What Is Telehealth? Definition & Examples

Telehealth is the delivery of care remotely using digital channels such as video, phone calls, monitoring devices, and patient portals. In practice, it depends on identity and access controls that let the right patient reach the right service quickly while keeping protected health information secure.

How Telehealth Works

Telehealth is a care-delivery model, not a single product. It combines synchronous visits, asynchronous messaging, remote monitoring, and portal access so clinicians can reach patients outside the exam room while preserving continuity of care.

The practical value of telehealth comes from reducing friction in access and extending clinical reach, but the service still has to preserve the same core requirements as in-person care: correct patient identification, safe communication, accurate documentation, and reliable escalation when remote care is not enough.

Core Security and Privacy Requirements

Telehealth depends on controls that protect protected health information while allowing fast access for the right person at the right time. That usually means secure authentication, session protection, encrypted communications, access logging, and careful handling of device, portal, and messaging data.

The security challenge is not just confidentiality. If access is too strict, patients cannot connect when they need care; if access is too loose, the service can expose records, misroute communications, or allow account abuse. A telehealth program therefore has to balance usability, availability, and privacy as part of the same service design.

For a broader control baseline, NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference for the access control, identification, authentication, audit, and system protection concerns that telehealth implementations must address.

Common Telehealth Use Cases and Delivery Modes

Telehealth covers more than live video appointments. It includes telephone triage, specialist consultations, remote follow-up, medication review, patient portals, and connected devices that send readings back to the care team.

Each delivery mode changes the risk profile. Video visits depend on stable connectivity and secure conferencing. Patient portals depend on account integrity and message confidentiality. Remote monitoring depends on trusted device data and on the clinical workflow that interprets it. The security design has to fit the mode, not just the brand of platform.

Where telehealth uses authentication, enrollment, or step-up verification to reach the right patient record or clinician workflow, NIST SP 800-63 Digital Identity Guidelines provides a relevant assurance model for selecting authentication strength and identity-proofing depth.

Governance, Compliance, and Operational Oversight

Telehealth is often governed as a healthcare service, an information system, and a privacy-sensitive communication channel at the same time. That means ownership needs to span clinical operations, security, privacy, vendor management, and incident response rather than sitting in one team.

Operational oversight should account for data retention, recording practices, third-party service dependencies, and the rules that determine when a remote encounter must be converted to in-person care. The best programs treat telehealth as a normal part of care delivery, but with explicit controls for identity, consent, logging, and data handling.

For privacy and processing controls, the EU General Data Protection Regulation (GDPR) is a strong reference point where EU personal data is involved, especially around data minimization, security of processing, and data protection by design. For programmes that need a broader governance lens, the NIST Privacy Framework helps structure privacy risk management around data use and protection outcomes.

Risk and Threat Considerations

Telehealth increases exposure to account takeover, phishing, misdirected communications, and privacy leakage because care depends on remote access paths that cross devices, networks, and third-party services. The main risk is not just a breached platform, but a compromised appointment, message thread, or patient session that can disrupt care and expose sensitive information.

Failure mechanism: Weak authentication, poor session handling, or insecure portal and device configuration can let an attacker impersonate a patient or clinician, intercept a visit, or access records and messages.

Impact: The result can be disclosure of protected health information, unsafe clinical decisions based on false or incomplete data, loss of patient trust, and service interruption during time-sensitive care.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-2 — Account Management	Telehealth relies on controlled user accounts for patients, clinicians, and staff.
	IA-2 — Identification and Authentication (Organizational Users)	Clinician and staff access to telehealth systems depends on strong user authentication.
	AU-2 — Event Logging	Telehealth platforms need logs for access, messaging, and remote-session activity.
Recommendation — Provision and review telehealth accounts so only approved users can reach care workflows. Require strong authentication for staff and clinicians accessing telehealth systems. Log telehealth access and session events so misuse and privacy incidents can be investigated.
GDPR	Articles 5, 25, and 32	Telehealth processes EU personal data and needs privacy by design and secure processing.
Recommendation — Design telehealth data flows for minimization, security, and privacy by default.

Telehealth