This is a very frequently asked question… can I use Skype? Is it HIPAA compliant?
OCR put out an “implementation standards” document in 2010, and those of you who are more tech-savvy than average will find it quite helpful.
Do you want lots more information about the Risk Assessment? Preferably straight from the US government? They have published several documents to help.