Choosing a Telehealth Platform: The BAA and Contract Checklist

Pick a telehealth platform on its contract, not its demo. The clauses that matter are the business associate agreement, data ownership and secondary use, subcontractors, breach reporting, exit and data return, and, new for 2027, how you pay the vendor. Video quality and scheduling screens are close to interchangeable across serious vendors; the contract terms are not.

Does the platform have to sign a BAA?

If it creates, receives, maintains or transmits protected health information for you, yes. The HHS Office for Civil Rights ended its COVID-era enforcement discretion for non-compliant telehealth tools at 11:59 p.m. on August 9, 2023 (88 FR 22380), so a consumer video app without a BAA is no longer an option. A vendor that says it is "compliant" but will not sign your BAA, or will only sign its own and refuses changes, is telling you something.

The required contents are set by 45 CFR 164.504(e)(2). Read the vendor's paper against that list:

• Permitted and required uses and disclosures, and no use or disclosure beyond them.
• Appropriate safeguards and compliance with the Security Rule (45 CFR part 164, subpart C) for electronic PHI.
• Reporting of any unauthorized use or disclosure, including breaches of unsecured PHI under § 164.410, which sets an outside limit of 60 calendar days after discovery. Negotiate a shorter window; many practices ask for five to ten business days.
• Flow-down to subcontractors that handle PHI, with the same restrictions.
• Access, amendment and accounting-of-disclosures support so you can meet patient rights under §§ 164.524, 164.526 and 164.528.
• Books and records available to HHS.
• Return or destruction of PHI at termination, or extended protection if that is not feasible.
• Your right to terminate if the vendor materially breaches.

How should the main contract handle data?

The BAA sets the floor. The commercial agreement is where vendors reserve rights you may not notice.

• De-identified and aggregate data. Many platforms reserve the right to de-identify your data and use it for their own products. Decide whether you accept that, and if so, require de-identification under 45 CFR 164.514 and no re-identification or sale.
• Marketing and analytics. Ask, in writing, which third-party scripts, SDKs and pixels run in the patient-facing app and the booking pages. A tracking tool on a logged-in patient page can disclose PHI. See tracking pixels on telehealth sites.
• AI features. If the vendor offers ambient notes or summarization, find out which model provider processes the audio, whether that provider is a subcontractor under the BAA, and whether recordings are retained.
• Ownership and export. You should own the clinical record and be able to export it, in a usable format, during the term and for a set period after it.

Which clinical and compliance features actually matter?

• Patient location capture. Licensure follows the patient. The platform should record the patient's stated location at the start of every visit and store it with the encounter. See verifying where the patient is.
• Identity verification. Photo ID capture and a way to compare it at later visits, which matters most if you prescribe controlled substances. See patient identity verification.
• Modality controls. Medicare defines an interactive telecommunications system at 42 CFR 410.78(a)(3) as two-way, real-time audio and video, with audio-only allowed in defined cases. Your platform needs to record which modality was actually used, because the claim depends on it.
• Consent capture. State-specific consent language, versioned, with a timestamp tied to the patient record.
• E-prescribing. If controlled substances are in scope, the e-prescribing module must meet DEA's electronic prescriptions for controlled substances rules (21 CFR part 1311), including identity proofing and two-factor signing for each prescriber.
• Audit logs. Who opened which record and when, exportable for an investigation.

Why do payment terms matter for Medicare claims in 2027?

Section 6209(g) of the Consolidated Appropriations Act, 2026 requires a modifier, effective January 1, 2027, on Medicare telehealth claims furnished through a virtual platform when the practitioner contracts with the entity that owns the platform or has a payment arrangement with it for using the platform, and on telehealth services furnished incident to a practitioner's service. In the CY2027 physician fee schedule proposed rule (91 FR 43842, July 16, 2026), CMS says it is creating modifiers BB and BC and will publish guidance on its website. The modifiers do not change payment, but they make your platform relationship visible on every claim. Before you sign, know which arrangement you are in and make sure the vendor's billing integration can append the modifier. Code-level questions go to White Glove Medical Billing.

The contract checklist

• BAA signed, matching every element of 45 CFR 164.504(e)(2), with breach notice in days, not the regulatory maximum.
• List of subcontractors that touch PHI, with notice before new ones are added.
• No secondary use of identifiable data; de-identified use only if you agree, under § 164.514.
• Inventory of third-party scripts and SDKs on patient-facing pages.
• Data export format, timing and cost at termination.
• Uptime commitment and service credits; a defined downtime procedure for clinicians.
• Security documentation: most recent independent assessment, penetration test summary, encryption at rest and in transit.
• Patient location, identity and consent capture configurable per state.
• EPCS certification if controlled substances are in scope.
• Payment arrangement described clearly enough to choose the 2027 telehealth modifier.
• Insurance: the vendor's cyber liability limits and whether you are an additional insured.

Should the platform also be the EHR?

For a single service line in a few states, an all-in-one platform is usually simpler. Once you add a second service line, labs from more than one vendor, or remote monitoring, check how the platform exchanges data before you commit. Migrating records later costs far more than asking now.

Our Platform, Pharmacy & Lab Selection service ($2,450) runs this checklist against your shortlist and returns a redline list for your counsel. See pricing.