Teleradiology compliance checklist for US buyers

A teleradiology compliance checklist is a written list of the licensure, credentialing, privacy, quality and contract items a hospital, imaging center or radiology group verifies before a remote radiology vendor reads its studies. The core items are a state licensure matrix, credentialing documentation, a signed business associate agreement (BAA), HIPAA Security Rule safeguards, peer review, and an SLA with turnaround in writing. Use it before you sign, then again at every renewal.

• Licensure: the interpreting radiologist needs practice authority in the state where the patient is, and ACR standards expect licensure where the study was performed and where it is interpreted.
• Credentialing: since a 2011 CMS final rule, hospitals and critical access hospitals can rely on a distant-site entity's credentialing information under a formal agreement.
• BAA: a signed business associate agreement governs how the vendor uses and discloses PHI, and HHS says a business associate cannot block access to PHI over a payment dispute (HHS FAQ 2074, 2016).
• Quality assurance: ACR practice parameters (updated 2023) hold remote imaging to the same quality assurance and peer review processes as on-site imaging.
• Contract: the SLA should state how turnaround is measured, which tiers exist (STAT, routine, stroke protocol), and how PHI is returned when the agreement ends.

TL;DR

• Verify licensure by state, not by where the radiologist sits.
• Get credentialing and primary source verification documents in writing, and know when your board can rely on the vendor's data.
• Sign a BAA with explicit data return terms, and confirm Security Rule safeguards: unique user authentication, automatic logoff, firewalls, encryption.
• Put turnaround definitions, peer review and escalation paths in the SLA, not in a sales deck.

Table of Contents

• What is a teleradiology compliance checklist, and who needs one?
• Who wrote this checklist, and what do we sell?
• Which licensure items belong on a teleradiology compliance checklist?
• How does credentialing work when you outsource reads?
• What does HIPAA require of a teleradiology vendor?
• What belongs in a teleradiology BAA?
• What quality assurance should the contract require?
• What should the SLA say about turnaround and coverage?
• How should you check PACS integration and security?
• What does a complete teleradiology compliance checklist look like?
• Which red flags should stop a contract?
• How can AstraRad help with a teleradiology compliance review?
• FAQ
• Sources

What is a teleradiology compliance checklist, and who needs one?

A teleradiology compliance checklist is a procurement tool that turns regulatory and accreditation expectations into yes-or-no items a vendor must answer in writing. Hospital administrators, imaging center directors, compliance officers and radiology group leaders use it to compare vendors on the same terms and to build an audit file.

The checklist matters because compliance is not something you pass once. HIPAA, for example, is an ongoing operational obligation, and the HHS Security Rule FAQ addresses whether an organization must "certify" compliance. In practice, you document your own risk analysis and safeguards, and you document your vendor's. A checklist gives that documentation a structure.

Teleradiology is the interpretation of medical images by a radiologist at a different location from where the images were acquired. That distance creates three compliance questions an on-site group never has to answer: where is the reader licensed, how are the reader's credentials verified, and how is PHI protected while it travels and is viewed remotely.

Who wrote this checklist, and what do we sell?

AstraRad is a US teleradiology service that delivers final signed reports read by board-certified subspecialists. We publish this checklist, and we have a commercial interest in it: we sell teleradiology to hospitals, imaging centers and radiology groups, so you should weigh our views with that in mind.

To keep the checklist useful whichever vendor you pick, every item below is tied to a regulator, an ACR document or a contract term you can ask any provider to put in writing. Where we describe how we work, we describe contract commitments, not marketing claims. Our state licensing page and radiologist page explain the licensure and subspecialty side in more detail.

Which licensure items belong on a teleradiology compliance checklist?

Licensure is the first item because it fails quietly. A teleradiologist needs practice authority in the state where the patient is, because care is legally delivered where the patient is. ACR practice standards go further and expect licensure in the state where the study was performed and the state where the interpretation is rendered, as our teleradiology state licensing guide explains.

A licensure matrix is a table that lists every radiologist who will read for you, every state where you perform studies, and the license number and expiration date for each pair. Ask for it as a contract exhibit and refresh it on a schedule you set.

Checklist item	What to request	Why it matters
Licensure matrix	Radiologist by state, license number, expiration date	Shows coverage for every state where your patients are imaged
Full-license status	Confirmation that licenses are full, not limited or provisional	Some states have particular rules, see Alabama and Arkansas
Renewal tracking	Named process and owner for renewals	A lapse mid-contract puts your reads at risk
Registry or special-state rules	Written note on state registries	Some states add steps, see Alaska
Board certification	ABR or equivalent, with subspecialty status	Supports subspecialty matching in the SLA

If you image patients in several states, ask the vendor to show the matrix for each one: California, Texas, Colorado and Connecticut all have their own pages on our site because the details differ by state. Radiologists at AstraRad are licensed in all 50 states, and that is a point you should verify with any vendor by asking for the matrix itself.

How does credentialing work when you outsource reads?

Credentialing is the process of verifying a physician's qualifications, and privileging is the decision to let that physician perform specific services at your facility. When you contract a teleradiology vendor, both still apply. The question is whether your governing body must verify every remote radiologist itself or can rely on someone else's work.

The 2011 CMS final rule changed the process hospitals and critical access hospitals can use for physicians who deliver care through telemedicine. The rule simplifies the process by allowing reliance on credentialing information from the distant-site entity. Many administrators miss this, and it can shorten onboarding. It works only inside a formal written agreement, so the contract is part of the compliance file.

On the imaging center side, ACR accreditation has its own expectations. The ACR general personnel requirements say interpreting physicians, including part-time and locum tenens staff, must meet and document specific requirements for a facility to be accredited. The ACR documentation also expects verification that no personnel appear on the OIG exclusion list.

Credentialing items to put on the checklist:

1. Primary source verification of licenses, training and board certification, with dates.
2. A statement of who performs verification and how often it is repeated.
3. OIG exclusion screening for every interpreting physician.
4. A copy of the vendor's credentialing and privileging documents, in a form your medical staff office can file.
5. A written agreement that supports your governing body's reliance on the vendor's credentialing information, where your facility uses that pathway.

Your medical staff bylaws, your state rules and your accreditor can add requirements, so have counsel or your medical staff office confirm which pathway applies to you.

What does HIPAA require of a teleradiology vendor?

HIPAA requires covered entities and their business associates to protect electronic protected health information (ePHI) with administrative, physical and technical safeguards. A teleradiology vendor that receives your images and creates reports is a business associate. That means a signed BAA, plus the vendor's own Security Rule safeguards for remote access.

A business associate is a person or organization that performs a function for a covered entity involving PHI. The HHS telehealth guidance (last reviewed 2023) states that telehealth services from covered providers must comply with the HIPAA Rules. Searches for "HIPAA and teleradiology" often assume a vendor certificate settles the matter. It does not, and no federal body certifies a teleradiology vendor as HIPAA compliant.

The technical safeguards to verify:

• Unique user authentication. Every radiologist logs in as an individual, never through shared credentials.
• Automatic logoff. HHS has said the automatic logoff specification applies to telecommuting staff with access to ePHI, as an addressable safeguard where reasonable and appropriate.
• Firewalls and encryption. Encrypt images and reports in transit and at rest, and document network boundaries between the reading environment and the public internet.
• Audit controls. Keep logs of who opened which study and when.
• Remote-use policies. HHS has published guidance on remote use of ePHI that frames the risks of offsite access.

Ask the vendor for its most recent security risk analysis summary and its incident response process. A vendor that cannot describe them is a vendor you cannot defend to an auditor.

What belongs in a teleradiology BAA?

A business associate agreement is a written contract that limits how a vendor may use and disclose PHI and requires it to safeguard that PHI. For teleradiology, the BAA should cover permitted uses, safeguards, breach notification, subcontractors and, often overlooked, what happens to your data when the relationship ends.

The last point is where contracts go wrong. In its FAQ on business associates blocking access, HHS answers no: a business associate may not use PHI in a way that would violate the Privacy Rule, and blocking access to resolve a payment dispute can do that. Write explicit data return terms, including format and timing, so a billing disagreement never holds your images or reports hostage.

For a deeper look at vendor duties in a BAA from the laboratory side, see this overview of HIPAA BAA requirements; the vendor-responsibility principles carry over to imaging.

BAA term	What to confirm	Red flag
Permitted uses	Reads and reporting only, no secondary use without written approval	Broad rights to use data for analytics or training
Safeguards	Reference to Security Rule safeguards and named controls	Generic promise to "protect" data
Breach notice	Defined timeline and contact	No timeline or no named contact
Subcontractors	Flow-down of the same obligations	Unnamed third parties handle images
Data return	Usable format, defined timing, no hold over fees	Silence on termination
Audit support	Cooperation with your reviews	Audit rights refused

Have your privacy officer and counsel review the final BAA. Your state may layer additional privacy requirements on top of HIPAA.

What quality assurance should the contract require?

The contract should require the same quality assurance for remote reads that you apply to on-site reads. The ACR practice parameter for remote imaging says remote imaging must be subject to the same quality assurance and performance monitoring as on-site imaging, including peer review and incident tracking. ACR also treats remote work as an extension of on-site operations, not a separate workflow.

Peer review is the structured, independent re-reading of a sample of a radiologist's reports to measure agreement and flag discrepancies. Ask the vendor how the sample is chosen, whether the second reader is blind to the first read, and how discrepancies reach you. At AstraRad, 1 in 20 reports is independently double-read, blind, for peer review. Ask every vendor for the equivalent rate in writing.

QA items to list:

• Sampling rate and method for peer review.
• Blinded second reads, and who the second reader is.
• Discrepancy categories and how they are reported to your department.
• Incident tracking that separates technology causes, such as network latency, from operator causes, because auditors look for proof that you can tell them apart.
• Compliance reporting you can attach to your own QA committee minutes.

If you are an ACR-accredited site, ask how the vendor's QA data fits into your accreditation file before you sign, not at the survey.

What should the SLA say about turnaround and coverage?

A service level agreement (SLA) is the part of the contract that defines what the vendor commits to deliver, how it is measured and what happens if it falls short. For teleradiology, the most important definitions are when the clock starts, when it stops, and which tier each study falls into.

AstraRad is a US teleradiology service that delivers final signed reports read by board-certified subspecialists. Our turnaround is committed by contract and measured from last-image arrival to radiologist signature. Use that measurement standard as a benchmark: any vendor should tell you exactly where the clock starts and stops.

Tier	Committed turnaround at AstraRad	Notes
STAT	Under 4 hours	Under 2 hours or under 1 hour on request
Routine	24 to 48 hours	Final signed report
Stroke protocol	Under 30 minutes	Measured last image to signature

SLA checklist items:

1. Clock definition: last-image arrival to signature, or something looser.
2. Tier definitions and who assigns a study to a tier.
3. Final signed reports at every tier, including overnight, not preliminary reads that need a second pass.
4. Coverage hours and whether readers are on scheduled shifts.
5. Location of readers: every read performed inside the United States, if your policies or payers require it.
6. Remedies and escalation path when a commitment is missed.
7. Reporting cadence for turnaround data.

Rural and critical access facilities often care most about overnight coverage. Our page on teleradiology for rural and critical access hospitals covers how those workflows run.

How should you check PACS integration and security?

PACS integration is the connection that lets images flow out to the reading radiologist and signed reports flow back into your systems. The compliance angle is simple: fewer portals and fewer copies of PHI mean a smaller surface to secure and audit.

Our reports go straight into your existing PACS with no extra portal, and the integration is DICOM conformant. Whatever vendor you evaluate, ask these questions:

• Does the vendor require a separate portal, and if so, who administers its user accounts?
• Is the integration DICOM conformant, and can the vendor provide a conformance statement?
• How are reports returned, and into which system of record?
• What network path carries the images, and how is it encrypted?
• Who supports the connection when something fails at 2 a.m.? ACR notes that on-demand IT and engineering support should be available for remote operations, though continuous live monitoring is not mandated.

Your IT and security teams should sign off on the connection design, and your risk analysis should be updated to include the new data flow.

What does a complete teleradiology compliance checklist look like?

A complete checklist combines the licensure, credentialing, privacy, quality and contract items into one document your committee can approve. Use the table below as a working template and attach vendor evidence to each row.

Area	Item	Evidence to collect
Licensure	Matrix of radiologists by state	Contract exhibit with expiration dates
Licensure	ACR two-state expectation addressed	Written statement
Credentialing	Primary source verification	Verification records
Credentialing	OIG exclusion screening	Screening process description
Credentialing	Reliance pathway, if used	Written agreement reviewed by counsel
Privacy	Signed BAA	Executed agreement
Privacy	Data return on termination	BAA clause
Security	Authentication, logoff, firewalls, encryption	Policy summary and risk analysis summary
Quality	Peer review with blind second reads	Sampling rate in contract
Quality	Incident tracking	Sample report
Contract	Tier definitions and turnaround clock	SLA exhibit
Contract	Escalation and remedies	SLA exhibit
Integration	PACS connection, DICOM conformance	Conformance statement

Revisit the checklist at renewal and after any change in your modalities, states or volumes.

Which red flags should stop a contract?

A red flag is a vendor answer that leaves a compliance obligation with you and no evidence in your file. The most common ones are easy to spot once you know the checklist.

• A vendor offers a "HIPAA certificate" in place of a BAA and a safeguards summary. No such certificate exists.
• Licensure is described by the radiologist's home state only.
• Turnaround is quoted without a definition of when the clock starts.
• Preliminary reads are used overnight, with final reports arriving later from a different reader.
• Peer review exists but no sampling rate or discrepancy reporting is offered.
• The contract is silent on data return, or ties it to payment.
• Volume minimums or platform fees appear only in the fine print.

Any one of these is fixable in negotiation. A vendor that will not put the fix in writing is telling you something.

How can AstraRad help with a teleradiology compliance review?

AstraRad is a US teleradiology service that delivers final signed reports read by board-certified subspecialists. We route every study to a subspecialist matched to the modality and body part, across ten subspecialties and twelve study types, on scheduled US shifts 24/7/365, with every read performed inside the United States. We work as a business associate under a signed BAA and are HIPAA aligned. Pricing is per report with no minimums, and the first signed report arrives within 10 business days of countersignature.

If you are building a vendor file, you can request a per-report rate card, delivered within one business day, or book a discovery call. A coverage plan with SLA terms in writing follows the call. Specific service lines are described on our pages for MRI teleradiology, X-ray and ultrasound overflow and PET-CT and nuclear medicine.

FAQ

Is there a HIPAA certification for teleradiology vendors?

No federal body certifies a teleradiology vendor under HIPAA. HHS addresses whether organizations must certify Security Rule compliance in its Security Rule FAQ. Instead, you document a signed BAA, the vendor's safeguards and your own risk analysis. Treat any vendor "certificate" as supporting material, not proof.

Do I need a BAA with a teleradiology provider?

Yes. A teleradiology provider handles PHI on your behalf, which makes it a business associate. HHS guidance on business associates shows why the agreement matters, including limits on blocking your access to PHI. Include data return terms before you sign.

Does a radiologist need a license in every state where my patients are?

Generally, yes. The practice of medicine is legally located where the patient is, so the interpreting radiologist needs practice authority there. ACR standards also expect licensure where the interpretation is rendered. Ask any vendor for a licensure matrix by state, and confirm details with counsel, since state rules differ.

Can my hospital rely on a teleradiology vendor's credentialing?

Often, yes. A 2011 CMS final rule lets hospitals and critical access hospitals rely on credentialing information from a distant-site entity under a formal agreement. Your governing body, bylaws and accreditor still set the process, so confirm the pathway with your medical staff office.

What quality assurance should remote reads receive?

Remote reads should receive the same quality assurance as on-site reads. The ACR practice parameter calls for the same performance monitoring, peer review and incident tracking. In your contract, specify the peer review sampling rate, blind second reads and how discrepancies are reported to you.

Sources

• CMS: Medicare finalizes a new rule for telemedicine services (2011)
• HHS: May a business associate block or terminate access to PHI? (2016)
• ACR practice parameter for CT and MR imaging at remote locations
• ACR general personnel requirements
• HHS Telehealth: HIPAA rules for telehealth technology (2023)
• HHS: Security Rule FAQ
• HHS: Automatic logoff and telecommuting employees
• HHS: Remote use of ePHI guidance