Telehealth Laws: Federal and State Rules Explained

Telehealth may happen through a screen, but the law still starts with a physical place.

Where is the patient sitting during the appointment?

That is one of the most important questions in U.S. telehealth law.

If a doctor is sitting in New York and the patient is sitting in Florida, the doctor is generally practicing medicine in Florida. Florida's licensing and medical-practice rules therefore matter even though the physician never crossed the state line.

Then federal law gets layered on top.

Medicare has its own telehealth coverage rules. The DEA regulates controlled-substance prescribing. HIPAA governs protected health information for covered entities and business associates. The FDA can regulate certain remote-monitoring devices and medical software. Federal fraud-and-abuse laws govern financial arrangements surrounding the care.

That gives telehealth providers a useful way to think about compliance:

State law generally determines whether and how you can treat the patient. Federal law adds rules governing areas such as payment, privacy, controlled substances, devices, and healthcare business arrangements.

A telehealth provider usually has to satisfy both.

This guide explains how those pieces fit together.

The Most Important Rule: Start With the Patient's Location

Telehealth makes distance feel irrelevant.

Legally, it often is not.

A clinician generally needs authority to practice in the state where the patient is physically located at the time care is delivered.

That means a provider cannot simply ask where a patient lives.

A patient might live in New Jersey but take a telehealth appointment while visiting Florida. For licensing purposes, where the patient is located during that particular encounter can become the important fact.

For a multistate telehealth practice, a practical workflow therefore begins with:

1. Where is the patient physically located?
2. Is the clinician authorized to practice there?
3. What standard-of-care rules apply?
4. Does that state require specific telehealth consent?
5. Can the proposed medication legally be prescribed through telehealth?
6. Does the patient's insurance cover the service?
7. Are there additional privacy or documentation requirements?

The technology is usually the easy part.

The jurisdiction is where telehealth becomes complicated.

Who Regulates Telehealth?

There is no single federal "telehealth license" or one national telemedicine law that replaces state medical regulation.

Different questions are controlled by different authorities.

This is why asking whether something is simply "legal under telehealth law" usually does not produce a complete answer.

You first have to know which part of telehealth law you are talking about.

State Licensing Rules

State licensure remains one of the biggest operational challenges for national telehealth companies.

In the traditional model, a physician who wants to routinely treat patients in several states may need licenses in several states.

There are ways to make that process easier.

Interstate Medical Licensure Compact

The Interstate Medical Licensure Compact, commonly called the IMLC, provides qualifying physicians with an expedited pathway for obtaining licenses in participating jurisdictions.

It is important to understand what the compact does not do.

The IMLC does not generally give a doctor one nationwide medical license.

Instead, it simplifies the process through which eligible physicians can obtain licenses from multiple participating states.

Other healthcare professions have developed their own compact systems, including areas such as nursing, psychology, physical therapy and counseling.

The rules are not identical from profession to profession.

Special Telehealth Registrations

Some states also provide telehealth-specific registrations, permits or other pathways through which an out-of-state practitioner may treat patients without obtaining the same license that would otherwise be required.

Conditions vary considerably.

A registration may restrict:

• Which clinicians qualify
• What services can be provided
• Whether the clinician may establish an ongoing practice
• Prescribing
• Controlled substances
• In-person follow-up obligations
• Recordkeeping
• Fees
• Disclosures to patients

There may also be exceptions involving consultations between physicians, established patients, follow-up care or specific cross-border situations.

A national practice should not build its licensing strategy around a broad statement such as "telehealth is allowed in this state."

Build it around the exact profession, patient location and type of care being provided.

For individual state requirements, see our Telemedicine Laws by State guide.

Standard of Care Still Applies

Telehealth changes the way care is delivered.

It does not create a lower standard of medical care.

If a patient's condition cannot reasonably be evaluated through video, telephone or another remote technology, the provider may need to move that patient to an in-person setting.

That judgment is part of telehealth medicine itself.

For example, a video visit may be completely appropriate for one patient but inadequate for another whose symptoms require:

• A physical examination
• Laboratory testing
• Imaging
• Vital signs unavailable remotely
• Emergency evaluation
• A procedure
• Direct observation that cannot be achieved virtually

Providers should have clear escalation protocols rather than treating every patient as someone who can remain in telehealth indefinitely.

The right answer sometimes is:

This needs to be seen in person.

Good telehealth includes knowing when telehealth is no longer enough.

Telehealth Informed Consent

Telehealth consent requirements vary by state.

Some states expressly require consent before telehealth services are provided. Requirements can also differ regarding whether consent must be written, verbal or simply documented in the medical record.

Payers may add additional requirements.

A well-designed telehealth consent process will usually explain issues such as:

• What telehealth is
• How the visit will take place
• Limitations of remote evaluation
• Privacy considerations
• What happens if the technology fails
• When an in-person evaluation may be necessary
• Emergency procedures
• Whether the encounter may be recorded
• The patient's ability to decline telehealth

Providers should also have a workflow for establishing the patient's physical location during the encounter.

That location is relevant not just for licensing.

It can become critical if the clinician needs to call emergency services for a patient experiencing a medical or psychiatric emergency.

Can Controlled Substances Be Prescribed Through Telehealth?

This is one of the areas where readers should be especially careful about relying on old articles.

Federal controlled-substance prescribing is governed in part by the Ryan Haight Online Pharmacy Consumer Protection Act and DEA rules.

Historically, the Ryan Haight framework generally required an in-person medical evaluation before certain controlled substances could be prescribed over the internet unless an exception applied.

The COVID-19 public health emergency produced major temporary telemedicine exceptions.

Those rules have continued to evolve.

Current federal status

As of August 13, 2026, DEA and HHS have extended the applicable pandemic-era telemedicine prescribing flexibilities through December 31, 2026.

That means eligible practitioners can continue to prescribe controlled medications through telemedicine under qualifying circumstances without a prior in-person evaluation, subject to the federal requirements and applicable state law.

December 31, 2026 is therefore an important date to verify rather than permanently hard-code into a compliance program.

State law may also be more restrictive than federal law.

A prescription must satisfy both.

Providers should verify the latest guidance directly with the DEA before prescribing controlled substances through telehealth.

This is especially important for organizations providing:

• Psychiatry
• ADHD treatment
• Addiction treatment
• Buprenorphine treatment
• Pain management
• Other services involving controlled medications

A telehealth article written six months ago can already be outdated in this area.

What About Regular Prescriptions?

Non-controlled medications are primarily governed by state medical and prescribing law rather than the DEA's controlled-substance framework.

States generally require a valid clinician-patient relationship and a medically appropriate evaluation before medication is prescribed.

Telehealth can often be used to establish that relationship.

But "telehealth is allowed" does not mean every medication can be prescribed after every type of remote encounter.

The clinician still needs enough information to meet the applicable standard of care.

Medicare Telehealth Rules

Medicare telehealth policy changed dramatically during the COVID-19 pandemic and has continued changing through subsequent legislation and CMS rulemaking.

As of August 2026, many Medicare telehealth flexibilities have been extended through December 31, 2027.

Among the currently extended policies, Medicare patients can receive many non-behavioral health telehealth services from home without the old geographic originating-site restrictions through the end of 2027.

Certain eligible practitioners can continue providing those services through that period as well.

Some behavioral-health telehealth changes have been made permanent.

This distinction matters.

Telehealth legality and telehealth reimbursement are not the same question.

A provider can be legally permitted to treat a patient and still find that a particular payer will not reimburse the encounter.

Conversely, a service appearing on a payer's telehealth coverage list does not eliminate state licensing requirements.

For a deeper explanation, see Telehealth Reimbursement.

Medicaid Telehealth Rules

Medicaid adds another layer because programs are administered by individual states within the federal Medicaid framework.

Policies can differ regarding:

• Covered services
• Eligible practitioners
• Patient location
• Provider location
• Audio-only care
• Behavioral health
• Remote patient monitoring
• Billing codes
• Documentation
• Payment rates

Providers operating nationally therefore have to distinguish among:

state medical law, Medicare rules, Medicaid rules and commercial payer policies.

They are related.

They are not interchangeable.

HIPAA and Telehealth

HIPAA does not disappear because the appointment takes place over video.

Covered healthcare providers and health plans must comply with applicable HIPAA requirements when providing telehealth.

That includes protecting patients' protected health information and using appropriate safeguards.

Where a technology company handles protected health information on behalf of a covered provider and qualifies as a business associate, the relationship will generally require an appropriate Business Associate Agreement, or BAA.

Providers should evaluate more than whether a product advertises itself as "HIPAA compliant."

Look at:

• How information is transmitted
• Where information is stored
• Access controls
• Authentication
• Encryption
• Logging
• Data retention
• Vendor access
• Breach procedures
• Business associate agreements
• Patient communications
• Recording settings

State privacy laws may impose additional requirements, including on health information that falls outside traditional HIPAA relationships.

Read our full guide to Telehealth Security and HIPAA.

Audio-Only Telehealth

A phone call can qualify as telehealth in some circumstances, but audio-only treatment is not universally interchangeable with video.

The answer can depend on:

• The state
• The specialty
• The clinical service
• The payer
• The patient's circumstances
• Whether the service can safely be provided without visual information

HIPAA does not categorically prohibit audio-only telehealth.

HHS has specifically addressed how covered entities can provide audio-only telehealth while complying with applicable HIPAA requirements.

The larger question is often whether the particular service can legally, clinically and financially be delivered that way.

Corporate Practice of Medicine

Telehealth businesses also have to think beyond the clinical encounter.

Some states limit the ability of ordinary corporations to directly employ physicians or control the practice of medicine.

These rules are commonly called corporate practice of medicine, or CPOM, laws.

They are one reason national telehealth organizations frequently use structures involving:

• A physician-owned professional entity, sometimes called a professional corporation or PC
• A separate management services organization, or MSO
• A management services agreement between them

But calling something a "friendly PC model" does not automatically make the structure compliant.

States may scrutinize who actually controls:

• Clinical decisions
• Physician hiring
• Termination
• Prescribing
• Medical protocols
• Professional fees
• Bank accounts
• Patient relationships
• Medical records

Management arrangements can also create separate fee-splitting concerns.

Companies planning a multistate telehealth operation should obtain state-specific healthcare counsel rather than copying another company's organizational chart.

See How to Start a Telemedicine Program for the operational side of launching virtual care.

Fraud, Kickbacks and Telehealth

Telehealth also operates within the same federal fraud-and-abuse framework as the rest of healthcare.

The Anti-Kickback Statute, Stark Law, False Claims Act and related rules can apply to telehealth business arrangements.

Risk can arise when compensation is connected to:

• Referrals
• Prescription volume
• Testing orders
• Medical equipment orders
• Medicare business
• Lead generation
• Patient recruitment
• Financial relationships with referral sources

Federal enforcement agencies have pursued large fraud cases in which telemarketing operations used brief or nonexistent telehealth encounters to generate reimbursable prescriptions, tests or medical-equipment orders.

That is different from legitimate telemedicine.

But legitimate telehealth companies should understand why these structures receive scrutiny.

A telehealth encounter should be driven by a genuine clinical relationship and medical need — not by the financial value of whatever can be ordered afterward.

FDA Rules for Telehealth Technology

Most ordinary video-conferencing technology is not regulated as a medical device simply because doctors use it.

Some technologies used within telehealth are.

FDA oversight may become relevant for:

• Connected diagnostic devices
• Remote monitoring hardware
• Certain clinical decision-support software
• Software intended to diagnose disease
• Some AI-enabled medical tools
• Software as a Medical Device, or SaMD

The distinction often depends on the product's intended use and the claims made about what it does.

This is becoming increasingly important as telehealth moves beyond video visits into continuous monitoring, artificial intelligence and home-based diagnostics.

Read more in our guide to Remote Patient Monitoring.

Can a U.S. Doctor Treat a Patient Who Is Overseas?

Telehealth technology works almost anywhere.

Medical licenses generally do not.

A U.S. physician's state license does not automatically authorize that physician to practice medicine on a patient physically located in another country.

The destination country's laws matter.

There may also be issues involving:

• Malpractice insurance
• Privacy law
• Data transfers
• Prescriptions
• Medication availability
• Emergency response
• Professional registration

The same logic applies in reverse.

A physician located abroad generally cannot treat a patient physically located in a U.S. state simply because the interaction occurs online. The physician typically still needs authority to practice in the patient's state.

For a broader look, see Telemedicine Around the World.

A Practical Telehealth Compliance Checklist

Before providing a telehealth encounter, a practice should be able to answer:

Where is the patient?

Confirm the patient's physical location.

Can the clinician practice there?

Verify the relevant license, compact privilege, registration or exemption.

Can this service be delivered remotely?

Consider state rules, modality requirements and standard of care.

Has the patient provided any required telehealth consent?

Document it appropriately.

Can this medication be prescribed?

Check state law and, for controlled substances, current DEA requirements.

Is the technology appropriate?

Evaluate HIPAA, security, privacy and clinical limitations.

Will the payer cover it?

Check Medicare, Medicaid or commercial payer requirements separately.

What happens if the patient needs in-person or emergency care?

Have an escalation procedure before the appointment begins.

That framework will answer far more compliance questions than simply asking whether "telehealth is legal."

The Bottom Line

There is no single telehealth law in the United States.

There is a stack of laws.

State law usually starts with the patient's physical location and determines who may practice, what standard of care applies and what consent or prescribing rules must be followed.

Federal law then adds rules involving Medicare, controlled substances, HIPAA, medical devices, fraud and other areas.

For providers, one question should come before almost everything else:

Where is the patient right now?

Once you know that, you can determine which state's rules apply and then layer the appropriate federal and payer requirements on top.

The underlying structure of telehealth law is relatively straightforward.

The details change constantly.

That is why good telehealth compliance is not a policy you write once.

It is a system you keep current.

Related TeleMed Today Resources

• Telemedicine Laws by State
• Telehealth Reimbursement
• Telehealth Security and HIPAA
• How to Start a Telemedicine Program
• Remote Patient Monitoring
• Telemedicine Around the World