Using telehealth platforms lawfully

“Ensure telemental health platforms are utilized in compliance with state and federal laws” (NBCC, 2027 task 6.9)

The platform a counselor uses for remote sessions must protect client information as federal and state laws require. Choosing and configuring a platform properly is part of the counselor's legal responsibility. The exam tests HIPAA requirements for technology and related state rules.

Key points

Under HIPAA, a telehealth vendor that handles protected health information for a covered entity is a business associate and must sign a business associate agreement.
Choose platforms with encryption, access controls and secure storage; configure features such as waiting rooms and unique meeting links.
The federal enforcement discretion that allowed non-compliant everyday video apps during the COVID-19 public health emergency has ended; platforms must now meet HIPAA requirements.
Avoid public-facing platforms such as social media livestreams for any clinical service.
State laws may add requirements for telehealth, such as specific consent or recording rules; check where the client is located.
Secure the counselor's own devices and network: updated software, strong passwords, no public Wi-Fi without protection.
Recording sessions requires informed consent, and recordings must be stored securely as part of the record or according to policy.

In practice

A counselor starting a private practice compares telehealth platforms and chooses one that signs a business associate agreement, encrypts video, and uses individual meeting links, and she keeps the signed agreement on file.

A counselor traveling for a conference plans to see a client remotely from a hotel. She uses a private room and a secure hotspot rather than the hotel's open Wi-Fi.

Check yourself

What agreement should a telehealth vendor sign with a covered counseling practice?

A business associate agreement, under which the vendor commits to protecting the protected health information it handles.

Can counselors still use any video app under COVID-era flexibilities?

No, that enforcement discretion has ended, so platforms must meet HIPAA requirements.

What is required before recording a telehealth session?

The client's informed consent, with secure storage of the recording.

NBCC's knowledge and skills for Domain 6

Knowledge of: State laws (state licensure law, supervision requirements, abuse reporting, license renewal, CAQH); Federal laws (e.g., HIPAA, FERPA, immigration policy, HI-TECH, ADA, NPI); Codes of ethics; Third-party reimbursement, insurance and billing (e.g., CPT codes); Counseling Compact; Emerging technologies in Counseling; Crisis policies and procedures; Recording keeping and reporting requirements and procedures; Appropriate logistics for telemental health services; Scope of practice (e.g., letters of support, working with special populations); Alternative medical-assisted/pharmacological interventions; Accessing state licensure board; Executing voluntary and involuntary commitments.

Skill in: Maintaining confidentiality; Discerning reputable training providers and programs; Troubleshooting technological difficulties during telemental health session (e.g., session disconnects, video not working); Billing and third-party reimbursement.

A study guide written by ExamDragon from NBCC's published task; not NBCC material and not part of the exam.