HIPAA-Compliant Video Conferencing in Mental Health

Telemedicine, or providing medical services remotely through telecommunication technology, has changed the healthcare landscape.

People are no longer limited to doctors or therapists that are close to them. Today telemedicine and telepsychology are quickly becoming respectable forms of practice, and medical services from a distance using video conferencing software are often considered as effective as traditional healthcare.[1][2]

Of course, no video conferencing technology is completely without vulnerabilities, but therapists and mental health specialists considering video solutions do have one important standard when trying to choose safe, private systems for their practices. That industry gold standard is HIPAA compliance.

Before you read on, we recommend you try Quenza for $1 a month. With HIPAA-compliant tools to help you design and deliver teletherapy, our customizable blended care software will help you take your practice online today.

Video Conferencing in Mental Health

As teletherapy and virtual care technology continue to enrich the mental healthcare sectors, there are also a lot of concerns regarding the security of these forms of practice. Specifically, the proper protection of patients’ privacy is a key issue. When data is transmitted and stored digitally, there is a risk of it being accessed by third parties who may not be authorized to view it.

Video conferencing has been a great aid to mental health services by removing the necessity of physical proximity. Patients can access mental health services from virtually anywhere in the world thanks to the development of web-based and digital technologies.

If in the beginning, users needed more resources to benefit from video therapy (a personal computer, and webcam); however the prevalence of smartphone apps has made it even easier to talk to a therapist from anywhere in the world, at any time.

Research shows that many mental health issues can be successfully handled using video conferencing technology.[3] There is even evidence that suggests video conferencing therapy can provide the same results as face to face therapy, making it a good alternative to traditional therapy.[4]

As technology evolves, so will the prevalence of using video conferencing in mental health services. But before that can happen, it will be essential to solve for how software design ensures the safety of patient data.

Research shows that many mental health issues can be successfully handled using video conferencing technology.

HIPAA and Technology

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law protecting the privacy of an individual’s personal health information, while at the same time allowing certain relevant parties to access to the same information so as to enable the provision of health services.[5]

One such example is insurance companies that may need to view a patient’s health information to reimburse treatment costs.

The law or specifically HIPAA offers a set of guidelines and requirements in terms of how patient information should be kept private.[6] Specifically in regard to telehealth or information stored on digital platforms, there are two main guidelines to consider:[5]

1. The Privacy RuleThis applies to protected health information that exists in any form, such as paper, oral, or electronic. It covers instances in which this information can be used, who is authorized to access it, and what are the patient’s rights regarding their personal health information.
2. The Security RuleApplies to protected health information that is stored electronically, and mentions that it must be protected by “administrative, physical, and technical safeguards.” It sets standards on what measures should be taken to keep electronic information private.
3. The HITECH ActThe HITECH Act was added specifically for telehealth data management purposes, strengthening the provisions of the Privacy Rule and Security Rule even further by defining specific violations and associated penalties.[7]HIPAA regulations are designed to protect the patient and all information pertaining to their health, including their mental health history, which may be stored in a database such as an electronic health record (EHR). There are clear guidelines informing therapists and mental health specialists of the proper measures for storing and transferring digital data.

   These guidelines include:

   • How to use the data
   • The necessity of encryption
   • Authentication requirements
   • Audit trails
   • Server security.

HIPAA and Video Conferencing Software

When it comes to video conferencing programs, HIPAA standards fall under the responsibility of both the health care provider and the vendor who offers the software. For that reason, some of the most popular providers of video calling technology such as Skype are not recommended for use in mental health provision. These providers excuse themselves from the responsibility of keeping up with HIPAA regulations regarding privacy and data protection and therefore are not safe for use in medicine.

Vendors that are HIPAA-compliant have specifically designed their products and services to be used in telehealth format. The key technological criteria that define HIPAA-compliant service provision of telemedicine are explained below.

1. EncryptionVirtual care practitioners cannot assume it is only themselves and clients present in the virtual therapy room. Digital data transmissions can potentially be intercepted by outside parties.Encryption is a process that scrambles data transmissions and makes it difficult to understand by third parties.[8] Video conferencing software that encrypts data will automatically decrypt it when it reaches those for whom it is intended and who are authorized to view it. The authentication can be something as simple as logging into the teletherapy platform or mobile app. As an authorized recipient, you would add your credentials, typically username and password, and access the data.
2. Peer to Peer NetworkingPeer to peer network connects two computers directly, without having to go through a central server, and is considered the most secure way to transmit sensitive information. Remote servers cannot be fully secured, which means they are always vulnerable. But if servers are removed from the process of data transmission, then this vulnerability does not exist.[9]
3. Local File StorageThe responsibility for the storage of patient data rests with the practitioner and should never be left to a vendor. Third-party storage of health information is in direct violation of HIPAA standards as it allows for access to data beyond the client/practitioner relationship. Instead, all the data (videos, chat texts, client files, etc.), should be stored locally on a health care provider’s side, and therefore not accessible to the vendor who should be responsible only for the transmission.Of course, this also means that the users with access to the data (the mental health specialist, as well as the patient), are individually responsible for the security of the data stored on their computers. The accountability of cloud service providers (CSPs) is also a pertinent issue in the research.[10]

   While mental health providers HIPAA regulations that offer guidance and solutions to potential security issues, patients should also take care and make sure their sensitive information is not accessed through their personal devices.

Video Conferencing Software: What To Look For

Using just any conferencing app or video therapy tool, no matter how popular, isn’t ideal as it may expose practitioners to a lot of risks. So if you plan to use Skype, do so at your own peril. But if you’re seriously shopping around for video conferencing software,  here are a few questions you should ask:

1. Is It Comfortable and Convenient?Video conferencing in therapy has the added benefit of making the services more accessible, convenient, and should be an enhancement to a practice. Before you invest in any blended care technology, consider the level of technological literacy, both your patients’ and your own as the therapist when choosing a program. If the system is too complex, it may require additional training and be associated with additional costs, not to mention frustration.[11]
2. Is Software HIPAA-Compliant?Some unscrupulous video conferencing providers will claim that their programs do live up to standards imposed by HIPAA, but it’s important to look into the specifics of what that means in practice. A HIPAA-compliant video software should offer the following, at least:[5]
   • Encryption
   • Authorization protocols/alternatives
   • Peer-to-peer networking
   • Local file storage

   Software that does not offer these basic privacy requirements may not be a good fit and expose both the therapist and the patient to risks.

3. Who Uses This Software?A good sign that the vendor is reputable can come from the fact that is other well-known mental health providers are also using their products. This speaks to the vendor’s reputation and can help you make an informed decision.

The Limitations of HIPAA

Using HIPAA-compliant video conferencing software not only reduces the risk of the data being breached by a third party that has something to gain from personal medical information stored in an electronic medical record or similar, but it also allows for better management of data and storage of information. Though video conferencing software may do all it can to be HIPAA-compliant, it is important to realize that some level of risk always remains.

The most common reason why electronic personal information gets in front of unauthorized eyes has nothing to do with the particular software used. It is actually caused by a very human factor and most often done by employees of healthcare providers who are “snooping on healthcare records of family, friends, neighbors, co-workers, and celebrities”.[12]

Such transgressions, according to official HIPAA sources, can take on different forms:

• Emailing personal health information to a personal email account;
• Leaving devices that can access such information unattended;
• Releasing information to an unauthorized individual;
• Downloading information on an unauthorized device.

Many of these are done by mistake, but they do show how important it is for all individuals with access to patient information to receive proper training on how to handle it, and how to make sure it is secure.

Most of the other potential risk also has to do with the mental healthcare provider, such as not conducting a risk assessment or improper disposal of a patient’s personal information.

5 Examples of HIPAA-Compliant Software

A quick Google search for “HIPAA-compliant video conferencing” will return thousands of examples. Offering the bare-minimum in data protection isn’t that difficult these days, but even if a vendor places the HIPAA-compliant mark on their website, not all video conferencing products are the same in terms of quality or what they can do to ensure privacy and protection of the patient information.

Just as not all teletherapy practitioners are licensed to practice, and not all apps are science-based, it’s a good idea to conduct due diligence before committing to a provider.[13][14]

Here are some apps and platforms to consider:

Platform	Details
	TheraNest is a practice management software that also has an integrated video conferencing service that is HIPAA-compliant. Patients can receive a secure session link and automatically join the therapist on the portal without the need to download an app or enter credentials.
Name	TheraNest
Price	$38+ monthly
Good For	Client Conferencing, Practice Management, Treatment Plans
Website	https://theranest.com/

Platform	Details
	For practitioners who want to deliver online treatments, Quenza offers HIPAA-compliant video coaching rather than live telehealth calls. Designed for maximum patient data security in accordance with the latest Privacy by Design (PbD) standards, the platform is also GDPR compliant and suitable for storing test results, assessment feedback, and patient intake information. Therapists and coaches can use Quenza to design their own psychological assessments or use the app’s research-based scales – the system’s progress trackers, real-time results, and client communications are all stored securely.
Name	Quenza
Price	$1+ monthly
Good For	Video Coaching, Online Psychotherapy, Treatment Plans
Website	https://quenza.com/

Platform	Details
	Doxy.me provides free limited services, but their HD video conferencing requires a monthly fee. The platform complies with HIPAA and HITECH requirements. It can be accessed through all major browsers and has a mobile app you can download and use through the comfort of your phone.
Name	Doxy.me
Price	Free – $50 monthly
Good For	Video Conferencing, Practice Management
Website	https://doxy.me/

Platform	Details
	Simple Practice says their services offer bank-level encryption and security. It is also a practice management software with an integrated video conferencing service that is HIPAA-compliant. It comes with a rather clean interface which can be easy to use even by someone with lower technical skills. The video conference component can also send automatic reminders to patients that they have an appointment coming up.
Name	SimplePractice
Price	$39+ monthly
Good For	Practice Management, Client Communications
Website	https://www.simplepractice.com/

Platform	Details
	VSee is a pricier practice management software, starting at $199 a month that offers an impressive list of services mental health practices can use to streamline their tasks, such as scheduling, intake forms, file transfer, billing, and video calling. The latter is called VSEE Messenger and offers military-grade security for communicating with patients even over 3G connections. Considering it also has a list of high-profile clients such as NASA and MDLive, the cost seems to be worth it. It does offer some free options depending on provider size and requirements.
Name	VSee
Price	Free – $49 Monthly
Good For	Instant Messaging, Video
Website	https://vsee.com/

Final Thoughts

Video conferencing will most likely increase in prevalence in the following years, as both therapists and potential patients open up to the idea and start embracing it. And as the technologies evolve, they will also likely become more secure.

However, from the evidence we have now, it seems that being HIPAA-compliant is not enough to ensure the patient’s data is kept safe. Vendors of these apps and platforms, though they can do everything they can to meet federal guidelines, are only one actor in play. Mental health providers also need to show a stronger focus on keeping this data safe.

We hope you enjoyed this article. To start designing and delivering HIPAA-compliant e-therapy today, don’t forget to check out our $1 Quenza trial, for unlimited one-month access to all its telepsychology features. Specially designed for online therapists and coaches, our software has all you need to build custom treatments, activities, and personalized care pathways, so you can be fully private and secure while improving their mental health.

References