Limit information access to the assigned work
HHS explains HIPAA duties for covered telehealth providers, including appropriate technology and vendor arrangements. Support access should follow the real task and applicable privacy obligations. HHS technology and privacy guidance
Map what navigators, clinicians, billing staff, and outside recipients can see. A worker explaining a fee may not need the full clinical note. Review permissions, logging, and the process for correcting information. Give patients a clear explanation when assistance involves sharing details with another service.
A qualifying consumer health-record product may also fall within the FTC's Health Breach Notification Rule. Review that scope if the business includes such a product. FTC health-record rule guidance
Test a fictional patient who declines optional coordination. Explain the remaining service choices accurately. The company should not treat broad disclosure as the price of receiving ordinary scheduling help. Keep sensitive clinical content out of general marketing and sales records.