Grand Prairie, TX
HIPAA-Safe Video Visits for Grand Prairie TX Providers
A video visit has two halves, and only one of them can be bought.
Book a Demo
The purchasable half is now settled for a Grand Prairie provider using Cleod9. The videoconferencing runs on Wildix, which will enter into a business associate agreement covering voice, voicemail, video, recording and transcription. Text messaging is excluded from it. Media is encrypted in transit using DTLS-SRTP, signaling and web traffic use TLS, Wildix has completed SOC 2 Type 1 and Type 2 audits under ISAE 3000, and each customer runs on a dedicated single-tenant instance in AWS.
The other half is the room the provider is sitting in, the device the patient joined on, who else can hear, what was documented, and what happens when the connection drops in the middle of an examination. No platform supplies any of that, and it is where the privacy of a video visit is actually won or lost.
This page is about the second half. It is operational guidance rather than legal or compliance advice. A signed agreement and an audited platform are necessary and not sufficient, and what a practice is required to do under HIPAA is a question for its own privacy officer or counsel.
The boundary, drawn plainly
It helps to write down which side of the line each thing sits on, because most of the confusion in this subject comes from assuming the vendor covers more than it does.
The platform's side
Encrypting the connection. Protecting the service. Holding any recording securely, in a defined place, for a period the practice selects. Being audited by somebody independent and being willing to sign an agreement that says all of this.
The practice's side
Who is in the room at either end. Whether the provider's screen is visible to anyone else. Whether the patient is somewhere they can speak freely. What was told to the patient and what was written down. Who is given a link and how. What the practice does when something fails. And which staff can see the schedule, the notes and any recording afterward.
A practice that reads that second list and recognizes four items it has never decided has found its work. None of it is difficult. It is simply nobody's job until it is assigned.
The provider's room is part of the visit
A video visit happens in a physical place, and that place is not covered by any agreement.
Three questions settle most of it. Can anyone else hear the provider's side, which in a practice with thin walls or a shared office is frequently yes. Can anyone see the provider's screen, which includes the person who walks in without knocking. And is the device the provider is using one the practice controls, or a personal laptop that goes home.
The fixes are ordinary. A door that closes and a sign that means something. A screen that faces away from the doorway. A headset, which improves both privacy and audio quality and is the cheapest single improvement available. And a clear position on personal devices, decided by the practice rather than by whoever happens to be working from home that day.
The same applies with more force when a provider conducts visits from home, where the practice controls nothing and has to rely on what it asked for. Ask for it explicitly, once, in writing, rather than assuming.
The patient's side, which you cannot control but can influence
Patients take video visits in cars, at work, in kitchens with other people present. The practice cannot dictate that and should not pretend otherwise. It can do two useful things.
The first is to say something at the start of the visit. A single sentence asking whether the patient is somewhere they can speak freely, and offering to reschedule or switch to a phone call if not, takes five seconds and occasionally changes the whole visit. Patients frequently have not thought about it until asked.
The second is to ask who else is present. Not as an interrogation, simply as a question at the start. A family member in the room is often welcome and sometimes essential, and the point is that the provider knows rather than discovers it twenty minutes in.
Both of these belong in the visit's opening, said the same way every time, by whoever starts the visit. They are worth more than any technical control the practice could add.
Getting the link to the right person
The invitation is the part most likely to go somewhere it should not, and it is the part given the least thought.
Three habits reduce the risk to close to nothing. Send the link to the contact details the practice holds for that patient rather than to whatever address arrived in a message. Keep the invitation free of clinical detail, so an invitation that reaches the wrong inbox discloses nothing beyond an appointment. And use a link that is specific to the visit rather than a standing room address that stays open between patients.
The standing room is the one worth checking. A permanent meeting address is convenient and it means the last patient could, in principle, rejoin during the next patient's visit. Ask how the platform handles this and confirm the behavior rather than assuming it.
Confirm who you are talking to
A brief identity check at the start of the visit, using something the practice already holds, is straightforward and is the kind of step that is obvious in a waiting room and easily skipped on video. Decide what the practice uses and have everybody use the same thing.
Recording a video visit
The platform can record, and can transcribe, and can do either or both. The fact that it can does not mean a clinical visit should be.
Recording a video visit creates a permanent, detailed record of a clinical encounter. There are situations where a practice decides that is right, and it should be a decision made in advance with the practice's privacy officer or counsel, not something a provider chooses in the moment.
If the practice does record, three things should be settled before the first one: the patient is told plainly and the telling is documented; the retention period is set deliberately, from the range of one week to ten years the platform offers, rather than left at whatever it defaults to; and the list of people who can play a recording back is short, written and reviewed.
If the practice does not record, say so in the policy explicitly. An unstated absence of recording is indistinguishable from an unconfigured setting, and somebody will eventually turn it on for a reason that seemed good at the time.
What gets written down
The documentation side of a video visit is not a technology question and it is where practices most often have nothing written at all.
Decide what the record of a visit should contain beyond the clinical note itself: that the visit was conducted by video, where the patient was if that matters clinically, who else was present, that the patient agreed to be seen this way, and what happened if the visit had to change format partway through.
The last one is worth its own line. A visit that begins on video, fails, and finishes on the phone is a different encounter from either, and a note that does not mention it will confuse anyone reading it later, including the provider.
What must be documented, and what form consent to a video visit has to take, are matters for the practice's own advisors. The operational point is that the answer should be one sentence in a policy rather than a decision each provider makes independently.
When it fails in the middle
Connections drop, and the minute afterward is the part patients remember.
Agree the fallback before it is needed and say it out loud at the start of the visit: if the video fails, the provider will call the patient on the number the practice holds, and the patient does not need to do anything. That single sentence turns a failure into an inconvenience, and it prevents the situation where both sides sit waiting for the other to reconnect.
Make sure the practice actually has a number that reaches the patient right now, which is not always the number on file. Confirming it at the start of the visit takes a moment and is worth it.
And treat a phone visit as a legitimate outcome rather than a defeat. For a great many appointments the video adds little, and a clean phone conversation serves the patient better than three attempts to reconnect.
Common questions
Does the platform being audited and the agreement being signed make a practice compliant?
No. They settle the vendor's side. The practice's compliance depends on its own policies, its configuration, how staff work and what gets documented, and that determination belongs with its privacy officer or counsel.
Can visit links or reminders be sent by text?
Text messaging sits outside the business associate agreement, so patient information should not travel that way. A reminder that names a date and time with no clinical detail is a different thing from clinical information, and where the practice texts at all the patient must have agreed to receive messages and a stop request must be honored promptly.
What does the encryption actually cover?
Call and video media are encrypted in transit using DTLS-SRTP, and signaling, web traffic and screen sharing use TLS. That protects the connection. It does not protect against somebody standing behind either participant, which is why the room matters.
Should a video visit ever be recorded?
Sometimes, for reasons the practice can state, decided in advance with its own advisors and with the patient told plainly. Recording every visit because the feature exists is not a defensible reason.
Can the practice see the audit report?
Ask for it. A provider willing to sign an agreement should be willing to show what it has been audited against, and keeping that with the agreement is worth the small effort of requesting it.
Before the first visit, in order
- Execute the business associate agreement and file it where it can be found.
- Ask what it covers and what it excludes, and keep that answer in writing alongside it.
- Write the practice's own one-page policy: rooms, devices, links, identity checks, documentation, recording, fallback.
- Have whoever advises the practice on privacy read it, particularly the consent and documentation lines.
- Set the retention period for anything recorded, deliberately.
- Decide who can see recordings and schedules, and write the list down.
- Run one visit with a colleague pretending to be a patient, including a deliberate failure, and fix what that exposes.
- Review the page once a year and whenever staff change.
Eight steps, most of them an afternoon. What they buy is a practice that can answer any question about how it runs video visits without having to go and find out.
Who else at the practice can see any of this
The visit itself gets the attention. The trail it leaves behind rarely does, and that trail is usually visible to more people than the visit was.
Think through what exists after a video visit ends. The appointment on a schedule several staff can see, often with a reason attached. The invitation that went out and whatever it contained. Any chat messages exchanged during the visit. A recording or transcript if the practice made one. And in some configurations a log showing who joined and for how long.
Each of those has its own access, and the defaults are usually broader than the practice intends, because access is set up for convenience when the system is installed and rarely narrowed afterward.
The exercise worth doing once: sit with whoever administers the system, list each of those five items, and ask who can see it today. Practices are regularly surprised by at least one answer, and narrowing it is normally a matter of minutes.
The staff member who sets the visit up
In most practices a provider does not schedule their own video visits. Somebody at the front sends the invitation, answers the patient's questions about joining, and sorts out the problems when the patient cannot get in.
That person is inside the privacy question even though they are not in the visit, and they usually receive the least guidance. They need to know what may go in an invitation and what may not, what to do when a patient asks them a clinical question while trying to join, how to confirm they are speaking to the right person before they send anything, and who to route a request to when somebody asks for a recording.
Half a page of instruction covers all four. Writing it is the difference between a practice where the rules are followed and one where the rules exist only in the mind of whoever wrote the policy.
It also makes the role transferable, which matters on the day that person is out and somebody else is sending the links.
Talking to Cleod9
Cleod9 is a Dallas-Fort Worth provider supporting its own customers, so a Grand Prairie practice works with someone in the same metro rather than a distant queue. The platform, including voice, video, messaging and mobile access, is described on the Cleod9 services page.
For video visits specifically, ask for the business associate agreement before the first visit, confirm in writing which services it covers and that text messaging sits outside it, ask how visit links are generated and whether a room stays open between patients, and settle recording and retention during setup rather than afterward. Then take the practice's own policy to its privacy officer or counsel, who decides what the practice is required to do.