US Telehealth Rules Explained: HIPAA, State Licensure, Prescribing and Medicare

The JenPulse team · October 5, 2026 · 6 min read

A doctor on the phone while working on a laptop in her office
Photo: Vitaly Gariev on Unsplash

There is no single "telehealth law" in the United States. A virtual visit sits under several layers of rules at once: federal privacy law, state licensing and practice rules, federal drug rules if controlled substances are involved, and each payer's coverage policy. Most compliance problems come from overlooking one of those layers.

This guide walks through each layer in plain English. It is a practical overview, not legal advice. Telehealth rules have changed repeatedly since 2020 and are still changing, so confirm the current position with your state medical board, CMS, the DEA and your payers, or a healthcare attorney.

Layer 1: HIPAA applies to virtual visits

A telehealth visit creates and transmits protected health information, so the HIPAA Privacy, Security and Breach Notification Rules apply just as they do in the office.

Use a platform that will sign a BAA

The video or messaging service you use handles PHI on your behalf, which makes the vendor a business associate. You need a signed business associate agreement (BAA) before using it with patients. During the COVID-19 public health emergency, the HHS Office for Civil Rights relaxed enforcement for everyday consumer video apps; that flexibility ended in 2023.

Apply the same safeguards as any other system

  • Unique logins for each clinician and staff member
  • Encrypted connections, and no recordings unless you have a clear reason and policy
  • Sessions that start from your scheduling or EHR system, not from links shared by personal email or text
  • A private space for the clinician, and a reminder to patients to find one too

Layer 2: State licensure follows the patient

In general, a clinician must be licensed in the state where the patient is physically located at the time of the visit, not where the clinician is. A physician in Texas seeing a patient who is in Oklahoma generally needs an Oklahoma license.

Some states have limited exceptions, for example for consultations with another physician, follow-up care for an existing patient, or temporary travel. They vary widely and change often, so don't rely on them without checking.

Licensure compacts make multi-state practice easier, but they don't remove the requirement:

  • Interstate Medical Licensure Compact (IMLC): an expedited pathway for eligible physicians to obtain licenses in participating states
  • PSYPACT: lets licensed psychologists practice telepsychology across participating states
  • Nurse Licensure Compact (NLC): a multistate license for registered and practical nurses

Practical rule: confirm and document the patient's location at the start of every visit.

The standard of care for a telehealth visit is the same as for an in-person visit. If a condition can't be safely assessed remotely, the right decision is to see the patient in person.

Many states require informed consent specifically for telehealth, and the required form (verbal or written) varies. Medicare also requires documented consent for certain virtual and remote services. A simple approach that works in most places:

  1. Explain the visit is by telehealth and what that means
  2. Confirm identity and current location
  3. Record the patient's consent in the visit note

States also set rules on establishing a new patient relationship through telehealth, so check yours before offering virtual first visits.

Layer 4: Prescribing, especially controlled substances

Prescribing non-controlled medications by telehealth is mainly governed by state law and the standard of care.

Controlled substances have an extra federal layer. The Ryan Haight Online Pharmacy Consumer Protection Act generally requires an in-person medical evaluation before prescribing controlled substances over the internet, with limited exceptions. During and after the public health emergency, the DEA allowed telemedicine prescribing without a prior in-person visit under temporary flexibilities, which it has extended several times while it works on permanent rules.

Because this area is still moving, check the DEA's current telemedicine rules before prescribing any controlled substance to a patient you have only seen virtually, and confirm your state's rules too, which can be stricter. Electronic prescribing of controlled substances (EPCS) requirements also apply.

Layer 5: Medicare and payer coverage

Medicare

Before 2020, Medicare covered telehealth only in limited circumstances, largely for patients in rural areas visiting from a clinic or other approved site. Many of those restrictions were waived during the public health emergency, and Congress has extended them repeatedly since. Some changes, particularly for behavioral and mental health services, have been made permanent; others depend on temporary extensions.

Before building your schedule around virtual visits for Medicare patients, check the current CMS list of covered telehealth services and whether the home counts as an approved location for the service you plan to provide.

Commercial payers and Medicaid

Many states have laws requiring private insurers to cover telehealth, and some require payment at the same rate as in-person care (payment parity). Medicaid coverage is set state by state. Each payer also sets its own coding rules, including place-of-service codes and modifiers for video and audio-only visits. Keep a short payer-by-payer reference sheet at the billing desk.

Layer 6: Documentation

Document a telehealth visit as thoroughly as an in-person one, plus:

  • That the visit was by video or audio only
  • The patient's location (and yours)
  • Consent, and who else was present
  • Any technical problems and how they were resolved

A compliance checklist for your practice

  1. Use a telehealth platform covered by a signed BAA
  2. Confirm every clinician is licensed in each state where their patients are located
  3. Verify and record patient identity and location at the start of each visit
  4. Obtain and document consent as your state and payers require
  5. Check DEA and state rules before prescribing controlled substances remotely
  6. Confirm coverage and coding rules for each major payer, including Medicare
  7. Document the visit type, location, consent and any technical issues
  8. Have a plan for emergencies: know the patient's location and local emergency contacts
  9. Train staff on the workflow and review your policies at least once a year

Frequently asked questions

Can I see a patient in another state by telehealth?

Generally only if you are licensed in the state where the patient is located during the visit. Some states have narrow exceptions, and licensure compacts can make getting additional licenses faster.

Is audio-only telehealth allowed?

Many payers, including Medicare for certain services, cover some audio-only visits, but rules vary by payer and service. HIPAA still applies, so document the visit as audio-only and check coverage before relying on it.

Can I prescribe controlled substances through telehealth?

It depends on the DEA's current telemedicine rules and your state's law. The DEA has extended temporary flexibilities several times, so check the current position before prescribing to a patient you have only seen virtually.

Does HIPAA require a specific telehealth platform?

No. HIPAA requires safeguards and a signed business associate agreement, not a particular product. For running visits smoothly, see our practical telehealth guide and the HIPAA checklist for small practices.

Telehealth in JenPulse

In JenPulse, video visits are booked from the patient's record, so each visit sits next to the patient's in-person visits and prescriptions. As with any tool, US practices should make sure a signed BAA is in place before seeing patients through it. For the day-to-day workflow, see our practical telehealth guide, or try the live demo.