Secure Messaging and Telehealth Platforms for Therapists
Overview
Secure Messaging and Telehealth Platforms for Therapists
Telehealth has transformed from a pandemic necessity to an essential component of mental health care. Over 60% of therapy sessions now include some telehealth component, and secure client communication has become standard practice.
Key takeaways
- Secure Messaging and Telehealth Platforms for Therapists Telehealth has transformed from a pandemic necessity to an essential component of mental health care.
- Over 60% of therapy sessions now include some telehealth component, and secure client communication has become standard practice.
- This guide helps you navigate the landscape of HIPAA-compliant telehealth and secure messaging platforms, comparing features, costs, and implementation considerations.
- Understanding HIPAA Requirements What HIPAA Requires for Telehealth Before evaluating platforms, understand the HIPAA requirements that govern telehealth and electronic communication.
- Technical safeguards required: End-to-end encryption for video and messaging Secure transmission (TLS 1.2 or higher) Unique user identification and authentication Automatic session termination Audit controls and access logs Data integrity controls Administrative requirements: Business Associate Agreement (BAA) with vendor Documented security policies Staff training on secure platform use Risk assessment including telehealth Key point: The platform must sign a BAA.
Details
This guide helps you navigate the landscape of HIPAA-compliant telehealth and secure messaging platforms, comparing features, costs, and implementation considerations.
Understanding HIPAA Requirements
What HIPAA Requires for Telehealth
Before evaluating platforms, understand the HIPAA requirements that govern telehealth and electronic communication.
Technical safeguards required:End-to-end encryption for video and messagingSecure transmission (TLS 1.2 or higher)Unique user identification and authenticationAutomatic session terminationAudit controls and access logsData integrity controls
Administrative requirements:Business Associate Agreement (BAA) with vendorDocumented security policiesStaff training on secure platform useRisk assessment including telehealth
Key point: The platform must sign a BAA. Without a BAA, even a technically secure platform doesn't meet HIPAA requirements for PHI.
What Platforms Are NOT HIPAA-Compliant
Do NOT use for therapy sessions:Regular Zoom (non-healthcare version)Skype (consumer version)FaceTimeGoogle Meet (non-Workspace version)WhatsApp, iMessage, or SMSStandard email
These platforms may be secure in some ways but don't meet healthcare requirements or won't sign a BAA.
The Post-COVID Enforcement Landscape
During the pandemic, HHS exercised enforcement discretion allowing non-compliant platforms. That period has ended. The Office for Civil Rights now expects full compliance.
Current requirements:Must use HIPAA-compliant platformsBAAs required from all vendorsSame security standards as in-person careState licensing laws apply (practice where patient is located)
For state-specific telehealth regulations, see our California telehealth guide.
Telehealth Platform Features
Essential Features
Every telehealth platform for therapy should include:
Video quality:HD video capabilityStable connection managementBandwidth optimizationMobile device support
Session management:Virtual waiting roomSession scheduling integrationOne-click join for clientsRecording capability (with consent)
Security:End-to-end encryptionNo data storage on client devicesSecure session linksAuthentication options
Usability:No client download requiredBrowser-based access optionMobile app availabilityEasy connectivity from any device
Advanced Features
Features that enhance the telehealth therapy experience:
Clinical tools:Screen sharing for worksheetsVirtual whiteboardDocument sharing during sessionAssessment integration
Administrative:EHR integrationAppointment remindersAutomated documentationAnalytics and reporting
Specialized capabilities:Group therapy supportCouples therapy (split screen)Interpreter/support person accessBreakout rooms for family therapy
Client Experience Considerations
The best platform is one clients will actually use.
Client-friendly features:Simple joining process (click link, join session)No app installation requiredMobile-friendly interfaceClear audio/video controlsWaiting room experienceTechnical support available
Accessibility:Closed captioning optionsScreen reader compatibilityAdjustable interfaceLow-bandwidth mode
Platform Categories
Integrated EHR Telehealth
What it is: Telehealth built into your practice management system.
Examples: Most modern mental health EHRs include telehealth.
Pros:Seamless scheduling integrationOne system for all functionsSimplified client experience (one portal)Automatic documentation linkingSingle vendor relationship
Cons:May have fewer features than standaloneVideo quality variesSwitching EHR means switching telehealth
Best for: Practices wanting simplicity and integration over advanced features.
For EHR selection guidance, see our EHR buyer's guide.
Standalone Telehealth Platforms
What it is: Dedicated telehealth platform used alongside your EHR.
Examples: Purpose-built healthcare video platforms.
Pros:Often superior video qualityMore advanced featuresSpecialized for healthcareCan keep if you change EHR
Cons:Additional costIntegration requirementsMultiple systems to managePotential client confusion
Best for: Practices prioritizing video quality and advanced features.
General Healthcare Video Platforms
What it is: Video platforms designed for healthcare broadly, adaptable for therapy.
Examples: Healthcare versions of mainstream video platforms.
Pros:Familiar interface for clientsRobust infrastructureCompetitive pricingBroad integration options
Cons:Not therapy-specificMay lack clinical featuresCould be overkill for small practices
Best for: Practices comfortable with technology wanting flexibility.
Secure Messaging Platforms
Why Secure Messaging Matters
Client communication between sessions is routine. Standard email and text don't meet HIPAA requirements.
Common uses for secure messaging:Appointment logisticsInsurance/billing questionsBrief clinical check-insResource sharingCoordination of care
Secure Messaging Options
Option 1: Client portal messaging
Most EHR systems include secure messaging within the client portal.
Pros: Integrated, no extra cost, all communication in one placeCons: Clients must log into portal, may be less convenient
Option 2: Standalone secure messaging apps
Dedicated HIPAA-compliant messaging platforms.
Pros: App-like experience, convenient for clients, text-message feelCons: Additional cost, another system to manage
Option 3: Encrypted email services
HIPAA-compliant email platforms.
Pros: Email interface clients know, professional appearanceCons: Email can feel formal, less immediate
Secure Messaging Best Practices
Regardless of platform:
Set expectations:Response time (e.g., within 24 hours)What's appropriate for messaging vs. sessionEmergency protocolsBoundaries around availability
Sample messaging policy language:"Secure messaging is available for non-urgent communication like scheduling changes, brief questions, and resource sharing. Messages are typically responded to within one business day. For clinical emergencies, please call 988 or go to your nearest emergency room. Secure messages are part of your clinical record."
Documentation: Include significant messages in clinical documentation as appropriate.
Implementation Guide
Step 1: Assess Your Needs
Questions to answer:What percentage of sessions will be telehealth?Do you need integrated or standalone platform?What features are essential vs. nice-to-have?What's your budget?How tech-savvy are your clients?Do you provide group therapy?What EHR are you using?
Step 2: Evaluate Platforms
Evaluation criteria:
Demo checklist:[ ] Test video quality in your environment[ ] Try the client experience (join as a client would)[ ] Test mobile experience[ ] Review security documentation[ ] Confirm BAA process[ ] Understand pricing and terms
Step 3: Legal and Administrative Setup
Before launching telehealth:Sign BAA with telehealth vendor (required for HIPAA)Update informed consent to include telehealth:Risks and limitations of telehealthConfidentiality protectionsEmergency protocolsRecording policies (if applicable)Client responsibilities (private space, technology)Verify licensing and insurance:Licensed in state where client is located during sessionMalpractice insurance covers telehealthUnderstand state-specific telehealth requirementsEstablish policies:Telehealth eligibility criteriaTechnical requirements for clientsBackup procedures if technology failsDocumentation requirements
Reference: APA Telepsychology Guidelines
Step 4: Technical Setup
Your environment:Reliable internet (minimum 5 Mbps up/down, 10+ recommended)Quality webcam (720p minimum, 1080p preferred)Good microphone (USB microphone or quality headset)Adequate lighting (face well-lit, no backlighting)Professional, private backgroundBackup internet option (mobile hotspot)
Test thoroughly:Run test sessions with colleaguesTest from different devicesVerify audio and video qualityPractice troubleshooting common issues
Step 5: Client Preparation
- Client setup instructions should include:
- How to access/join sessions
- Technical requirements (browser, app, internet)
- Creating private, confidential space
- Backup plan if technology fails
- How to contact you if issues arise
Sample client instructions:"To join your telehealth session:Click the link in your appointment reminder emailAllow camera and microphone access when promptedEnsure you're in a private space where you won't be overheardHave a phone nearby in case we need a backup connectionTechnical requirements: A device with a camera and microphone, stable internet, and a current web browser. If you have trouble connecting, call [phone number]."
Step 6: Go-Live and Optimize
First week checklist:[ ] Monitor connection quality[ ] Gather client feedback[ ] Document any technical issues[ ] Adjust settings as needed[ ] Refine client instructions
Ongoing optimization:Review telehealth quality periodicallyStay current with platform updatesRefresh training as features changeMonitor client satisfaction
Telehealth Best Practices for Therapy
Creating a Professional Telehealth Environment
Visual setup:Clean, professional backgroundFace well-centered in frameCamera at eye levelMinimal visual distractionsConsistent environment session to session
Audio considerations:Quiet environment (no background noise)Good microphone positioningConsider noise-canceling featuresTest audio before sessions
Lighting:Light source in front of you (not behind)Soft, even lightingAvoid harsh shadowsNatural light works well
Clinical Adaptations for Telehealth
Engagement techniques:More explicit verbal acknowledgment (nodding less visible)Direct eye contact (look at camera, not screen)Check in about what client sees/hearsAddress tech issues promptlyBuild in more pauses
Safety protocols:Verify client location each sessionHave emergency contacts on fileKnow local emergency resources for client's locationDiscuss safety plan in first sessionHave clear protocol for crisis during telehealth
Documentation:Note that session was via telehealthDocument client location (state/jurisdiction)Record any technology issuesApply appropriate modifiers for billing (see our CPT codes guide)
Managing Technical Issues
Prevention:Test equipment regularlyKeep backup options readyAdvise clients on requirementsHave pre-session connection check option
During session issues:Have phone backup readyClear protocol for reconnectionDon't let tech consume the sessionDocument issues that occur
Common issues and solutions:
Group Therapy Telehealth
Platform Requirements for Groups
Group telehealth has additional requirements:
Essential features:Support for enough participants (most therapy groups 6-12)Gallery view (see all participants)Mute controls (host can mute participants)Waiting room (control entry)Raise hand or reactions (facilitate participation)
Helpful features:Breakout rooms (for subgroups)Recording with consentChat function (text support)Co-host capability
Group-Specific Best Practices
Structure:Clear participation guidelinesExplicit turn-taking protocolsVisual cues for wanting to speakChat for non-urgent commentsMuting guidelines
Confidentiality:Remind participants of confidentialityRequire headphones in shared spacesDiscuss recording prohibitionsAddress screenshots/recordings
Technical considerations:More bandwidth neededLonger connection time for all to joinMore troubleshooting requiredConsider co-facilitator for tech support
Billing for Telehealth Services
Telehealth Modifiers and Place of Service
Modifiers:95: Synchronous audio-video telehealth93: Audio-only (telephone) services where permitted
Place of Service codes:02: Telehealth (patient at distant site)10: Telehealth provided to patient at home
Payer-Specific Considerations
Medicare:CMS telehealth guidelines govern coveragePlace of service and modifier requirements specificAudio-only expanded in recent years
Medicaid:State-specific rulesCalifornia: See our Medi-Cal billing guide
Commercial payers:Policies vary by payerMost cover telehealth at parity with in-personVerify specific requirements
For complete billing guidance, see our CPT codes guide.
Cost Comparison
Pricing Models
Per-provider monthly:Range: $20-75/provider/monthMost common modelUsually includes unlimited sessions
Per-session pricing:Range: $1-5 per sessionGood for low-volume telehealthCosts scale with usage
Included with EHR:Range: $0 additional (part of EHR cost)Simplest optionFeatures may be limited
Flat monthly fee:Range: $100-500/month regardless of providersBetter value for larger practicesIncludes all features
Total Cost Considerations
Beyond subscription:Implementation/setup feesTraining costsIntegration costsEquipment (webcam, microphone, lighting)Internet upgrade if needed
ROI Calculation
Revenue impact of telehealth:Reduced no-shows (easier for clients to attend)Additional appointment capacity (no travel between locations)Extended service area (clients beyond driving distance)Weather-proof schedulingFilled schedule gaps with telehealth-only clients
Example:20% no-show reduction = 2-3 recovered sessions/weekAt $150/session = $1,200-1,800/month additional revenuePlatform cost of $50/month = excellent ROI
Security Incident Response
If Something Goes Wrong
Have a plan for security incidents:
Potential incidents:Unauthorized person joins sessionRecording discovered without consentPlatform data breachSession credentials compromised
Response steps:End session immediately if active breachDocument what occurredContact platform security teamAssess HIPAA breach notification requirementsNotify affected clients if requiredImplement preventive measures
HIPAA breach assessment: Reference: HHS Breach Notification Rule
Factors determining if breach notification required:Was PHI actually accessed?What type of PHI was involved?Who accessed the information?Was the PHI actually acquired/viewed?
Frequently Asked Questions
Can I use Zoom for therapy?
Yes, but only Zoom for Healthcare (Zoom One for Healthcare), which includes a BAA and HIPAA-compliant features. The free consumer version of Zoom is not HIPAA-compliant.
What if my client has a crisis during a telehealth session?
Know the client's location and have emergency contacts on file. If there's immediate danger, contact local emergency services where the client is located. Consider having a protocol established from the first session.
Do I need separate consent for telehealth?
Yes. Your informed consent should specifically address telehealth, including risks, limitations, confidentiality considerations, and emergency protocols. Many state licensing boards require telehealth-specific consent.
Can I provide telehealth to clients in other states?
Only if you're licensed in the state where the client is located during the session. Some states have licensure compacts or temporary practice provisions, but most require full licensure. Check PSYPACT for psychologists or state-specific requirements for your license type.
Is audio-only (phone) therapy considered telehealth?
Yes, and most payers now cover it, though reimbursement may differ from video sessions. Use modifier 93 for audio-only services. Verify payer-specific coverage.
How do I handle couples therapy via telehealth when partners are in different locations?
Most platforms support this. Each partner joins from their location. Address confidentiality considerations (who might overhear at each location). Some platforms have split-screen features designed for this.
What if my client's video quality is poor?
Have a protocol: try audio-only, suggest they move closer to router, offer to continue by phone. Don't let technical issues dominate the session. Document issues that occur.
Looking for seamless telehealth integration? Ease Health includes HIPAA-compliant video therapy and secure messaging built directly into our EHR. No extra software, no additional cost. Schedule a demo to see how easy telehealth can be.
Next steps
- Review the key takeaways and adapt them to your practice workflow.
- Use the details section as a checklist when you implement or troubleshoot.
- Share this with your billing or admin team to align on process and terminology.
