HIPAA and Hotel WiFi: What Telehealth Providers Get Wrong

I’ve been doing remote work for years, mostly in healthcare IT. I’ve seen colleagues take their laptops to coffee shops, airport lounges, and yes, hotel rooms. And every time I hear someone say “I’ll just use the hotel WiFi, it’s fine” – I cringe a little. Because if you’re a telehealth provider handling protected health information (PHI), that’s not just a bad idea. It’s a compliance time bomb.

Let’s be real: telehealth has exploded. Therapists, doctors, and nurses are logging in from vacation rentals, business trips, and even RVs. And the rules around patient privacy haven’t gotten any more forgiving. HIPAA violations can mean fines up to $50,000 per violation, and in 2023 the Office for Civil Rights fined a mental health provider $60,000 for a single breach tied to unsecured WiFi. So yeah, this matters.

What’s the actual risk?

Hotel WiFi is a shared network. Anyone in the lobby, next room, or even a parking lot can potentially sniff traffic. Sure, most sites use HTTPS now, but that only encrypts the data between your browser and the website. If you’re using a VPN client that splits your traffic, or a poorly configured remote desktop, your PHI could be exposed in transit. And HIPAA isn’t just about encryption – it requires a full risk analysis and documented safeguards.

But most providers I talk to focus on the wrong thing. They think “I have a VPN, I’m safe.” And that’s where the real problem starts.

What people think works – and where it fails

The “just use a VPN” approach – consumer VPNs are designed for privacy, not compliance. They leak DNS, log connections, and often route through shared IPs that scream “VPN” to any security scanner. Some employers explicitly block known VPN IPs. And if you’re using a VPN from a hotel network, your traffic still goes through that hotel’s infrastructure first – meaning a compromised access point could intercept your VPN handshake.

Relying on HTTPS alone – yes, it encrypts the payload, but metadata like IP address, timing, and domain names are visible. For a compliance auditor, that’s not enough. You need end-to-end control.

Personal hotspots – better, but cellular networks have their own risks (SS7 attacks, man-in-the-middle with fake towers). Plus, if you’re traveling abroad, your carrier may hand your traffic to foreign networks.

I’ve literally seen a therapist log into an EHR system over a hotel WiFi while downloading a torrent on the same connection. That’s not just a security risk – it’s a lawsuit waiting to happen.

What actually matters for HIPAA compliance on the go

First, you need network-level control that goes beyond a simple VPN app. That means routing all traffic through a secure endpoint you control – ideally your home office network. This is where the concept of a residential IP and a dedicated router becomes relevant. Some people use a flashed router at home, then connect to it remotely via a VPN tunnel. It’s not perfect, but it gives you a fixed IP that doesn’t trigger alarms, and your traffic never touches a public VPN server.

But here’s the part most people skip: you also need to isolate work and personal traffic. A split-tunnel VPN is a liability. You want full-tunnel, with DNS forced through your own resolver. And logs – you need to keep logs of who connected, when, and from where, in case of an audit.

I’ve seen setups using a Raspberry Pi at home with OpenVPN, or a pre-configured travel router that acts as a VPN client back to a home base. Something like a GL.iNet router flashed with custom firmware can do this. But configuring it for HIPAA requires more than just plugging it in – you need to disable IPv6, lock down DNS, and configure firewall rules to block anything that leaks real location.

One company I’ve seen people use is keepmyhomeip.com – they provide a router that’s pre-configured to route traffic through a home IP. I’ve never used them personally, but the idea is sound. Another is flashedrouter.com, which sells travel routers with OpenVPN/WireGuard pre-installed. Again, not an endorsement, but I’ve seen folks in remote work forums swear by them.

But the real point is this: you can’t just slap a VPN on your laptop and call it compliant. You need a dedicated device that ensures all traffic from your work machine (and only that machine) goes through a secure tunnel. And you need to test it – regularly.

Why most people underestimate the risk

Because HIPAA enforcement is increasing. The OCR has stepped up audits, and they don’t care if you were “just trying to work from a hotel for a weekend.” The policy at most healthcare organizations is clear: no unsecured networks. But enforcement rarely happens until there’s a breach.

And breaches happen in weird ways. I know a provider who stayed at a hotel where the WiFi required a portal login. That portal redirected to a fake page that installed a keylogger. Next thing, his EHR credentials were used to access 200 patient records. That’s a $100,000 fine and a lot of bad press.

Employers are also getting smarter about detection. They monitor login IPs, browser fingerprints, even latency. If your home IP suddenly changes to Mexico, you’ve got explaining to do. And if you’re using a consumer VPN, they can flag the IP as a datacenter address. That’s an easy conversation to avoid by using a residential IP setup.

But it’s not just about avoiding detection – it’s about covering your ass. If a breach happens and you were on hotel WiFi without proper safeguards, you’re personally liable. That’s not a risk I’d take for a $15/day internet connection.

The bigger picture

Telehealth isn’t going away, and the boundaries between work and travel are blurrier than ever. But compliance doesn’t bend for convenience. If you’re serious about working from anywhere, you need to build a setup that’s both secure and undetectable. Not because you’re hiding something, but because the systems we use aren’t designed for mobility.

Most providers I know end up with a hybrid: a dedicated travel router that connects to a home VPN server, with split tunneling disabled. They use a second device for personal browsing. They test their setup monthly with a port scan and a leak test. It sounds like overkill until you’re the one facing an audit.

If you’re unsure where to start, reach out to someone who does this daily. A good IT consultant can set up a WireGuard server on a cheap VPS or a home router, route your traffic through a residential IP, and document everything for compliance. It’s not cheap – maybe $200 one-time plus monthly fees – but compared to a fine, it’s nothing.

At the end of the day, HIPAA and hotel WiFi don’t mix. Not without serious engineering. And if you think you’re the exception, ask yourself: is that risk worth your license?