Privacy and Security Risk Factors Related to Telehealth Services – A Systematic Review

Abstract

The objective of the study is to identify challenges and associated factors for privacy and security related to telehealth visits during the COVID-19 pandemic. The systematic search strategy used the databases of PubMed, ScienceDirect, ProQuest, Embase, CINAHL, and COCHRANE, with the search terms of telehealth/telemedicine, privacy, security, and confidentiality. Reviews included peer-reviewed empirical studies conducted from January 2020 to February 2022. Studies conducted outside of the US, non-empirical, and non-telehealth related were excluded. Eighteen studies were included in the final analysis. Three risk factors associated with privacy and security in telehealth practice included: environmental factors (lack of private space for vulnerable populations, difficulty sharing sensitive health information remotely), technology factors (data security issues, limited access to the internet, and technology), and operational factors (reimbursement, payer denials, technology accessibility, training, and education). Findings from this study can assist governments, policymakers, and healthcare organizations in developing best practices in telehealth privacy and security strategies.

1. Introduction

The extended lockdown as a result of the COVID-19 pandemic brought about increased demand for telehealth services.¹ Before COVID-19, telehealth services existed but were not widely used, mainly due to the lack of reimbursement. The use of telehealth services has been viewed as innovative and a solution for improving the delivery of healthcare as well as reducing costs and increasing access to care regardless of location.² Prior to the COVID-19 public health emergency (PHE), Mental and behavioral health providers utilized telehealth services most frequently. However, after March 2020, with the declaration of the PHE, the necessity for telehealth services sored in all disciplines, especially with primary care, mental and behavioral health and pediatrics.¹

In a 2022 telehealth survey of physician participants conducted by the American Medical Association, 60 percent of respondents agreed or strongly agreed that telehealth enabled them to provide high-quality care. More than 80 percent of respondents indicated that with the use of telehealth, patients have better access to care.³ However, putting telehealth services to use during the pandemic opened the door to multiple issues, including health care disparities.⁴ With the increased use of telehealth and virtual care comes a plethora of new services, widening the gap of risks, which now include cyber and technology-related data security and privacy exposures.⁷ Also, patients’ lack of trust and expertise in using telehealth technology adds to their concerns for privacy and security.⁵ The American Telemedicine Association, a leader in telehealth policy, advocates for telehealth and virtual care technology to be built on a foundation of protection of patient privacy, patient data, and the reduction of cybersecurity risks.⁶ Despite telehealth being viewed as a valuable resource for providing quality healthcare services, data privacy and security concerns continue to hinder the perception of benefits and influence the overall adoption and successful use of virtual care services.²

Healthcare professionals have become acutely aware of the obstacles to using telehealth technology, such as the performance of physical examinations as well as the lack of reimbursement parity and differences in state licensure and regulations.⁸ Vulnerable populations struggle more than others with the use of healthcare technology, which raises privacy and security concerns.⁹ Although there have been significant temporary changes in telehealth policies at both the federal and state levels, permanent changes to support telehealth services have been slower to manifest despite the continued demand.¹⁰ To gain a better understanding of the challenges and barriers to the adoption and use of telehealth technology, the authors undertook this study to gather information that can be used to develop best practices and guidelines for telehealth privacy and security strategies.

Study Objectives

• 1. Identify challenges and associated factors for privacy and security related to telehealth visits during the COVID-19 pandemic.

• 2. Categorize challenges into key factors in order to develop best practices and guidelines for telehealth privacy and security strategy.

2. Methods

2.1. Search Strategy

This systematic review was undertaken using a comprehensive literature search to find all published work identifying privacy and security challenges in telehealth. The search strategy was developed with the assistance of a college librarian. The search terms included a combination of Medical Subject Heading (MeSH) and advanced terms such as privacy, security, and telehealth. The six databases of PubMed, Science Direct, ProQuest, Embase, CINAHL, and the Cochrane Library were selected for the search using database-controlled vocabulary terms for telehealth, privacy, and security.

A protocol was established before the search, data gathering, and analysis using the Population, Interventions, Comparison, and Outcomes (PICO) Framework. This protocol outlined the search strategy, selection process, and data collection. This approach allowed the reviewers to frame this research based on the PICO methodology, which include the following:

• Population: Includes all providers using telemedicine; all consumers of healthcare using telehealth, excluding insurance companies

• Interventions: Includes all types of telehealth services such as live video, store-and-forward, remote monitoring, and mobile health; excludes face-to-face encounters

• Comparison: Privacy and security challenges 2020-2022 with challenges prior to 2020

• Outcomes: Best practices for privacy and security

2.2. Inclusion and Exclusion Criteria

Inclusion Criteria

• English-language only

• Peer-reviewed empirical studies

• January 2020 to February 2022

• Search terms: telehealth, telemedicine, privacy, security, confidentiality

Exclusion Criteria

• Studies conducted outside of US

• Study design issues: non-empirical studies (systematic review, literature review, commentary)

• Non-telehealth related studies (mobile health, eHealth)

2.3. Review Process

The selection strategy of abstracts for full review was divided among three reviewers. First, each reviewer independently reviewed abstracts for inclusion. Then, each reviewer presented their findings to the full group, and all discrepancies were reconciled.

A total of 1,224 study abstracts were identified through online databases. Upon review, 47 studies were duplicates; the reviewers eliminated 750 studies based on inclusion criteria dates; and 122 were eliminated due to wrong study design. A full-text review was selected for 305 articles. Upon examination, 77 studies were excluded due to wrong study design, 29 were mobile health, 10 did not include privacy and security, 31 were foreign studies, and 140 studies were wrong publication type. Eighteen studies were found acceptable for analysis, as decided by the three reviewers. A summary of the selection process is shown in Figure 1.

Figure 1.

Study Selection Flow Diagram

3. Results

3.1. Study Design and Data Collection Methods

Eighteen studies were identified and included in this study. Quantitative studies were the most cited study design (n=8), followed by qualitative study (n=5), four mix-methods (n=4), and one pre-post design (n=1). The collection methods included a host of approaches from interviews (both semi-structured and focus group) to surveys eliciting both qualitative and quantitative measures. Table 1 contains the study design and data collection methods in the review.

Table 1.

Study Design and Data Collection Methods Included in the Review (total n=18)

Study Types	Data Collection Methods	Total Studies	Studies
Qualitative study	Interview (semi-structured), focus group	5	Alexander et al. (2021) Monk et al. (2021) Palinkas et al. (2021) Payán et al. (2022) Schoebel et al. (2021)
Quantitative study	Survey	8	Dekker et al. (2020) Esmaeilzadeh et al. (2021) Majmundar et al. (2022) Manze et al. (2022) Pooni et al. (2021) Puzzitiello et al. (2021) Schinasi et al. (2021) Thomas et al. (2021)
Mixed methods	Interview, focus group, survey	4	Allison et al. (2022) Harsono et al. (2022) Rogers et al. (2021) Wood et al. (2021)
Pre-post design	Both qualitative and quantitative measures	1	Zayde et al. (2021)
Total		18

3.2. Participant Types and Characteristics

The characteristics of the 18 studies, including the participant level, participant types, and a sample description, are summarized in Table 2.

Table 2.

Participant Types and Characteristics in the Review (total n=18)

Participant Level	Participant Types	Sample Characteristics	Author and Year
Patient/Consumer n=10
Patient/Consumer	Community members in rural Western North Carolina counties	n=17 community members perceptions of tele-COPD program	Alexander et al. (2021)
Patient/Parents/Consumer	8 academic-affiliated pediatric primary care practices in Southeastern US.	n=48 children & n=104 parents surveyed n=14 children, n=20 parents interviewed	Allison et al. (2022)
Patient/Consumer	1 of 6 ambulatory orthopedic surgery office, a large urban area in the US.	n=105 patients-orthopedic surgery	Dekker et al. (2020)
Patient/Consumer	Designed six experiments to examine how people (as an actual beneficiary of telehealth) evaluate five telehealth encounters versus face-to-face visits.	n=751 patients	Esmaeilzadeh et al. (2021)
Patient/Consumer	Two HIV clinics (outpatient)	n=205 patients of HIV population Patients and clinical staff. Telehealth visits	Harsono et al. (2022)
Patient/Consumer	Outpatient endovascular neurosurgery clinic	n=140 patients mailed n=65 responded to survey	Majmundar et al. (2022)
Patient/Consumer	Residents (consumers)	n=953 consumers of health care female and transgender males New York State Residents aged 18-44	Manze et al. (2022)
Patient/consumer	Patients (generalized) - musculoskeletal examination	n=816 patients	Puzzitiello et al. (2021)
Patient/Consumer	In-home remote patient monitoring via telehealth for blood pressure monitoring	n=214 patients	Thomas et al. (2021)
	of women with postpartum hypertension
Patient/Consumer	Outpatient child mental health clinic in an underserved urban community	n=12 patients	Zayde et al. (2021)
Provider n=6
Provider	Credentialed athletic trainers	n=11 athletic trainers	Monk et al. (2021)
Provider	State Mental Health Authorities (SMHA) representatives	n=29 SMHA representatives of 21 randomly selected states	Palinkas et al. (2021)
Provider	Pediatric Rheumatology Providers	n=223 providers	Pooni et al. (2021)
Provider	Provider (emergency medicine and neurologists) 9 observation sessions were conducted with 3 caregivers recruited for each session, a nurse, paramedic, and neurologist for a total of 27 caregivers.	n=27 caregivers	Rogers et al. (2021)
Provider	Independent children's hospital and outpatient providers - Chicago, IL	n=305 Pediatric providers	Schinasi et al. (2021)
Provider	Providers, licensed and no licensed behavioral health providers	n=31 behavioral health providers. Include: social workers, peer support specialists, psychologists, licensed professional counselors, board-certified behavioral analysts, registered nurses, other providers	Schoebel et al. (2021)
Patient and Provider n=2
Patient Provider	Patients & clinical personnel FQHC community health center	n=15 clinical personnel n=9 patients	Payán et al. (2022)
Patient Provider	Patient and provider (Adolescent Medicine at a large pediatric HCO)	n=392 telehealth visits were scheduled in n=331 unique patients n=23 providers	Wood et al. (2021)
		Include: endocrinology, attending physicians, nurse practitioners, fellows
		Visits were conducted collaboratively with registered dieticians, behavioral health providers, social workers, nurses, and interpreters.

Ten studies (56 percent)^{9,11-17,25,26} included patients, parents, or consumers, with the most common participant type being patients or parents utilizing telehealth services in an outpatient setting^{9,12,13,15,16,26} such as ambulatory surgery, clinics, or physician practices. Two studies^11,17 included participants from the community while one study¹⁶ examined remote monitoring. Overall, a total of 3,324 patients, parents, or consumers of telehealth were included in the 10 studies.

Six studies (33 percent)^{18,19,21,22-24} included a range of provider types from athletic training, emergency room providers, pediatricians, and mental health. A total of 626 participants were providers of telehealth services.

Two studies (11 percent)^4,25 included both provider (clinical personnel, physicians, and nurses) and parent types as participants. A total of 24 providers or parents were participants.

3.3. Privacy and Security Challenges and Risk Factors

Table 3 summarizes all papers analyzed for telehealth's privacy and security challenges and risk factors. Three risk factors associated with privacy and security in telehealth practice include: environmental factors (lack of private space for vulnerable populations, difficulty sharing sensitive health information remotely), technology factors (data security issues, limited access to internet and technology), and operational factors (reimbursement, payer denials, technology accessibility, training, and education).

Table 3.

Privacy and Security Challenges and Risk Factors

CHALLENGES RISK FACTORS	DESCRIPTION OF THE PROBLEMS	STUDIES
PATIENT RELATED
Privacy and confidentiality concern	• Privacy and cost were expressed as telehealth concerns. • Privacy and confidentiality concerns with telehealth visits. No technology-based confidentiality concerns. • Privacy concerns with use of remote video consultations. • Clinical staff reported challenges with ensuring privacy and confidentiality related to telehealth visits. • As noted in the survey of 65 patients, about one fourth had concerns about privacy and confidentiality when using telemedicine services, whereas nearly one half did not have these concerns. • Concern for the protection of patient privacy is expressed. • Privacy concerns were minimal and factors that influenced this included age, BMI, marital status, and readmissions. • Respondents reported privacy concerns before telehealth services. These concerns included being at home with other household members, other group members having household members at home, and technology-related issues such as hacking. • After attending their first telehealth sessions, participants indicated that the telehealth format did not affect their experience of privacy, suggesting that the experience in the telehealth session may have alleviated concerns for several participants and did not prompt new concerns for others. • Potential challenges include lack of familiarity with and access to technology and connectivity as well as issues protecting confidentiality and data security.	Alexander et al. (2021), Allison et al. (2022), Dekker et al. (2020), Esmaeilzadeh et al. (2021), Harsono et al. (2022), Majmundar et al. (2022), Manze et al. (2022), Payán et al. (2022), Puzzitiello et al. (2021), Thomas et al. (2021), Wood et al. (2021) Zayde et al. (2021)
Age related, such as Elderly, young adults	• Presence of parents and the location of the visit. • Neurosurgery patients expressed privacy concerns. • Individual-level patient barriers were older age, LEP, and limited digital literacy. • Privacy concerns with pediatric and adolescent population.	Allison, et al. (2022), Majmundar et al. (2022), Payán et al. (2022), Woods et al. (2021)
Space, location, environment (homeless)	• Difficult to have privacy without being overheard in the patient's home as well as provider's home office. • Clinical staff reported challenges with ensuring privacy and confidentiality related to telemedicine describing their experience of conducting telemedicine visits from home and navigating disruptions in their living spaces. • Among those with housing, lack of privacy in larger households and not having adequate space for confidential and private conversations was problematic. • Concern for the protection of patient privacy, requires patients have access to a private area for discussion and perform a virtual examination poses difficulties for patients who do not have access to private housing and lack access to proper equipment such as personal headphones. • Videoconferencing may inadvertently provide an unwarranted visualization of the patient's living conditions to the provider. • Unstable housing for the homeless presented challenges for providers. Coordination with shelter medical team to obtain privacy space for visits and care.	Allison et al. (2022), Harsono et al. (2022), Payán et al. (2022), Puzzitiello et al. (2021), Woods, 2021
Special patient population, such as HIV, pregnancy, mental health	• Some (HIV) patients reflected on the difficulty of speaking about personal information during telemedicine visits. • Perceived patient safety and privacy concerns obtaining contraception via telehealth.	Harsono et al. (2022) Manze et al. (2022)
Trust of provider and others	• Participants noted that to be successful, telehealth visits must be described and shown to them by their own provider or other trusted individual(s), such as a pharmacist. • The need for a suitable space may be another reflection of trust and privacy concerns rather than an issue of access to the technology needed to participate in a remote video visit. • We interpret our findings to indicate that the acceptability of remote video consultation might	Alexander et al. (2021) Dekker et al. (2020) Esmaeilzadeh et al. (2021)
	be improved by measures to gain trust and ensure privacy. • The need for a suitable space may be another reflection of trust and privacy concerns rather than an issue of access to the technology needed to participate in a remote video visit. • Perceived trust in medical care platforms’ competency.
Technology use Health/digital literacy (language, medical terminology) Patient awareness, Communication	• Most participants expressed a lack of interest and comfort in using Internet-capable devices (e.g., mobile devices, tablets, computers). • Need to assist patients with the technological requirements and reassure them that the remote video visit is secure and private. • Perceived technical errors • Perceived information completeness • Perceived communication barriers • Perceived technical challenges • Patients experienced technology barriers. Individual-level patient barriers were older age, LEP, and limited digital literacy. • Difficulty using telehealth, uncomfortable using the necessary technology to participate in virtual appointments. Widespread use of telehealth may not be readily accessible to everyone. Instead of assuming that patients know how to interact with technology, we may need to take “universal digital health literacy precautions” by assuming that they do not know how unless proven otherwise. • Problems with Bluetooth syncing and cellular data connectivity. These problems resulted in an inability for the Bluetooth enabled data collection devices to reliably sync the patient's clinical data to the tablet for transmission to clinicians.	Alexander et al. (2021) Dekker et al. (2020) Esmaeilzadeh et al. (2021) Harsono et al. (2022) Payán et al. (2022) Puzzitiello et al. (2021) Thomas et al. (2021)
HEALTH CARE PROVIDER RELATED
Privacy and confidentiality concern	• The athletic trainers were concerned with privacy and patient preferences and noted their level of experience and access to technology influenced these thoughts. • Patient focused including privacy, experience, and preferences. • Lack of privacy • Difficulty using with young children and youth in need of substance use treatment • Finding a Health Insurance Portability and Accountability Act (HIPAA)-compliant platform	Monk et al. (2021), Payán et al. (2022), Palinkas et al. (2021), Pooni et al. (2021), Rogers et al. (2021), Schinasi et al. (2021), Schoebel et al. (2021)
	• Patients may have limited ability to be able to engage confidentially with their provider. • Privacy and confidentiality concerns for providing adolescent and young adult telehealth visits. • Difficulty in protecting patient privacy. • The list of concerns includes patient privacy.
Space, location, environment	• Lack of private workspace for personnel. • Difficulty in maintaining awareness of the surroundings to protect patient privacy.	Payán et al. (2022), Rogers et al. (2021)
Technology use Digital literacy Accessibility	• Barriers to telehealth services included limited access to internet and technology • A key implementation barrier was the negative impact of COVID-19 on operations, which included the financial impact of losing patient volume/revenue and personnel shortages. • Personnel identified as central to facilitating implementation and use, included: 1) champions at various levels (leadership, peers) to provide leadership, motivation, and expertise; 2) clinic staff (e.g., CHWs, medical assistants) responsible for preparing patients and intake processes prior to each visit; 3) information technology (IT) personnel to issue equipment and provide technical support; and 4) bilingual personnel who provided high quality language concordant care. • Patients may have limited ability to be able to engage confidentially with their provider. • Providers continued to have concerns about the reliability of internet connections to support telemedicine. Families won't be able to access video services due to lack of digital devices, cellular data, or Wi-Fi, limitations in the physical assessment of a patient by video and quality of audio or video will be poor. • Providers identified several populations for which telebehavioral health was less accessible: clients with serious mental illness and substance use disorder, those with no broadband Internet access, children, and older adults.	Palinkas et al. (2021), Payán et al. (2022), Pooni et al. (2021), Schinasi et al. (2021), Schoebel et al. (2021)
Limitation of quality assessments and diagnosis	• Clinician focused concerns • Feasibility of provide quality of care through telehealth services. Accuracy of the diagnosis due to lack of physical touch of the patients. • Limitations in the physical assessment of a patient by video, and quality of audio or video will be poor.	Monk et al. (2021), Schinasi et al. (2021), Wood et al. (2021)
	• Limited ability to perform physical examination on HIV adolescent patient.
Professional development, training	• Challenge in training providers and clients. • Personnel capacity: A key implementation barrier was the negative impact of COVID-19 on operations, which included the financial impact of losing patient volume/revenue and personnel shortages. • Professional development capacity refers to personnel knowledge and familiarity with telemedicine as well as the availability of trainings or learning resources. Personnel with limited telemedicine knowledge and prior experience struggled, saying a lack of knowledge and uncertainty about appropriate use was challenging in the face of rapid implementation and workflow changes. • Issues with the Telemedicine system, lack of training and experience. Lack of team training.	Palinkas et al. (2021), Payán et al. (2022), Rogers et al. (2021)
Burn out of using telemedicine	• Providers reported an increase in their level of burnout with the use of telemedicine.	Pooni et al. (2021)
Liability, legal and regulatory issues	• Limitations in policy and reimbursement, technology and understanding the appropriateness and potential impact on patient health outcomes.	Pooni et al. (2021), Schinasi et al. (2021)
Reimbursement issues	• Training providers and clients, and reimbursement challenges. Policy changes to enable reimbursement, internet access, training, and provider licensing resulted in substantially fewer appointment cancellations or no-shows, greater family engagement, reduction in travel time, increased access for people living in remote locations, and increased provider communication and collaboration.	Palinkas et al. (2021)

Unsurprisingly, most cited challenges included privacy and security. Twelve studies^{4,9,11-17,20,25,26} cited patient privacy and confidentiality challenges, seven studies^18-21,22-24 cited provider privacy and confidentiality challenges, and age-related patient challenges were mentioned in four studies. The presence of parents during a pediatric/adolescent telehealth visit was an example of an age-related privacy concern. Additionally, the elderly population sometimes presented with limited digital literacy. However, age-related challenges were not noted for providers.

Seven studies identified the use of technology as a risk to telehealth.^{9,11,13-15,20,25} The technology risk includes health/digital literacy (language, medical terminology), patient awareness and communication, patients experiencing technical errors, perceived information incompleteness, lack of interest and comfort in using internet-capable devices, and the need for patient assistance with technology. Five studies^19-21,23,24 included technology issues for providers, such as limited access to the internet and telehealth-specific technology, financial cost of technology, implementation of technology, staffing, information technology personnel to implement and support technology, reliability of internet connections to support telemedicine, access to video services, lack of digital devices, cellular data, or Wi-Fi.

The patient's environment as a privacy risk was identified in five studies^4,9,12,15,20. For example, being overheard in the patient's or provider's home, navigating disruptions in their living space, lack of proper equipment such as headphones, unwarranted visualization of patient's living conditions, large households not having adequate space for confidential conversations, and lack of a private room for the vulnerable population such as the homeless. In two studies,^20,22 providers cited the lack of private workspace for personnel and difficulty in maintaining awareness of the surroundings to protect patient privacy as challenges.

Three studies identified patient's trust as a challenge to the use of telehealth.^11,13,14 Participants noted that to be successful, providers or other trusted individuals should describe and show patients how to use the technology; identifying a suitable space may be another reflection of trust, acceptance of remote video consultation to improve measures and gain trust, and perceived trust in the competency of telehealth platforms. Three studies identified professional development and training for telehealth as a challenge.^19,20,22 However, providers’ studies did not list trust as a challenge or risk.

Three studies identified limitations of quality assessment and diagnosis as a provider challenge and a risk only.^4,18,23 Individuals with HIV, pregnancy, or mental health diagnoses have special privacy concerns and two studies^15,17 identifying special privacy issues for these patients. Liability, legal, and regulatory challenges were found in two studies,^21,23 and reimbursement challenges¹⁹ and burnout from telehealth use²¹ were noted in one study for the providers only, respectively.

Discussion

Key Findings and Best Practices

This study identified the challenges and three key factors associated with telehealth privacy and security: environmental, technology, and operational factors. The authors developed and categorized these factors based on the identified issues and risks, and Table 4 illustrates the summary of each three factors and examples. To address these risk factors, best practices and recommendations are discussed below.

Table 4.

Summary of Environmental, Technological, and Operational Factors

Environmental Factors

• Lack of private space for vulnerable populations (homeless, elderly, adolescent/parent)

• Difficulty sharing sensitive health information (HIV, behavior health, contraception) remotely

• Videoconferencing may inadvertently expose the patient's living conditions to the provider

Technological Factors

• Technology data security issues (hacking of video visit)

• Limited access to internet and technology

• Lack of digital devices, cellular data, or Wi-Fi

• Digital literacy

• Poor quality of audio or video

Operational Factors

• Privacy and security concerns

• Reimbursement, payer denials

• Technology accessibility

• Training and education

• Maintenance and updating devices

Environmental Factor Implications

Environmental conditions play an essential role in telehealth privacy and security, which refer to an individual's surroundings, living conditions, and social connections that directly or indirectly impact privacy and security protections. Vulnerable populations such as the homeless, elderly, adolescents, and those who struggle with mental health are often concerned about the lack of private space for telehealth visits. Telehealth patient visits also create difficulty sharing sensitive health information remotely for people with certain conditions or diseases, such as HIV/AIDS, behavior health, and contraception requirements. The space, location, and accessibility to the use of telehealth are also a concern for healthcare providers.

For best practice, providing a safe, accessible environment should be a major concern when performing telehealth practice. Providers should check the availability and suitability of the patient location before and during the telehealth services. Provide guidance and resources to patients for finding a private place for the appointment when necessary. Use email, chat, or messages through the patient portal if a private location is unavailable or reschedule and suggest a better place for the telehealth visit. Explain to a minor patient whether parents or guardians should or should not be present at the appointment. Obtain informed consent or fill out a release of information before the visit begins.

Technological Factor Implications

Technology and digital literacies are other factors in telehealth privacy and security concerns. Technology factors include data security issues such as hacking of video visits, limited access to the internet and technology, lack of digital devices, cellular data use, or Wi-Fi, digital literacy such as limited knowledge and understanding of the technology use, and poor quality of audio or video output. Knowledge of technology use and digital literacy limiting the quality of assessments and diagnosis is another issue in telehealth use.

For best practice, when sharing information online, identify steps to protect patient information, and only enter personal information on secure websites with a lock icon in the URL bar. Require passwords for all online meetings and verify information while the patient remains in the “waiting room.” For patients with telehealth visits, do not set up a telehealth appointment or share personal information with an unknown provider; use the provider's main phone number to confirm their identity. Keep devices protected with updated antivirus software. Avoid using public Wi-Fi to access telehealth services, and avoid accessing telehealth on devices shared with people outside of the home or family. Improve the quality of audio and videos by working with IT staff to ensure adequate bandwidth. Utilize the network, quality of service, and other measures to enhance the speed of the internet. Provide resources and training to patients with low health digital literacy. Consider the needs of vulnerable populations, such as English as a second language, disabilities, minors, and the elderly population.

Operational Factor Implications

The operational factor is also important in telehealth privacy and security practice. Reimbursement, payer denials for telehealth services, technology accessibility for all patients, training, and education for both staff and providers, maintenance and updating of devices and software are all related to the operational factors.

For best practice, the healthcare provider should incorporate telehealth services into privacy and security policies, procedures, and workflows, as well as integrate telemedicine into the Notice of Privacy Practices. Conduct thorough training modules with multiple sessions, manually rehearse steps, and ensure workflow integration is in place prior to beginning sessions. Ensure all staff and providers have received telehealth-specific privacy and security training. Include telehealth equipment, software, and devices in the organization's security management plan and annual security risk assessment. Determine the need for business associate agreements.

Healthcare professionals should review insurers’ coverage determinations for telehealth services. Perform coding updates in the chargemaster to ensure billing codes meet payer requirements. Provide coding education for providers and office coding and billing staff. Ensure documentation for telehealth services is standardized and meets billing requirements. Use documentation templates or checklists for payer-specific requirements and use automatic time tracking within the organization's electronic health record for CPT code selection if available. Smart and dot phrases with predefined, modifiable snippets, which allow for standardization and timesaving documentation. Be aware of potential fraud or identity theft. At the start of each visit, verify a patient's identity using a government-issued ID and confirm their name, address, and device location.

Limitations and Future Studies

There are several limitations to this study. First, the search and review only included English-speaking languages, and studies conducted inside of the US; this limited comparison of any studies published in non-English and conducted in other countries. Second, the search only included peer-reviewed empirical studies; therefore, those non-peer-reviewed non-empirical studies, such as reports, case studies, and commentary published non-peer-reviewed, may be missed. Third, this review study included only publications from January 2020 to February 2022 intended to capture information beginning and during the COVID-19 pandemic. Therefore, the studies published before and after this period are excluded.

There are several opportunities for further research and investigation. First, although there have been significant temporary changes in telehealth policies at both the federal and state levels, permanent changes to support telehealth services have been slower to manifest despite the continued demand. Further research in developing and strengthening telehealth policies and regulations to better guide practice. There is also a lack of in-depth studies that address privacy and security concerns with the use of telehealth services and shows a need for continued research. In addition, the growth of telehealth and the use of technology has exposed digital health inequity and identified the need for digital health literacy education to the vulnerable populations. Finally, challenges such as provider telehealth burnout opens an avenue for further investigation.

Conclusion

The growth of telehealth use has inadvertently created challenges and issues for privacy and security. A multidimensional approach is needed when developing the best practices to incorporate and resolve the issues and tailor the needs of patients, providers, and operational managers. Building best practice guidelines and policies to address technology, digital literacy, accessibility and minimize privacy and security risks are necessary.

Author Biographies

Shannon H. Houser (shouser@uab.edu) is a professor in the Department of Health Services Administration at the University of Alabama at Birmingham in Birmingham, Alabama.

Cathy A. Flite (cflite@temple.edu) is an associate professor in the Department of Health Services Administration & Policy at Temple University in Philadelphia, Pennsylvania.

Susan L. Foster (fsusan@wustl.edu) is privacy compliance educator in the HIPAA Privacy Office at the Washington University School of Medicine in St. Louis, Missouri.