Think about how much care went into making your physical office confidential. Soundproofing between rooms. A waiting area out of earshot. Doors that close, files that lock, a front desk trained never to say a client's name too loudly. Now think about how much of that scrutiny was applied to the video session running from a clinician's laptop.
Telehealth became permanent in behavioral health because it works — it removes transportation barriers, reduces no-shows, and reaches clients who would otherwise go without care. But it also moved a clinical space out of a building you control and into networks, devices, and rooms you don't. The confidentiality obligation didn't move with it automatically. That part takes deliberate work.
The four places telehealth privacy quietly breaks
In our behavioral health assessments, the gaps are rarely in the video platform itself. They're around it:
- The clinician's room. A home office with a door is a clinical space. A kitchen table with family in the next room is not — and neither is a parked car, however tempting between appointments.
- The device. Personal laptops without encryption, without endpoint protection, and shared with a household are the single most common finding. If a session runs on it, it needs to meet the same standard as a workstation in your office.
- The account. A clinician's platform login without multi-factor authentication is one reused password away from someone else being able to enter sessions or reach records.
- The leftovers. Session notes drafted in a personal email draft folder, screenshots saved to a desktop, recordings nobody decided the retention rule for. Data at rest outlives the session.
What "configured correctly" actually means
Most major telehealth and video platforms can be operated compliantly, but the defaults are rarely the compliant settings. Worth confirming, in writing, for your organization:
- A signed Business Associate Agreement with the platform vendor — and with anyone else touching session data
- Waiting rooms enabled and unique meeting links, so no one arrives in the wrong session
- Recording disabled by default, with a documented exception process if it's ever clinically necessary
- Encryption verified in transit, and MFA required on every clinician account
- A written policy telling clinicians what a compliant environment looks like — headphones, closed door, no household members within earshot, work device only
Tell clients what you've done
There's a clinical benefit hiding in the compliance work. Clients disclosing difficult things over video are often quietly wondering who else can hear. A short, plain explanation at intake — how the platform is secured, that sessions aren't recorded, what you ask of them for their own privacy — is both a safeguard and a trust-builder. It's also the kind of practice that shows up well in an annual risk assessment.
Pick one clinician this week and walk their actual telehealth setup end to end: the room, the device, the login, where notes land afterward. Whatever you find there, you'll find across the team. Our free security assessment includes this review for behavioral health clients — and the findings are yours either way.
Telehealth earned its place in behavioral health care. It deserves the same deliberate confidentiality you built into your building — because to the client on the other end of the call, it's the same clinical relationship, and the same trust.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →