

For productivity, prefer measures a clinician can see and predict — scheduled hours, documentation timeliness — over tools that measure quietly.

Whatever you do collect, say so in the remote-work agreement: what the practice may access on a practice-owned device, what it will not touch, such as personal files and personal messages, and what happens to both at separation.

Clinicians should not have to guess how far the scrutiny extends.