A telehealth platform can close, get acquired, or freeze accounts under a subpoena with little warning. When that happens, the treating clinician, not the platform, remains the HIPAA covered entity responsible for the patient's record. A board or an auditor that later asks for an encounter the clinician cannot produce reads the gap as a documentation failure, regardless of who controlled the software. Retention and access obligations do not end when the vendor relationship does.
The Record Obligation Survives the Platform
HIPAA itself sets no retention period for the clinical record. The six-year duty many clinicians have heard of, at 45 CFR Section 164.316(b)(2)(i), applies to HIPAA compliance documentation, not to the patient's chart. The record's retention period comes from state board rules, state statute, or the payer contract under which the encounter was billed, and it varies by state and license type. What does not vary is who owns the duty: the clinician is the covered entity, and the platform was a business associate processing the record on the clinician's behalf, a structure that can carry its own corporate practice of medicine questions. A closure or acquisition changes who holds the data. It does not transfer or erase the clinician's retention obligation.
What to Demand in Writing Before Access Ends
Every business associate agreement a telehealth platform signed should address what happens to the record at termination. Under 45 CFR Section 164.504(e)(2)(ii)(J), the contract must require the business associate to return or destroy the PHI it holds at termination or, if that is not feasible, to keep protecting the data and limit its further use to the purpose that made return or destruction infeasible. HHS's Office for Civil Rights has also said a business associate may not block a covered entity's access to PHI it maintains on the covered entity's behalf; the data must stay accessible and usable on demand. A clinician still in contact with the platform or its counsel should put a written request on record: a full export of every encounter, in a usable format, confirmation of what the platform intends to do with any copy it keeps, and a response deadline.
Preserving What Still Exists
Once a shutdown or acquisition is announced, the account can go dark on short notice. Clinicians should export what the interface still allows: encounter notes, prescribing records, results tied to the visit, and any messaging thread documenting consent or follow-up instructions. A screenshot of a note is not a substitute for the structured record. Where the platform involved controlled substance prescribing, the prescriber's own registration log, not the platform's, is what an inspection asks for first and deserves its own backup. Clinicians sharing an account across a group practice should confirm someone has actually completed the export before the account is deactivated, not simply assigned the task.
When the Platform Will Not or Cannot Return Records
Some platforms in shutdown or receivership do not respond, or respond that the data no longer exists. Document every attempt: date, method, and who was contacted. A refusal to return PHI it is contractually obligated to return is itself a potential HIPAA violation and can be reported to OCR, but that complaint does not relieve the clinician of accounting for the record when a board or a billing audit asks. An auditor unable to verify a billed encounter through the record can treat it as unsupported, which can lead to a recoupment demand. Where a subpoena or known investigation is already in the picture, a litigation hold on any remaining copies or export files becomes its own obligation.
Keeping Patients' Care Connected
Patients in an active course of care need a way to continue it. Clinicians should notify affected patients promptly, direct them to whatever records were preserved, and summarize the treatment history in writing for a receiving provider when the underlying record cannot be fully recovered. A dated, signed, good-faith summary is a materially different position in front of a board or a payer than a silent gap in the chart.
A gap in the record reads the same to an auditor whether the platform lost the data or the clinician never secured it.
Why Early Legal Counsel Is Critical
It is critical that telehealth providers promptly retain experienced healthcare defense counsel when a platform they used closes, is acquired, or freezes account access, particularly if a subpoena or an active investigation triggered the freeze. Early legal intervention can protect the provider's rights, build a defensible written record of every access request and platform response, and keep an unrecoverable gap in documentation from being read as a compliance failure rather than a vendor failure. Delaying can make an already incomplete record harder to explain when an auditor or board actually asks for it.
How Health Law Alliance Can Help
Health Law Alliance has handled 5,000+ matters across healthcare regulatory and audit defense over 25+ years, including telehealth compliance and HIPAA matters. If your telehealth platform has shut down, been acquired, or cut off your access to patient records, contact Health Law Alliance's telehealth defense attorneys for a free, confidential consultation before an auditor or a board asks for a record you cannot produce.
