Data Privacy & Patient Confidentiality

MANDATORY

5 criteria

ALL YES Standard likely met. ANY PARTIAL Improvement plan required. ANY NO Blocks accreditation until resolved.

REFERENCES

1. [26] Official telehealth guidance specifically advises patients to find a private location for their session and provides concrete suggestions — a quiet room at home, a private space in a community setting, a parked car — reflecting that session environment privacy requires active guidance, not assumed adequacy from platform security alone.

A patient joining from their own phone or laptop doesn't automatically mean they're somewhere private, and genuine, proactive guidance on finding a private location — not just technical platform security — is what actually protects a conversation about sensitive health information from being overheard by someone else in the room.

1 Guidance exists in intake materials but isn't reinforced verbally at the start of an actual session.

Real, active reinforcement at the point of use is more reliable than guidance provided once and easily forgotten.

2 Alternatives are suggested generally but not tailored to what's realistically available to a specific patient's circumstances.

Genuine, practical guidance should reflect what's actually feasible for the individual patient, not a generic list.

3 Environment is addressed for new patients but not consistently revisited for established, ongoing patients.

An established patient's actual environment can change, and deserves the same genuine, ongoing attention.

Week 1 Review current patient environment guidance for genuine specificity and practicality.

Week 2 Build concrete alternative suggestions for patients without a private home space.

Week 3 Reinforce environment guidance verbally at the start of sessions, not intake materials alone.

Ongoing Revisit environment guidance periodically for established patients.

Ask a patient whether they were given any specific guidance on finding a private location.

A specific, real answer reveals genuine practice, not an assumption of adequate guidance.

Observe an actual session opening for genuine environment discussion.

Direct observation reveals whether this happens in practice, not just in intake documentation.

ALL YES Standard likely met. ANY PARTIAL Improvement plan required. ANY NO Blocks accreditation until resolved.

REFERENCES

1. [27] Established health privacy guidance specifically requires recorded consent before continuing a consultation when a translator, caregiver, or family member is present, or when the patient is in a public location where the conversation may be overheard, reflecting the genuine risk of an unseen third party during a telehealth session.

A person present but out of camera view can hear everything discussed without the provider ever knowing they're there, and genuine disclosure and consent — not an assumption the patient is alone simply because no one else appears on screen — is what actually protects the patient's real control over who learns their sensitive health information.

1 Inquiry happens for new patients but isn't consistently repeated for established, ongoing patients.

An established patient's actual circumstances at a given session can genuinely differ from prior visits.

2 Consent is obtained verbally but not consistently documented in a genuinely retrievable way.

Documented consent provides more reliable, real evidence than a verbal exchange alone.

3 Public location risk is addressed when obviously apparent but not consistently for more ambiguous settings.

Genuine attention to this risk shouldn't depend solely on how obviously public a setting appears.

Week 1 Review current practice for genuine inquiry about third-party presence at session start.

Week 2 Train providers to actively ask and document consent when a third party is present.

Week 3 Build specific guidance for addressing apparently public patient locations.

Ongoing Extend genuine, repeated inquiry to established, ongoing patients.

Observe an actual session opening for genuine inquiry about who else might be present.

Direct observation reveals whether this genuinely happens, not an assumption based on stated policy.

Ask to see documented consent for a real case where a third party was present.

A real, specific record reveals genuine practice, not policy language alone.

ALL YES Standard likely met. ANY PARTIAL Improvement plan required. ANY NO Blocks accreditation until resolved.

REFERENCES

1. [28] Practitioners often lack clear guidance on whether and how to record telehealth sessions, creating genuine ambiguity and discomfort for both provider and patient, establishing a clear, specific, documented recording policy as necessary to close this documented gap.

Real research specifically found that practitioners often lack clear guidance on whether and how to record sessions, creating genuine ambiguity and discomfort for both provider and patient — a service that hasn't resolved this ambiguity with a clear, specific policy leaves a real gap exactly where clarity matters most, since a patient has a genuine right to know if they're being recorded.

1 A policy exists for standard consultations but isn't specifically addressed for group or family sessions.

Every session type deserves the same genuine policy clarity, not standard consultations alone.

2 Storage location is specified but retention duration isn't clearly, specifically defined.

Both elements genuinely matter to a patient's real understanding of what happens to their recorded information.

3 Notification happens but isn't consistently documented as genuinely occurring before recording begins.

Documentation of prior notification is what makes genuine compliance verifiable, not assumed from general practice.

Week 1 Review current recording practice for genuine, specific policy clarity.

Week 2 Build a clear, documented policy addressing whether, when, storage, and retention.

Week 3 Establish consistent, documented patient notification before any recording.

Ongoing Extend policy clarity to all session types, not standard consultations alone.

Ask to see the actual, written recording policy, not a general assurance recording is handled appropriately.

A specific, real document reveals genuine clarity, not assumed adequacy.

Ask a provider directly what the specific retention period is for a session recording.

A specific, confident answer reveals genuine, clear policy, not individual discretion.

ALL YES Standard likely met. ANY PARTIAL Improvement plan required. ANY NO Blocks accreditation until resolved.

REFERENCES

1. [29] Many clinicians continue conducting sessions from home offices with unencrypted devices and storing session recordings in personal cloud storage, having never completed the compliance transition required since temporary pandemic-era enforcement discretion ended, establishing the provider's home office as a genuine, distinct privacy compliance layer separate from platform security.

Real, documented findings show many clinicians never completed the transition required when temporary pandemic-era flexibility ended, continuing to use unencrypted devices and store recordings in personal cloud storage from home offices — the provider's home is a genuine, distinct compliance layer separate from the platform itself, and a service that only verifies platform security while overlooking the provider's actual working environment has a real, documented gap.

1 Device encryption is verified for provider-issued equipment but not for personally owned devices also used for sessions.

Every device genuinely used to access patient information deserves the same verification, regardless of ownership.

2 Network security is addressed at initial setup but not periodically reconfirmed as home network configurations can change.

A home network's real security can change over time, and periodic reconfirmation reflects this reality.

3 Physical privacy is generally adequate but hasn't been specifically confirmed for providers sharing a household with others working or studying at home.

A shared household is exactly where genuine physical privacy deserves specific, not assumed, confirmation.

Week 1 Review current home office privacy and security for genuine verification versus assumed adequacy.

Week 2 Verify encryption for every device genuinely used to conduct sessions, regardless of ownership.

Week 3 Confirm home network security and genuine physical privacy for every provider.

Ongoing Periodically reconfirm home office security as configurations may change.

Ask a provider to describe their actual home office setup, including device and network security.

A specific, confident answer reveals genuine attention, not an assumption of adequacy.

Ask specifically about physical privacy for a provider sharing a household with others.

This reveals whether genuine privacy has been confirmed, not assumed from a general home office description.

ALL YES Standard likely met. ANY PARTIAL Improvement plan required. ANY NO Blocks accreditation until resolved.

REFERENCES

1. [30] Multiple countries' health privacy frameworks specifically establish heightened confidentiality protections for substance use disorder or addiction treatment records, distinct from general health information privacy practice, often requiring the patient's own specific consent for disclosure.

Substance use disorder treatment records are governed by a genuinely distinct, stricter federal confidentiality framework than general health information, specifically because unauthorized disclosure of this particular information can carry real, serious consequences for a patient beyond typical privacy harm — a service that applies only general confidentiality practice to these specific records falls short of what this distinct, real legal standard actually requires.

1 The distinct standard is understood by clinical staff but not consistently by administrative staff who may handle these records.

Every staff member with access to these specific records deserves the same genuine understanding of this heightened standard.

2 Written consent is obtained but doesn't specifically distinguish this category from general information release consent.

Genuine compliance requires consent language specifically reflecting this distinct, heightened requirement.

3 The standard is applied for direct SUD treatment records but not consistently for related information in a broader clinical note.

Related information embedded elsewhere carries the same genuine sensitivity and deserves the same heightened standard.

Week 1 Review current handling of substance use disorder records for genuine adherence to the distinct standard.

Week 2 Establish specific written consent language distinguishing this category from general release.

Week 3 Train all staff with potential record access, not clinical staff alone, on this heightened standard.

Ongoing Audit handling of related information within broader clinical notes for consistent application.

Ask an administrative staff member whether they're aware of the distinct standard for these specific records.

This reveals whether genuine understanding extends beyond clinical staff alone.

Ask to see the actual, specific written consent language used for this category of disclosure.

A real, specific document reveals genuine compliance, not an assumption general consent suffices.