Control access across the care and support teams
If the company combines Chicago-based operations with a distributed clinical team, define who can read clinical notes, update contact details, and resolve billing issues. A shared customer record should not expose more information than each job needs. Review interpreter and referral communications as carefully as the video platform. For reporting, use appropriately aggregated operational measures, such as incomplete follow-ups, without giving advertisers patient-level clinical events or inferred neighborhood health characteristics.
Map the information collected by intake, visits, billing, support, analytics, and outside vendors. Determine the entities covered by HIPAA and the agreements each relationship needs. Keep clinical details out of advertising events and routine support exports. Configure access by job responsibilities, test account removal, and document how records can be obtained after a patient leaves. HHS telehealth guidance is a starting point for privacy review, not a certification that a particular software configuration is compliant.