HIPAA Security Rule update

    For teleradiology groups

    HIPAA compliance for teleradiology, proof a hospital can check.

    Live Compliance runs the HIPAA program for teleradiology groups: the status questions answered on paper, the risk analysis that covers every reading station, vendor BAAs down the chain, and the buyer-facing proof that moves a hospital contract through procurement, with a named compliance team on every plan.

    Or request a call

    ~10 minutes · No credit card · No call required

    Radiology groups are among the 500+ organizations on Live Compliance. Read the client stories.

    The public Trust Center page: the live seal, the organization's verified status, and the dated program record a buyer can check.

    The page a hospital's procurement team can check

    Where it goes wrong

    Where teleradiology programs actually fail.

    A teleradiology group reads for covered entities all night and holds their studies while it does. The failures are specific to that position: status nobody settled, stations nobody counted, and questionnaires nobody can answer fast.

    01

    Covered entity, business associate, or both

    Status is the question a procurement reviewer opens with, and most groups answer it loosely. A group that bills health plans electronically for its reads, itself or through a billing company, is a covered entity in its own right, because sending standard transactions is what the definition turns on. Separately, a hospital’s contract may require a business associate agreement (BAA), and signing one binds the group to its terms. Both can be true at once, and neither cancels the other. A group that cannot say which description applies under which contract cannot say which obligations it is carrying, which is precisely what the reviewer is testing.

    45 CFR 160.103 · HHS FAQ 240

    In the programThe program record states the group's status, the agreements behind each contract, and the proof a hospital asks for, in one place.

    02

    The contract stalls inside the security questionnaire

    Hospitals do not take a group’s word for its program; they send a questionnaire, and the contract waits while it sits. The group that answers in days, with evidence a reviewer can verify, keeps the deal moving. See what a reviewer can check.

    45 CFR 164.308(a)(1) · 164.316 (the program evidence a reviewer checks)

    In the programThe Seal of Compliance, the public Trust Center page read from your live program record, and the printed Statement of Satisfactory Assurance, cited to the CFR, on every plan.

    03

    Dozens of reading stations, in dozens of homes

    A teleradiology group’s facility is a fleet of reading stations spread across spare bedrooms and time zones, and the workstation use and security standards apply to every one. A program that cannot produce the list of stations cannot claim the controls behind them, and the list changes every time a radiologist joins or leaves.

    45 CFR 164.310(b)–(c)

    In the programThe device register knows every station, and on Professional and Enterprise the security agent watches each one, with findings logged by machine and severity.

    04

    The 1099 radiologist nobody classified

    HIPAA’s workforce definition turns on direct control, not pay status, so a contract radiologist whose work the group directly controls fits the definition and is normally trained and tracked like an employee. HHS lets a group treat that same person as a business associate instead, under a signed business associate agreement (BAA), but the label does not move the risk: the group is still liable for what its agents do. Groups that never decided have readers with no training record and no agreement, which is both answers failed at once.

    45 CFR 160.103 · 160.402(c) · 78 FR 5581-5582

    In the programEvery reader lands in the program either way: workforce members get role-based training with records, and the agreement tracker holds the BAAs for the rest. The classification call stays with your counsel.

    05

    Studies cross the network all night

    Teleradiology is transmission at volume: studies in, reports out, every night. The Security Rule requires technical measures to guard ePHI moving over a network, and the policies plus the evidence they are followed are part of the record an auditor and a hospital reviewer read.

    45 CFR 164.312(e)

    In the programTransmission security policies with tracked acknowledgments, organization-wide encrypted email on Professional and up, and the monitoring evidence beside them.

    06

    The vendor chain behind the reads

    The cloud picture archiving and communication system (PACS), the vendor neutral archive (VNA), the AI triage vendor, and the speech-recognition service all hold or hear ePHI on the group’s behalf, which makes them business associates or subcontractors in the chain. Written satisfactory assurances are required before ePHI moves, and a hospital’s questionnaire asks who the subcontractors are.

    45 CFR 164.308(b) · 164.502(e)

    In the programVendor and BAA tracking on every plan: the inventory, the signed agreements, and the renewal dates in one place.

    07

    The night the reading platform goes down

    A hospital that sends its overnight studies out has no reading room to fall back on. That makes the group’s contingency plan part of someone else’s patient care, and the Security Rule asks for more of it than most groups have written down. Three pieces are required outright: a data backup plan that keeps retrievable exact copies of ePHI, a disaster recovery plan that restores what was lost, and an emergency mode operation plan that keeps the processes protecting ePHI running while systems are down. Testing and revising the plan is addressable, which means the group either does it or documents why its alternative is reasonable. The version a hospital reviewer pushes back on is the one written for the billing server: it says nothing about how reads keep moving, who the hospital calls at two in the morning, or how studies read on a backup path get back into the record afterwards.

    45 CFR 164.308(a)(7)

    In the programThe contingency plan sits in the policy module with its review date and per-person acknowledgments, and the incident procedures name who calls which hospital, so the plan is a document the group has read rather than one it owns.

    08

    Licensure and HIPAA are two different problems

    A group reading across state lines carries two rule sets that get conflated constantly. Which states a radiologist may interpret studies for is a medical licensure question, decided by licensing boards, and HIPAA has nothing to say about it. HIPAA is federal and applies the same way wherever the patient sits. HIPAA overrides only state laws that conflict with it, and even a conflicting state law survives when it is more protective of health privacy. Most state health-privacy and breach-notification laws therefore apply alongside HIPAA, and they generally follow where the affected patients live rather than where the group keeps its office. A group reading nationally can therefore owe notice under several states’ laws from a single incident, which is a question to put to counsel before one happens, not during.

    45 CFR 160.203

    In the programThe program record knows which states the group reads for, so the incident procedure starts from a list of applicable laws instead of a scramble, and the licensure question goes where it belongs, to the group's counsel and its credentialing file.

    09

    A breach means telling every hospital you read for

    When a group holds studies for many hospitals, one incident fans out into many notifications. As a business associate, the group must tell each affected covered entity without unreasonable delay and no later than 60 calendar days after discovering the breach. For patients it serves as a covered entity in its own right, the group itself notifies the patients, the Department of Health and Human Services (HHS), and, when more than 500 residents of a state are affected, the media there. If the group acts as a hospital’s agent, the hospital’s own clock can start the day the group finds out, and state breach laws, which follow where the patients live, can add shorter deadlines. The clocks and the contact lists have to exist before the bad night, not after.

    45 CFR 164.410 · 164.404 · 164.406 · 164.408

    In the programIncident procedures with named owners and the notification clocks written in, and the incident log that timestamps discovery.

    Jim Johnson, Founder of Live ComplianceReviewed by Jim Johnson, Founder · Live Compliance
    Last reviewed November 2026

    Accuracy and legal note. Plain-language summary of the HIPAA Rules (45 CFR 160.103, 160.203, 160.402, 164.308, 164.310, 164.312, 164.316, 164.404, 164.406, 164.408, 164.410, 164.502), accurate as of November 2026. Regulations change. This is general educational information, not legal advice. Verify current requirements at hhs.gov/hipaa or with your compliance counsel.

    From the client wall

    “Live Compliance is much more than a portal; it has transformed our operations by streamlining employee onboarding and policy management. This platform has significantly improved our compliance posture and simplified our processes.”

    Ryan Furlough · Premier Radiology

    Read the client stories

    Straight answers

    Teleradiology and Live Compliance, in plain words.

    Live Compliance is the HIPAA compliance program for teleradiology groups: the status answered, the stations counted, the vendors on paper, and the proof a hospital can check, with a named compliance team on every plan.

    It works beside the PACS vendor and the IT relationship you already have. It does not replace them; it runs the program a hospital questionnaire and an auditor examine.

    • Since 2010
    • 500+ organizations
    • 19 modules
    • Named team on every plan
    • 100% audit success rate

    Frequently both, and the two are not alternatives. Sending claims or other standard transactions to health plans electronically, whether directly or through a billing company, is what makes a health care provider a covered entity in its own right, and a group billing for its own reads is doing exactly that. A hospital contract may separately require a business associate agreement, which binds the group to whatever it signs. Whichever description applies, the hospital will want proof of the program before it signs and while the contract runs. (Source: 45 CFR 160.103; HHS, "Covered Entities and Business Associates.")

    Usually not for the reads themselves. When one provider discloses to another for a patient's treatment, the rule asks for no agreement, and interpreting a study is treatment. Plenty of hospitals require one regardless, and signing is routine. A business associate agreement is needed if the group also does work for the hospital that is not treatment, such as storing the hospital's images or running its quality reviews. Nothing about the group's own duties gets smaller either way. (Source: 45 CFR 164.502(e)(1)(ii)(A); HHS FAQ 240.)

    From one place, rather than from six people's inboxes. Every plan carries the Seal of Compliance, a Trust Center page a reviewer can open and check against your live record, and a four-page Statement of Satisfactory Assurance written against the CFR for exactly this audience. It documents your program; it does not replace a business associate agreement where one is required.

    It turns on direct control. HIPAA's workforce definition covers employees and other people whose work is under the group's direct control, whether or not the group pays them. Those readers are normally trained and tracked like employees. HHS also allows a group to treat a contractor it controls as a business associate under a signed business associate agreement (BAA), but either way the group remains liable for the acts of its agents, and the contract label does not decide the question. Have your attorney confirm the contract language; either way the reads do not move without the paperwork. (Source: 45 CFR 160.103, 160.402(c); 78 FR 5581-5582.)

    Yes, and for most groups it is the normal arrangement rather than the exception. A spare-bedroom reading station is a workstation under the Security Rule, so the same expectations travel home with it: a written policy on where and how it may be used, physical protection around it, a login unique to that radiologist, authentication behind that login, and a protected path back to the picture archiving and communication system (PACS), which in practice means an encrypted connection. Encryption is technically an addressable specification, so a group that does not use it has to document why and what it does instead (45 CFR 164.312(e)). What catches groups out is the inventory. A station nobody wrote down cannot be described as secure.

    Yes. Holding or handling your ePHI is what the definition turns on, and that is the entire job of a cloud archive. Treat the vendor neutral archive, any AI analysis tool, and the speech-recognition service the same way: the written assurance, meaning a signed BAA, has to be in place before a single study reaches them. (Source: 45 CFR 164.308(b), 164.502(e).)

    Every price is published: $399, $895, or $1,450 a month plus $8.33 per employee per month, billed annually, with no add-on fees. Example: 20 employees. Professional is $1,061.60 a month. That includes the platform, the monitoring, and a named compliance team.

    Other specialties

    Radiology groupsMSOs and medical groupsMulti-location practicesDental practicesPharmacies
    See the platform, on real screensEvery price on the page

    See where your program stands before an auditor does.

    Get your free 10-minute audit-readiness score. Then, if you want it, the guarantee: audit-ready in 60 days, or we keep working at no additional cost until you are.

    Or talk to a Specialist

    ~10 minutes · No credit card · No call required

    500+
    healthcare organizations
    100%
    audit success rate
    2010
    protecting healthcare since