Block 6. Security, Privacy, and Accessibility

1

Threat Modeling a Telemedicine Platform

Threat modeling a telemedicine platform: STRIDE, the attack surface, and the HIPAA risk analysis you need. A repeatable method plus a free worksheet.

2

Securing the Video Pipeline End to End

Secure a telemedicine video pipeline end to end: DTLS-SRTP, TLS/mTLS, signed URLs, secrets, and the PHI boundary — with the HIPAA rule for each layer.

3

End-to-End Encryption in Telehealth: When You Need It and What It Costs

When does telehealth need end-to-end encryption? HIPAA doesn't require it. See when E2EE is worth its cost, what it breaks, and how to still record.

4

Authentication and Identity for Patients and Providers

How telemedicine authenticates patients and providers: NIST assurance levels, the proposed 2026 HIPAA MFA rule, and account recovery that doesn't leak PHI.

5

Data Residency, Sovereignty, and Where PHI Lives

Where can telemedicine PHI legally live? HIPAA sets safeguards, not borders, but GDPR, France's HDS, and the EHDS can pin health data to a region.

6

Incident Response and Breach Notification

The HIPAA breach notification 60-day rule, the four-factor risk test, who to notify at 500+, and the incident-response runbook a telehealth team needs.

7

WCAG 2.1 AA for Telemedicine Video — Mandatory in 2026

WCAG 2.1 AA is now the legal accessibility bar for telemedicine video. Which law applies, the 2027 deadlines, and a consult audit checklist.

8

Designing for the Patients Who Need It Most: Elderly, Low-Vision, Low-Bandwidth

How to design telemedicine for elderly, low-vision, and low-bandwidth patients: one-tap join, audio-only fallback, large targets — fewer failed visits.