Build privacy into mobile and travel scenarios
Use fictional records to test logins from shared devices, lost access to a phone number, and an appointment from a location without privacy. Review whether notifications expose the treatment category. The San Diego support team should have an approved identity-verification process that does not require patients to send documents into arbitrary personal inboxes. If referral records cross organizational boundaries, specify the purpose, recipient, transmission method, and authorized personnel involved.
Map the information collected by intake, visits, billing, support, analytics, and outside vendors. Determine the entities covered by HIPAA and the agreements each relationship needs. Keep clinical details out of advertising events and routine support exports. Configure access by job responsibilities, test account removal, and document how records can be obtained after a patient leaves. HHS telehealth guidance is a starting point for privacy review, not a certification that a particular software configuration is compliant.