Telemedicine, end to end: HIPAA, clinical video, EHR & AI

Telemedicine is the delivery of clinical care at a distance — a diagnosis, consult, or treatment over live video, phone, or store-and-forward. Telehealth is broader: it includes telemedicine plus non-clinical services like provider training, administrative meetings, and remote patient monitoring. Digital health is broader still, covering any health technology. In practice, “telemedicine” describes the clinical encounter; “telehealth” describes the whole remote-care program around it.

A custom telemedicine MVP typically runs from the low tens of thousands for a single-specialty video product to several hundred thousand for a multi-role platform with EHR integration, e-prescribing, and clinical AI. The cost drivers are compliance scope (HIPAA controls, BAAs, audit logging), the number of integrations (each EHR or pharmacy network adds time), and whether you build or buy the video layer. Most production builds land in a 6–9 month range.

HIPAA compliance is an architecture, not a checkbox. You need a signed Business Associate Agreement (BAA) with every vendor that touches PHI, encryption in transit (DTLS-SRTP for video, TLS elsewhere) and at rest, role-based access control, an immutable audit log of every PHI access, patient consent and data-retention handling, and a breach-response plan. The 2026 HIPAA Security Rule update also makes multi-factor authentication and asset inventory explicit requirements.

A Business Associate Agreement is the contract HIPAA requires between a covered entity (or another business associate) and any vendor that creates, receives, stores, or transmits protected health information on its behalf. It binds the vendor to HIPAA's safeguards and breach-notification duties. For a telemedicine build, you need a BAA with your video API, cloud host, transcription or AI provider, and any analytics tool — no BAA means that vendor cannot legally handle PHI.

A video API is “HIPAA compliant” only when the vendor will sign a BAA and you configure it correctly — the BAA is the deciding factor, not a marketing label. Major CPaaS vendors that offer a BAA include Twilio, Vonage, Agora, and Daily; building on WebRTC directly (mediasoup, LiveKit, Janus) keeps PHI in your own BAA-covered infrastructure. The right choice depends on call scale, recording needs, and how much of the stack you want to own.

An AI medical scribe — also called ambient clinical documentation — listens to a patient visit and drafts the clinical note automatically, so the clinician doesn't type during the consult. It uses speech recognition and large language models to transcribe and summarize, then writes back to the EHR for the clinician to review and sign. Because it processes PHI, it needs a BAA, a human-in-the-loop sign-off, and care to stay on the right side of the FDA's medical-device boundary.