If you practice in the US, running EMDR sessions over video puts you squarely in HIPAA territory the moment a client's information touches your telehealth setup. This is a practical checklist for what to look for in your tools and workflow — not legal advice, but a starting point before you talk to your own compliance counsel.
Why this matters beyond “checking a box”
HIPAA (the Health Insurance Portability and Accountability Act) sets baseline rules for how covered entities — which includes most therapists in private practice — handle protected health information, or PHI. PHI is broader than session notes: it includes anything that could identify a client and relates to their health or care, which in a remote EMDR context can include the fact that they’re a client at all, appointment details, and anything discussed or displayed on screen.
Getting this wrong isn’t just a compliance risk. It’s also a trust issue with clients who are disclosing sensitive material to you over a screen.
What makes a platform HIPAA-appropriate
The two things to check first
Whether the vendor will sign a Business Associate Agreement (BAA), and whether the connection is encrypted in transit. If either is missing, that's disqualifying for anything touching PHI.
A few things to look for when you’re evaluating any tool in your remote EMDR workflow:
- Encryption in transit. Video, audio, and any chat or file transfer should be encrypted end-to-end or in transit using current standards, not sent in the clear.
- A signed Business Associate Agreement. Under HHS guidance, a vendor that creates, receives, maintains, or transmits PHI on your behalf is a “business associate,” and you need a BAA with them before you rely on their tool for anything involving PHI (HHS.gov, Business Associates; HHS.gov, Covered Entities and Business Associates). Consumer-grade video apps that won’t offer a BAA are a poor fit for clinical use, whatever their marketing claims.
- Access controls. Only you (and anyone else on your team who needs to) should be able to reach session data, account settings, or recordings, if you keep any.
- A clear data-retention story. Know what the vendor stores, for how long, and how to have it deleted.
Where the “conduit” exception applies — and where it doesn’t
There’s a narrow exception in HIPAA guidance: a vendor acting purely as a conduit for PHI, without creating, receiving, or maintaining it on your behalf, may not require a BAA — the classic example is a postal service. In practice, most telehealth and video platforms don’t qualify for this exception, because they’re actively processing the call, may log metadata, or offer recording and storage features. Don’t assume a platform is exempt; ask directly, and get it in writing.
A pre-session checklist
Before you run a remote EMDR session
- Confirm your video platform will sign a BAA, or use one already covered under your practice's agreements
- Confirm the connection is encrypted, and avoid consumer accounts that lack that guarantee
- Store any client-identifying notes separately from your bilateral-stimulation tool, in a system you already know is compliant
- Have your telehealth-specific informed consent ready and reviewed with the client — see our guide to screening and informed consent
- Know your state's specific telehealth and recording-consent rules, which sit on top of HIPAA
Where CloudEMDR fits
CloudEMDR’s role in a remote session is narrow by design: it delivers the moving dot, bilateral sound, and session controls. It’s built so it doesn’t need client-identifying information to run — a client joins a Pro session by opening a link, with no account or personal details required on their end. That narrow scope is deliberate: the less identifying data a tool touches, the smaller your compliance surface. It doesn’t replace your HIPAA-compliant video platform, which remains the piece carrying your session audio and video.
Not legal advice
HIPAA compliance depends on your specific setup, state law, and how your practice is structured. This checklist is a starting point for evaluating tools, not a substitute for your compliance officer, legal counsel, or professional liability insurer.
If you work with associates or admin staff
Solo practice keeps your compliance surface small, but the moment anyone else — a biller, a virtual assistant, a group-practice colleague — touches scheduling or session information, your checklist grows. Anyone with access to PHI on your behalf needs their own access controls, and if they’re using a separate tool to manage that access (a scheduling app, a shared inbox), that tool needs its own BAA too. It’s easy to audit your primary video platform and overlook the smaller pieces of your workflow that also touch client information, so it’s worth walking through your full toolchain, not just the video call itself.
Recording sessions
If you record remote EMDR sessions for supervision, training, or client review, treat the recording itself as PHI from the moment it’s captured. That means encrypted storage, the same access controls as any other client record, a retention policy you can point to, and — separately from HIPAA — explicit client consent for the recording itself, which some states also regulate directly. If you don’t have a clear reason to record, the simplest compliance move is not to.
Beyond HIPAA: the bigger security picture
HIPAA is the US baseline, but if you ever see clients based in the EU, GDPR sets its own — often stricter — requirements. Our guide to GDPR compliance in digital therapy walks through that side. And if your practice crosses state lines, your telehealth setup isn’t the only compliance question — licensure is a separate issue, covered in telehealth licensure across state lines.
Build your remote setup with privacy in mind
CloudEMDR is designed to need as little client data as possible — Pro clients join a session with a single link, nothing to sign up for. See how the free version works before you commit.