Identity verification for telehealth

What telehealth services ask of identity checks

A telehealth service meets its patient on a screen. The clinician cannot look at a card across a desk, yet the service holds health records and may issue prescriptions, so it needs to know that the person who registered is the person who logs in later and the person who is treated. At the same time it handles some of the most sensitive data there is, so the verification should leave as little personal data as possible in the messages between systems.

• Reach a new patient before the first visit with a link that works on a phone.
• Verify the patient against a document and a live face.
• Keep personal data out of callbacks, and delete it on request.
• Let only the right staff see the results.

The flow

1. Invitation. When a patient books, your system creates a one-time link and sends it by the channel you use. A patient who opens it on a desktop can finish on a phone with a QR code.
2. Document. The patient photographs an identity document. It is read and checked for fraud.
3. Selfie and active liveness. The selfie is matched to the document portrait, and the patient moves the face through two ovals.
4. Result without personal data. The webhook tells your system the session is complete, and it has an option that does not send personal data.
5. Review. Staff with the right role decide doubtful cases in the dashboard.
6. Retention and erasure. Retention is a setting you choose per scenario, within the minimum periods and privacy obligations that apply to you. Erasure on request is available by API, with a confirmation webhook and an erasure log.

Modules used

• Document verification, face verification and liveness.
• One-time links and QR hand-off, described on the web SDK page.
• Webhooks, including the option that does not send personal data.
• Dashboard with roles, and the data protection page for the controls.

Regulatory frame

One example from a primary text: the United States rules for health information, 45 CFR part 164, which apply to covered entities and their business associates.

• Section 164.312(d) sets the standard of person or entity authentication: implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
• Section 164.514(h)(1)(i) requires a covered entity, prior to any disclosure permitted by that subpart and except with respect to disclosures under section 164.510, to verify the identity of a person requesting protected health information and the authority of any such person to have access to protected health information under that subpart, if the identity or any such authority of such person is not known to the covered entity.

This block describes the texts, not our service. For information; not legal advice.

Sources

• Title 45 of the US Code of Federal Regulations, section 164.312, technical safeguards, electronic Code of Federal Regulations, fetched 27 October 2026.
• Title 45 of the US Code of Federal Regulations, section 164.514, other requirements relating to uses and disclosures of protected health information, electronic Code of Federal Regulations, fetched 27 October 2026.

Next

Try the interactive tour, read how we handle data protection or talk to us.