Example Scenario: How POY Verify Is Designed to Help a Telehealth Company Verify Real Patients
This example scenario follows a hypothetical telehealth company dealing with fake appointment bookings, prescription fraud, and stolen insurance credentials. It shows how POY Verify is designed to confirm a real patient is present at three key points, with an on-device liveness check, so the platform never stores biometric data that could become protected health information.
This is an illustrative example scenario, not a customer case study. POY Verify is in private beta, so the company described here is hypothetical and no results are reported. It shows how the product is designed to work for this kind of platform.
The Scenario
Imagine a telehealth provider offering virtual consultations, prescription management, and specialist referrals across many states. Growth has been steady, but the fraud team sees warning signs: climbing no-show rates, spikes in new registrations, and prescription requests that do not fit real patient patterns.
The Problem in Detail
In this scenario the fraud comes through three channels, each exploiting the fact that the platform cannot confirm a real patient is behind an account:
Fake Appointment Bookings
Scripts create patient accounts and book specialist appointments, taking time slots that real patients need.
Pharmacy Benefit Fraud
Fraudsters open accounts with stolen or synthetic insurance credentials to obtain prescriptions, particularly high-value or controlled medications.
Insurance Credential Stuffing
Bots test stolen insurance member IDs against registration, and working matches are sold on to fraud rings.
Beyond direct losses, real patients struggle to book appointments and insurance partners grow concerned about fraud controls.
The HIPAA Challenge
The obvious fix is identity verification, but in healthcare that comes with extra regulatory weight.
Why Biometric Data Is Risky in Healthcare
Under HIPAA, information that identifies a person in connection with healthcare services can be protected health information. A platform that collects biometric data from patients may take on that data as PHI, with the encryption, access control, audit, and breach notification obligations that follow.
Most traditional verification tools collect facial images, selfies, or biometric templates. The platform needs to confirm a real human is present without collecting data that could be classified as PHI.
The Solution
POY Verify's zero-data architecture is designed for exactly this constraint. Biometric processing happens on the patient's own device inside the Secure Enclave, and the platform receives only a signed verification result. In this scenario the check is added at three patient touchpoints:
1. New Patient Registration
New patients complete a liveness check during signup. Their phone confirms a living person is present, and the platform stores the resulting proof with the account.
2. Appointment Booking Confirmation
Before a booking is confirmed with a provider, returning patients complete a quick re-verification, so automated scripts cannot hold provider time slots.
3. Prescription Request Authorization
High-value prescription requests, particularly for controlled substances, require a fresh liveness check before they go to the pharmacy.
Designed to Simplify HIPAA Review
The key question for a platform's compliance team is what data actually reaches its servers.
The question to put to your own HIPAA security officer: if biometric data is created and processed only on the patient's device, and the platform receives a signed proof, does the verification flow add any new PHI? POY Verify is designed so it does not, but each platform has to confirm that for its own setup.
No Biometric Data on Your Servers
Biometric processing happens on the patient's device. The platform's servers do not receive, process, or store biometric data.
Narrower BAA Scope
Because no biometric data is sent to POY Verify, the verification flow is designed to keep biometric data out of any business associate arrangement. Confirm the full scope with counsel.
Clean Audit Trail
The platform can log verification results and timestamps without logging any biometric data.
No Biometrics to Breach
If the platform's servers are compromised, there is no biometric data there to steal.
Before and After
Before POY Verify
- Fake appointment bookings taking real slots
- Wasted provider time
- Pharmacy benefit fraud
- Ongoing insurance credential stuffing
- Traditional ID verification rejected by compliance
- HIPAA concerns blocking biometric tools
- Slow manual fraud review
With POY Verify, by design
- Liveness checks at registration, booking, and prescriptions
- Credential stuffing stopped at registration
- No biometric data in the platform's systems
- Automated verification instead of manual review
- A simpler story for insurance partners
What to Measure
This scenario reports no results. A pilot would compare fake bookings as a share of all bookings, flagged prescription requests, credential stuffing attempts at registration, verification completion against the existing login success rate, and patient feedback on the check.
The Broader Healthcare Picture
Healthcare identity fraud is a long-running problem, and the usual fixes create new ones: document checks add friction and data to protect, and biometric tools add PHI. POY Verify is designed to verify human presence without collecting human data, which is the trade-off healthcare platforms have struggled to get.
Regulatory Landscape
Biometric privacy rules for healthcare are getting more complex. Several states have enacted or are considering biometric privacy laws with their own requirements:
- Illinois BIPA - Requires written consent before collecting biometric data, sets retention and destruction rules, and allows a private right of action.
- Texas CUBI - Prohibits capturing biometric identifiers without informed consent and requires destruction within a reasonable time.
- Washington State - Requires consent for commercial use of biometric data and reasonable security practices.
- New York City - Requires businesses to disclose biometric data collection to customers with signage.
For a telehealth platform operating in many states, that patchwork is a real burden if biometric data is collected. POY Verify is designed so the platform does not collect it.
Key Takeaways
- Healthcare fraud needs human verification, not just authentication - Passwords, SMS codes, and security questions verify credentials, not that a real patient is present.
- Biometric data carries extra weight in healthcare - Collected in connection with care, it can become PHI with all the obligations that brings.
- Zero-data architecture is designed to simplify multi-state compliance - Not collecting biometric data avoids much of the state-by-state patchwork.
- Check placement matters - Registration, booking, and prescription requests are the points where a real-patient check stops the most fraud.
Frequently Asked Questions
Is this telehealth example a real customer case study?
No. It is an illustrative example scenario, not a customer case study. POY Verify is in private beta, so the telehealth company described here is hypothetical and no results are reported. The scenario shows how the product is designed to work for this kind of platform, and what a team would measure in a real pilot to judge whether it works.
Where would a telehealth platform add POY Verify checks?
At three patient touchpoints. New patients complete a liveness check during registration. Returning patients re-verify before an appointment booking is confirmed, so scripts cannot hold provider time slots. High-value prescription requests, particularly for controlled substances, require a fresh check before they go to the pharmacy. Each check runs on the patient's own phone and gives the platform a signed result rather than biometric data.
Does POY Verify add protected health information to a telehealth platform?
It is designed not to. Under HIPAA, information that identifies a person in connection with care can be protected health information, so collecting biometric data from patients can bring encryption, access control, audit, and breach notification obligations. POY Verify processes biometrics on the patient's device and sends only a signed proof, so no biometric data reaches the platform's servers. Each platform should confirm that with its own HIPAA security officer.
What should a telehealth team measure in a POY Verify pilot?
Compare fake bookings as a share of all bookings, flagged prescription requests, and credential stuffing attempts at registration before and after the rollout. Also track verification completion against the existing login success rate, and collect patient feedback on the check itself. Because this scenario is hypothetical, those are the measures a real pilot would use to judge whether the checks are working.
See How POY Verify Can Help Your Platform
Whether you are fighting patient fraud, navigating HIPAA, or securing prescription workflows - POY Verify delivers human verification without data liability.
REQUEST A DEMO