What types of additional precautions must the physician or practice take to ensure that all patient information remains “secure” and, if appropriate, “encrypted”?

In the past, the utilization of telemedicine was often primarily thought of in the context of a “specialist” consulting with a physician regarding a patient in a remote or rural area who may not have easy access to the specialist, or a radiologist reading an image from a “remote” location. Due, in large part, to advancements in technology (including EMR), the term “telemedicine” currently includes such patient care practices as providing “patient portals” to patients, which may house secured provider-patient email capabilities, test result reporting, etc.
In today’s world of being “connected 24/7”, initial feedback indicates that many patients like the ability to communicate with their providers from their mobile device at their convenience. However, as with many technological advances and resulting capabilities (especially in healthcare), come additional legal oversight and regulatory requirements.
Questions inevitably arise as to what type of “communication” or “reporting” to patients constitutes the “practice of medicine?”
For example, if a patient sends her physician a secure email indicating describing a “cold” or sinus infection symptoms and requests a prescription for an antibiotic, which the physician prescribes, is the physician practicing telemedicine even though she hasn’t physically seen the patient in her office? Does it matter if the physician has prescribed the same, or a similar, antibiotic for the patient’s recurring symptoms over the past ten years?
What types of additional precautions must the physician or practice take to ensure that all patient information remains “secure” and, if appropriate, “encrypted”?
Is it possible to balance the wealth of information available to patients via the Internet with a loss of a personal relationship between the patient and caregiver?