File Transfer for Telemedicine: Secure Remote Care

Telemedicine file transfer happens inside HIPAA-covered video platforms (Doxy.me, Zoom for Healthcare, Teladoc) or through connected EHR portals (MyChart, FollowMyHealth), not through consumer messaging. A workable stack: an integrated telehealth platform with a BAA, an e-prescribing service (DrFirst, Surescripts, RxNT) wired to the EHR, a FHIR-based document exchange for imaging and labs, and a BAA-signing ad-hoc transfer service like HexaTransfer Enterprise for the rare out-of-band send. The 2020 OCR enforcement discretion period ended May 2023; providers now must use HIPAA-compliant telehealth tools, not consumer Zoom or FaceTime.

The Post-PHE Compliance Reset

During the COVID public health emergency, OCR temporarily waived HIPAA enforcement against providers using consumer-grade video (FaceTime, Skype, Zoom consumer) for good-faith telehealth. That discretion ended May 11, 2023, with a 90-day transition period.

Since August 2023, telehealth visits must use HIPAA-compliant platforms with:

Business Associate Agreement signed
End-to-end or server-side encryption of video and data
Access controls and authentication
Audit logging
Breach notification obligations

Platforms that meet the bar: Doxy.me, Zoom for Healthcare, Microsoft Teams with BAA, Webex for Healthcare, Teladoc, Amwell, MDLive, Doximity Dialer.

Pre-Visit Document Collection

Patients arrive at a telehealth visit with relevant prior records — outside lab results, imaging CDs, discharge summaries from other systems, medication lists. Capturing these before the video starts saves time.

Workflow:

Patient books through the portal
Portal auto-sends a secure upload form 48 hours before visit
Patient uploads photos of ID, insurance card, and any prior records
Office staff reviews, adds to EHR
Clinician has everything before the video begins

Platforms handling this: Phreesia (intake), Klara, Luma Health, Clearwave, Solutionreach. For ad-hoc document requests mid-visit, the patient can upload through the same secure link or, if urgent, photograph and message through the portal.

During-Visit File Exchange

Mid-visit, clinicians often need to share information with the patient: educational materials, after-visit instructions, referral letters, treatment plans. Most modern telehealth platforms include in-session file attachment.

Common file types:

After-visit summary (.pdf, 1 to 3 pages): auto-generated by EHR
Patient education handouts (.pdf): from EHR patient library or AAFP, ACP, etc.
Image annotations (.png, .jpg): explaining anatomy or procedure
Prescription documentation: sent via e-prescribing, not handed to patient
Lab order forms: electronic signature, routed to lab
Referral letters: generated and shared through HIE or Direct

For files too large for the telehealth chat (rare, but some imaging exports hit 100 MB), drop a password-protected transfer link in the chat and share the password verbally during the call.

E-Prescribing and Controlled Substances

E-prescribing (eRx) is the required method in most states. The stack:

EHR's e-prescribing module (Epic, athenahealth, eClinicalWorks, NextGen)
Surescripts as the national network
DrFirst, RxNT as standalone options for non-EHR workflows
EPCS (Electronic Prescribing of Controlled Substances) requires two-factor authentication per DEA requirements

The Ryan Haight Act and subsequent DEA rules governed controlled substance prescribing via telehealth. The DEA issued temporary rules during COVID permitting telehealth prescribing without prior in-person exam, which have been extended through late 2025 with permanent rulemaking in progress. Check current DEA guidance before prescribing schedule II-V medications via telehealth.

Don't email prescription PDFs to patients. That's not how prescribing works in 2026 — pharmacies receive eRx through Surescripts; patients don't handle the prescription at all.

Imaging and Diagnostic Test Sharing

Telehealth visits often involve reviewing imaging or diagnostic studies. Options:

Patient has imaging in Apple Health (pulled from participating hospitals): screen share
Patient has CD: have them upload through a cloud image exchange (PocketHealth, Ambra, LifeImage)
Provider has imaging: share through the EHR's image viewer
Outside provider imaging: request via Carequality, CommonWell, or TEFCA QHIN

For urgent visits where imaging arrives during the call, a patient-uploaded DICOM through the telehealth platform's file feature works — but the file sizes (often 500 MB+) exceed many platforms' limits. A dedicated cloud image exchange handles this better.

Mental Health and Psychiatric Telehealth

Behavioral health is the largest telehealth specialty. It brings additional privacy considerations:

Psychotherapy notes (HIPAA 164.501): separately protected, require specific authorization for most disclosures
42 CFR Part 2 (SUD records): strict consent requirements for substance use disorder data
State-specific mental health privacy laws: often stricter than HIPAA
Minors: varying state rules on adolescent consent for mental health services

For therapy sessions, purpose-built platforms (SimplePractice, TheraNest, TherapyNotes, Ivy Pay for billing) combine video, scheduling, notes, and billing. They sign BAAs and handle the specialty workflow better than general telehealth tools.

Cross-State Licensure and Multi-State Workflows

Clinicians practicing telehealth across state lines need licensure in each state where the patient is located (with some compact exceptions: IMLC for physicians, PT Compact, Nurse Licensure Compact, PSYPACT for psychologists).

File sharing in multi-state practice faces additional issues:

Records retention per each state's rules
Medical records release forms that comply with each state's release statute
State-specific informed consent requirements
Prescription monitoring program (PMP) reporting in the patient's state

A cloud EHR with multi-state configuration (athenahealth, Epic, eClinicalWorks) handles most of this. For record releases across state lines, use the stricter state's form or a multi-state-compliant composite.

Home-Based Devices and Remote Monitoring

Remote patient monitoring (RPM) generates continuous data streams: blood pressure, glucose, weight, ECG, SpO2. Platforms that handle this:

Dexcom, Abbott Libre (glucose)
Omron, Withings (BP, weight)
Apple Watch, Fitbit (activity, ECG)
iRhythm Zio (extended ECG monitoring)
Philips, Cardiomems (cardiac implants)

Data flows from device to vendor cloud, then via HL7 FHIR Observation or proprietary API to the EHR. BAAs cover each vendor in the path. Billing uses CPT codes 99453-99458 for RPM and 99457-99458 for remote therapeutic monitoring.

Ad-Hoc File Transfer for Edge Cases

Despite integrated platforms, edge cases require ad-hoc transfers:

Specialist review of unusual imaging not yet in PACS
Multi-disciplinary tumor board: send pathology + imaging + labs to consulting providers
Second-opinion services: patient-initiated package assembly
Medical-legal releases: attorney requests records for litigation
Research consortia: de-identified data sharing

For these, use a BAA-signing encrypted transfer tool. Set expiration to 14 days, password-protect, share password via separate channel.

Security Practice for the Remote Clinician

Many telehealth providers work from home. Minimum controls:

Device: organization-managed, disk encryption enabled (BitLocker, FileVault), EDR installed (CrowdStrike, SentinelOne)
Network: VPN to hospital network or Zero Trust Network Access (Zscaler, Cloudflare Access)
Physical: private room with door closure during visits, screen positioned away from others, headphones
Authentication: MFA on all clinical systems (hardware key like YubiKey preferred)
Auto-lock: 5-minute screen lock
Printing: disabled for PHI where possible; when required, secure print queue

A Workable Telehealth Stack

Video platform: Doxy.me, Zoom for Healthcare, or Teams with BAA
EHR with telehealth module: Epic, athenahealth, eClinicalWorks
E-prescribing: Surescripts via EHR; DrFirst for EPCS
Remote monitoring: specialty-specific platforms with FHIR to EHR
Ad-hoc transfers: BAA-signing E2EE service
Patient intake and forms: Phreesia or Klara
Secure messaging: EHR portal or BAA-covered messaging (TigerConnect)

Try it at hexatransfer.com — free, no account, 10 GB max.