Remote chart review can be HIPAA-compliant when the clinic protects electronic protected health information, or ePHI. Appropriate administrative, physical, and technical safeguards must be in place. A collaborating physician should only access charts through authorized systems and devices. The clinic should also control user access, secure data transmission, maintain audit logs, and document any required business associate relationships.
Key Takeaways
- Remote chart review must protect ePHI with appropriate access, authentication, audit, and transmission safeguards. (Jump to Section)
- Collaborating physicians should receive only the EHR access needed for their oversight responsibilities. (Jump to Section)
- Secure transmission and device safeguards matter whenever charts are accessed outside the clinic. (Jump to Section)
- Audit logs help the clinic track who accessed records and what activity occurred within the system. (Jump to Section)
- A Business Associate Agreement may be required depending on the physician’s relationship with the clinic. (Jump to Section)
Core HIPAA Requirements for Remote Chart Review
HIPAA does not create a separate security standard just because a physician is reviewing charts remotely. The same Security Rule applies to ePHI that is created, received, maintained, or transmitted electronically.
For a clinic, the remote workflow should protect three things:
- Confidentiality: Patient information should not be available to unauthorized people.
- Integrity: Records should be protected from improper alteration or destruction.
- Availability: Authorized users should be able to access the information when needed.
HHS requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards. These include access controls, authentication, audit controls, workstation security, and transmission security.
A remote chart review process should, therefore, answer practical questions such as:
- Who can access the EHR?
- What records can the collaborating physician see?
- How is the physician’s identity verified?
- How is access recorded?
- What devices and networks may be used?
- How is ePHI protected during transmission?
- Who responds if unauthorized access occurs?
If the clinic cannot answer these questions, the workflow needs further review before remote access is granted.
Need a collaborating physician for remote chart review?
Get matched with a licensed physician who can support your practice's oversight workflow.
Access Controls for Remote Physician Chart Review
The collaborating physician should have their own authorized EHR account. Shared usernames or general clinic logins make it harder to control access and identify who reviewed a record.
HHS requires technical policies and procedures that limit ePHI access to authorized users. Access should also reflect the individual’s role.
For remote chart review, this means the clinic should:
- Create individual user credentials: Each physician should log in under their own account.
- Limit access by role: Give the physician the information needed for chart review without unnecessary access to unrelated systems or records.
- Use authentication controls: The system should verify that the person logging in is the authorized user.
- Remove access promptly: Disable credentials when the collaboration ends or the physician no longer needs access.
- Review access permissions: Update permissions when the physician’s responsibilities change.
The clinic should also document who approves remote access and what level of access is appropriate.
This is part of HIPAA’s broader information-access management requirement. Access to ePHI should be authorized based on the user’s role and responsibilities.
Secure EHR Access and Encryption
Remote chart review usually requires ePHI to travel across an electronic network. HIPAA therefore requires technical safeguards to protect information during transmission.
A compliant workflow should use a secure EHR or approved remote-access system rather than sending patient charts through personal email, consumer messaging apps, or other unapproved channels.
The clinic should review:
- Transmission security: Confirm that the platform protects ePHI when it moves between the physician’s device and the EHR.
- Encryption: Use appropriate encryption for ePHI when supported by the clinic’s risk analysis and security policies.
- Device security: Require secure devices with appropriate login controls and protections against unauthorized use.
- Network security: Avoid exposing ePHI through unsecured or unmanaged connections.
- Local storage: Limit downloading or storing patient information on personal devices unless the clinic has approved safeguards in place.
HHS guidance recognizes encryption as a way to make ePHI unreadable to unauthorized individuals. The Security Rule itself remains risk-based, which means the clinic should determine appropriate safeguards through its security risk analysis.
For a clinic owner, the practical rule is simple: the physician should review charts inside an approved secure system whenever possible, rather than moving patient information outside that system.
Audit Logs and Remote Access Monitoring
Remote chart access should leave a clear record of who accessed patient information and what they did in the system. The HIPAA Security Rule requires audit controls that record and examine activity in systems containing ePHI.
For remote physician chart review, the clinic should be able to identify:
- Who accessed the chart: Each physician should use an individual account so activity can be tied to a specific user.
- When access occurred: The system should record the date and time of each login and chart review.
- Which records were viewed: The clinic should be able to see which patient records were opened during the session.
- What actions were taken: Logs should show relevant activity such as viewing, editing, downloading, or printing records when the system supports it.
- Whether activity looks unusual: Access outside normal hours, repeated failed logins, or records outside the physician’s role may need review.
Audit logs are especially important when a collaborating physician works from another location. They help the clinic confirm that remote access matches the physician’s assigned responsibilities.
The EHR or remote-access platform should support activity logging. The clinic should also define when those logs will be reviewed. This may include routine monitoring, security incidents, patient complaints, or suspected unauthorized access.
Audit logs should work together with access controls. Access controls limit who can enter the system, while audit logs show what happened after access was granted.
Build remote chart review around a defined physician workflow.
Medical Director Co. matches practices with physicians.
When a Business Associate Agreement May Be Required
A Business Associate Agreement, or BAA, is not automatically required simply because a collaborating physician sees patient information.
The requirement depends on the physician’s legal relationship with the clinic.
Under HIPAA, a business associate is generally a person or entity outside the covered entity’s workforce that performs certain services or functions involving PHI. When a business associate relationship exists, the covered entity must have a written agreement that defines permitted uses of PHI and requires appropriate safeguards.
A clinic should determine whether the collaborating physician is functioning as:
- Part of the clinic’s workforce;
- A healthcare provider involved in treatment;
- An independent contractor performing services involving PHI; or
- A business associate under HIPAA.
The answer affects whether a BAA is required.
If a third-party EHR, cloud platform, or other vendor creates, receives, maintains, or transmits ePHI on the clinic’s behalf, that vendor may also be a business associate. HHS requires appropriate written assurances when a business associate handles ePHI.
Do not use a BAA as a substitute for secure access. The agreement creates contractual safeguards, but the technical workflow still needs to comply with the Security Rule.
Device and Workstation Security for Remote Review
Remote chart review extends the clinic’s HIPAA responsibilities beyond the physical office. The device, workspace, and access method used by the physician should all be covered by the clinic’s security policies.
For remote access, the clinic should define:
- Approved devices: Specify whether the physician may use a clinic-owned device, a personal device, or both. Any permitted device should meet the clinic’s security standards before EHR access is allowed.
- Login protection: Require secure passwords and any additional authentication controls supported by the EHR or remote-access system.
- Screen security: Patient information should not be visible to family members, visitors, coworkers, or others who are not authorized to see it.
- Unattended devices: Devices should be locked when not in use. Automatic screen locking can reduce the risk of unauthorized access.
- Local downloads: The clinic should decide whether charts, screenshots, reports, or other ePHI may be downloaded to the device. If local storage is allowed, additional safeguards may be needed.
- Printed records: Printing should be restricted or avoided unless the clinic has a secure process for storage and disposal.
- Lost or stolen devices: The clinic should have a clear reporting process so access can be disabled and the incident can be evaluated quickly.
- End of the physician relationship: EHR credentials, remote-access permissions, and any other access should be removed promptly when the collaboration ends.
The physical workspace also matters. A physician reviewing charts from home or another location should use a private setting where patient information cannot be seen or overheard by unauthorized people.
Remote access should follow the same security principles as access inside the clinic. The location changes, but the clinic’s responsibility to protect ePHI does not.
HIPAA Remote Chart Review Checklist
Before giving a collaborating physician remote chart access, confirm the following:
- The physician has an individual EHR account.
- Access is limited to what the physician needs for the role.
- Authentication controls are enabled.
- The EHR or access platform supports audit logging.
- ePHI transmission is protected.
- Devices used for remote access meet clinic security requirements.
- Local downloading and storage are restricted or controlled.
- Patient information is not sent through unapproved email or messaging tools.
- The clinic has completed a security risk assessment that includes remote access.
- Any required BAAs are signed.
- Access can be removed promptly when the relationship ends.
- The clinic has a process for responding to security incidents.
HHS requires regulated entities to assess risks to ePHI and implement safeguards that reduce those risks to a reasonable and appropriate level. Remote physician access should be included in that assessment.
How Medical Director Co. Supports Remote Chart Review
Medical Director Co. places collaborating physicians who provide ongoing chart review and physician support for practices.
The remote-review process should still operate within the clinic’s HIPAA-compliant EHR and security policies. Medical Director Co. can provide the physician relationship and collaboration structure, while the practice maintains the secure systems used to access patient records.
This gives clinics a defined physician oversight workflow without requiring them to independently recruit a physician for remote chart review.
Need a physician for ongoing remote chart review?
Get matched with a licensed collaborating physician for your practice.
FAQs
Is remote chart review allowed under HIPAA?
Remote chart review is permitted when ePHI is protected with appropriate HIPAA safeguards. The clinic should control access, secure electronic transmission, authenticate users, and monitor system activity. Remote access should also be included in the clinic’s security risk assessment.
Does a collaborating physician need a separate EHR login?
Individual access is the stronger approach because HIPAA requires access controls and audit mechanisms. Separate credentials allow the clinic to identify who accessed a record and manage permissions by user. Shared accounts make those controls more difficult to maintain.
Does HIPAA require encryption for remote chart review?
HIPAA requires appropriate protections for ePHI during electronic transmission. Encryption is an important safeguard and may be appropriate based on the clinic’s risk analysis and implementation decisions. HHS also recognizes encryption as a method for making ePHI unreadable to unauthorized individuals.
Does a collaborating physician need a Business Associate Agreement?
A BAA may be required depending on the physician’s relationship with the clinic and how PHI is being used. Not every collaborating physician relationship automatically creates business associate status. The clinic should determine the physician’s HIPAA role before deciding which agreement is required.
What should a clinic audit in a remote chart review workflow?
Review user permissions, login activity, chart access, device policies, transmission safeguards, and terminated-user access. Confirm that any required BAAs are current. Remote access should also be included in periodic security evaluations.
Secure the Workflow Before Remote Review Begins
HIPAA-compliant remote chart review requires more than giving a physician an EHR password. Clinics need controlled access, secure transmission, audit capability, and appropriate device safeguards. They also need the correct contractual relationships in place. Medical Director Co. can provide the collaborating physician, while the practice maintains the secure remote-access environment for patient records.
Set up physician chart review for your practice.
Get matched with a collaborating physician for ongoing clinical oversight.
Bolton M. Harris, J.D., is a seasoned attorney with a formidable background in criminal law and a focus on healthcare law and compliance. As the in-house legal counsel at Medical Director Co., Harris brings a unique blend of prosecutorial experience and regulatory expertise to support healthcare professionals across Texas. Her career spans roles as a prosecutor in multiple counties and now as a trusted advisor on the legal intricacies of medical practice operations.
Education & Early Career
Bolton Harris completed her undergraduate studies at Southern Methodist University (SMU) in 2013. During her time at SMU, she was not only a dedicated student but also a competitive athlete on the university’s women’s swimming team. She went on to earn her Juris Doctor from Texas A&M University School of Law in 2016 and became a member of the Texas Bar that same year. Armed with a strong academic foundation and discipline honed as a student-athlete, Harris embarked on a career in criminal law immediately after law school.
Prosecutorial Experience in Texas
Bolton Harris began her legal career in public service as a criminal prosecutor. She served as an Assistant District Attorney in multiple jurisdictions, where she quickly rose through the ranks and handled a broad spectrum of cases. Some highlights of her prosecutorial career include:
- Assistant District Attorney, Dallas County, Texas: Prosecuted a high volume of criminal cases in one of the state’s busiest DA offices, gaining extensive trial experience in both misdemeanor and felony courts.
- Assistant District Attorney, Ellis County, Texas: Continued to hone her courtroom advocacy skills, known for meticulous case preparation and a tenacious pursuit of justice on behalf of the community.
- Assistant District Attorney, Navarro County, Texas: Broadened her legal expertise by handling diverse criminal matters in a smaller county, working closely with law enforcement and community leaders to uphold the law.
Through these roles, Harris built a reputation for being a tough but fair advocate. She brought numerous cases to trial and developed an in-depth understanding of the criminal justice system. This distinguished prosecutorial background laid a strong foundation for the next phase of her career in the private sector.
Healthcare Law & Compliance at Medical Director Co.
After her tenure as a prosecutor, Harris shifted her focus to healthcare law, applying her legal acumen to the medical field. She recognized that the same attention to detail and tenacity that served her in criminal law could benefit healthcare providers navigating complex regulations. Embracing this new direction, Harris became well-versed in the intricate laws governing medical practices – from licensing requirements to patient safety and privacy standards – and is passionate about helping practitioners stay compliant.
In her current role as the in-house attorney for Medical Director Co., Bolton Harris oversees all legal and compliance matters for the organization and its clients. Medical Director Co. is a nurse-owned firm that connects nurse practitioners (NPs), physician assistants (PAs), and registered nurses with qualified medical directors and collaborating physicians, offering fast placements and comprehensive compliance support for healthcare practices. Harris ensures that each of these partnerships and clinical ventures adheres to all applicable state and federal laws. She is responsible for drafting and reviewing collaborative practice agreements, advising on regulatory requirements, and providing ongoing legal counsel as clients establish and grow their clinics. Drawing on her prosecutorial eye for risk management, Harris proactively identifies potential legal issues and addresses them before they escalate, giving healthcare professionals peace of mind.
Bolton M. Harris’s multifaceted expertise – spanning high-stakes courtroom litigation to detailed healthcare compliance – makes her a formidable legal ally. Whether advocating in front of a jury or guiding a medical practice through regulatory hurdles, she remains committed to the highest standards of the legal profession. Her blend of courtroom-tested skill and healthcare law knowledge ensures that clients of Medical Director Co. receive elite-level counsel and steadfast protection in an ever-evolving legal landscape.
