How to Conduct Telehealth Sessions Anywhere Without Violating HIPAA

You’re a therapist, counselor, or healthcare provider, and you’ve got a client who needs a session while you’re in a different state—or maybe even a different country. Or maybe you just want the freedom to take a session from a coffee shop or a co-working space. I get it. Remote work is great, but when you’re dealing with protected health information (PHI), one wrong move can land you in serious trouble.

I’ve seen a lot of providers think they’re covered because they use a standard VPN or they’re on a supposedly "secure" public network. But HIPAA is a different beast. It’s not just about encryption—it’s about having complete control over your environment and knowing exactly where data flows. And if you’re working outside your home or office, that control gets tricky fast.

The Real Problem: It’s Not Just About Encryption

Most people think HIPAA compliance for telehealth boils down to using an encrypted video platform (like Zoom for Healthcare or Doxy.me). That’s part of it, but it’s not the whole picture. The moment you step into a Starbucks, you’re sharing a network with strangers. Even if your video stream is encrypted, other traffic on that network could leak PHI if you’re not careful. Plus, your employer or the platform’s audit logs might flag that you’re connecting from an unusual IP—like a coffee shop in Barcelona when you’re supposed to be in Denver.

Then there’s the whole issue of business associate agreements (BAAs). Do you have a BAA with your VPN provider? Probably not. Most consumer VPNs explicitly say they aren’t HIPAA compliant. Using one actually violates the rules because you’re routing PHI through a third party without a contract.

What People Think Works (But Doesn’t)

I’ve heard people say, “Oh, I just use my personal hotspot” or “I’ll connect through a VPN app.” A hotspot from your phone is better than public WiFi, but it’s still mobile data—and if you’re abroad, your employer might wonder why your IP is suddenly in Thailand. A VPN app? It encrypts your traffic but it doesn’t make your IP residential. Most companies can still detect you’re using a VPN because data centers are obvious. And again, no BAA.

Some people try to get away with using a remote desktop to a computer at home, but that introduces latency and potential video hiccups during sessions. Not ideal for a client who needs you to be fully present.

What Actually Works: Network-Level Control

If you want to conduct telehealth sessions anywhere without violating HIPAA, you need to treat your internet connection like a medical device. That means controlling the entire path from your device to the destination. The gold standard is routing all your traffic through a secure tunnel back to your home network—specifically to a router you control.

Here’s how it works: You buy a dedicated router (like a flashed travel router) that automatically connects to your home network via OpenVPN or WireGuard. That way, every device you use—laptop, tablet, even a work phone—appears to be at your home IP address. Your employer sees a consistent, residential IP. And because the tunnel is encrypted end-to-end, there’s no exposure on the public network.

But wait—does this make you HIPAA compliant? Yes, if you also have a BAA with the company that provides the tunnel infrastructure, or if you own both ends of the tunnel (home router and travel router). Many providers sell pre-configured setups that include BAAs. I’ve seen services like keepmyhomeip.com and flashedrouter.com mentioned in forums as ways people simplify this. They basically give you a router that’s already set up to route through your home IP. You just plug it in at your remote location.

Other Compliance Must-Haves

• End-to-end encryption on your video platform. Make sure you’re using a HIPAA-compliant service with a signed BAA.
• No unsecured networks ever. Even with a tunnel, if your device has malware or you accidentally use a non-encrypted stream, you’re at risk.
• Logging and monitoring. You need to know what’s happening on your network. Tools like Pi-hole or a proper router log can help.
• Physical security. Don’t leave your device unattended in a café. Yes, obvious, but still.

The Broader Picture: Why Most People Underestimate This

Let’s be real—most remote healthcare providers treat HIPAA like a checkbox. They think as long as they have a password on their WiFi and use Zoom Healthcare, they’re fine. But audits are becoming more automated. Insurance companies, regulators, and even employers are scanning for anomalies. If your patient is in New York and your IP says you’re in Berlin, that’s a red flag. And if there’s a breach? You’re personally liable. Fines can start at $100,000 per violation.

I’ve seen clinics lose their Medicare contracts because one therapist took a “workcation” without telling anyone. It’s not worth the risk.

Conclusion: Do It Right or Don’t Do It

You can absolutely conduct telehealth sessions from anywhere—as long as you’re willing to set up the infrastructure properly. A consumer VPN won’t cut it. A hotspot won’t cut it. You need a dedicated, HIPAA-compliant tunnel back to a fixed location you control. Yes, it costs a bit upfront (maybe $200 for a pre-configured router plus a monthly fee for the tunnel service), but compared to the cost of a violation, it’s pocket change.

If you’re unsure about your setup, reach out to someone who specializes in remote work compliance for healthcare. Don’t guess. Your clients’ privacy—and your career—depends on it.