Federal Telehealth Laws: DEA, Medicare, HIPAA and More

Telehealth may happen through a screen, but the law still starts with a physical place. Where is the patient sitting during the appointment? That is one of the most important questions in U.S. telehealth law.

If a doctor is sitting in New York and the patient is sitting in Florida, the doctor is generally practicing medicine in Florida. Florida's licensing and medical-practice rules therefore matter even though the physician never crossed the state line.

Federal law is then layered on top. Medicare has its own telehealth coverage rules. The DEA regulates controlled-substance prescribing. HIPAA governs protected health information for covered entities and business associates. The FDA can regulate certain remote-monitoring devices and medical software. Federal fraud-and-abuse laws govern financial arrangements surrounding the care.

That gives telehealth providers a useful way to think about compliance. State law generally determines whether and how you can treat the patient. Federal law adds rules governing areas such as payment, privacy, controlled substances, devices, and healthcare business arrangements. A telehealth provider usually has to satisfy both.

This guide covers the federal layer. For the state layer (licensure, standard of care, consent and most prescribing rules), see our explainer on how state telemedicine laws work, and compare individual states in the state law comparison table.

TeleMed Today provides independent educational information about telemedicine, digital health and healthcare policy. This page is not legal, medical or billing advice, and telehealth requirements change frequently — verify current rules with the relevant licensing board, CMS, DEA, payer or qualified professional before acting.

Who Regulates Telehealth?

There is no single federal "telehealth license" or one national telemedicine law that replaces state medical regulation. Different questions are controlled by different authorities.

This is why asking whether something is simply "legal under telehealth law" usually does not produce a complete answer. You first have to know which part of telehealth law you are talking about. The state rows in that table (licensure, standard of care, consent, most prescribing rules and corporate-practice limits) are covered in our explainer on how state telemedicine laws work. The rest of this guide covers the federal rows.

Can Controlled Substances Be Prescribed Through Telehealth?

Federal controlled-substance prescribing is governed in part by the Ryan Haight Online Pharmacy Consumer Protection Act and DEA rules. Historically, the Ryan Haight framework generally required an in-person medical evaluation before certain controlled substances could be prescribed over the internet unless an exception applied. The COVID-19 public health emergency produced major temporary telemedicine exceptions, and those rules have continued to evolve.

Current Federal Status

DEA and HHS have extended the pandemic-era telemedicine prescribing flexibilities through December 31, 2026. Under that extension (90 FR 61301), a DEA-registered practitioner may prescribe Schedule II–V controlled substances after a real-time audio-video telemedicine encounter without having previously conducted an in-person medical evaluation, when the applicable conditions are satisfied. Audio-only encounters qualify only for Schedule III–V narcotic medications approved by the FDA to treat opioid use disorder, such as buprenorphine.

DEA has also adopted two permanent rules, in effect since December 31, 2025. Under 21 CFR 1306.51, a practitioner who first reviews the patient's state prescription drug monitoring program data may prescribe buprenorphine and other FDA-approved Schedule III–V medications for opioid use disorder after a telemedicine encounter, including audio-only, for up to six calendar months from the first prescription. Further prescriptions then require at least one in-person medical evaluation, as defined in 21 U.S.C. 829(e)(2)(B), or another pathway authorized by 21 U.S.C. 829(e), such as another form of telemedicine allowed under federal law. A separate rule, 21 CFR 1306.52, covers continuity of care for VA patients.

December 31, 2026 is an important date to verify rather than permanently hard-code into a compliance program.

State law may also be more restrictive than federal law, and a prescription must satisfy both. Providers should verify the latest guidance directly with the DEA before prescribing controlled substances through telehealth. This is especially important for organizations providing:

• Psychiatry
• ADHD treatment
• Addiction treatment
• Buprenorphine treatment
• Pain management
• Other services involving controlled medications

A telehealth article written six months ago can already be outdated in this area.

Medicare Telehealth Rules

Medicare telehealth policy changed dramatically during the COVID-19 pandemic and has continued changing through subsequent legislation and CMS rulemaking. Many Medicare telehealth flexibilities have been extended through December 31, 2027. Among the currently extended policies, Medicare patients can receive many non-behavioral health telehealth services from home without the old geographic originating-site restrictions through the end of 2027, and certain eligible practitioners can continue providing those services through that period as well.

Some behavioral-health telehealth changes have been made permanent, although CMS says an in-person visit requirement for mental health telehealth at home takes effect after December 31, 2027.

Telehealth legality and telehealth reimbursement are not the same question. A provider can be legally permitted to treat a patient and still find that a particular payer will not reimburse the encounter. Conversely, a service appearing on a payer's telehealth coverage list does not eliminate state licensing requirements. For a deeper explanation, see Telehealth Reimbursement.

Medicaid Telehealth Rules

Medicaid adds another layer because programs are administered by individual states within the federal Medicaid framework. Policies can differ regarding:

• Covered services
• Eligible practitioners
• Patient location
• Provider location
• Audio-only care
• Behavioral health
• Remote patient monitoring
• Billing codes
• Documentation
• Payment rates

Providers operating nationally therefore have to keep state medical law, Medicare rules, Medicaid rules and commercial payer policies separate. They are related, but they are not interchangeable.

HIPAA and Telehealth

HIPAA does not disappear because the appointment takes place over video. Covered healthcare providers and health plans must comply with applicable HIPAA requirements when providing telehealth, which includes protecting patients' protected health information and using appropriate safeguards.

Where a technology company handles protected health information on behalf of a covered provider and qualifies as a business associate, the relationship will generally require an appropriate Business Associate Agreement, or BAA. Providers should evaluate more than whether a product advertises itself as "HIPAA compliant." Look at:

• How information is transmitted
• Where information is stored
• Access controls
• Authentication
• Encryption
• Logging
• Data retention
• Vendor access
• Breach procedures
• Business associate agreements
• Patient communications
• Recording settings

State privacy laws may impose additional requirements, including on health information that falls outside traditional HIPAA relationships. Read our full guide to Telehealth Security and HIPAA.

Audio-Only Telehealth

A phone call can qualify as telehealth in some circumstances, but audio-only treatment is not universally interchangeable with video. The answer can depend on:

• The state
• The specialty
• The clinical service
• The payer
• The patient's circumstances
• Whether the service can safely be provided without visual information

HIPAA does not categorically prohibit audio-only telehealth. HHS has specifically addressed how covered entities can provide audio-only telehealth while complying with applicable HIPAA requirements. The larger question is often whether the particular service can legally, clinically and financially be delivered that way.

Fraud, Kickbacks and Telehealth

Telehealth operates within the same federal fraud-and-abuse framework as the rest of healthcare. The Anti-Kickback Statute, Stark Law, False Claims Act and related rules can apply to telehealth business arrangements. Risk can arise when compensation is connected to:

• Referrals
• Prescription volume
• Testing orders
• Medical equipment orders
• Medicare business
• Lead generation
• Patient recruitment
• Financial relationships with referral sources

Federal enforcement agencies have pursued large fraud cases in which telemarketing operations used brief or nonexistent telehealth encounters to generate reimbursable prescriptions, tests or medical-equipment orders. That is different from legitimate telemedicine, but legitimate telehealth companies should understand why these structures receive scrutiny. A telehealth encounter should be driven by a genuine clinical relationship and medical need, not by the financial value of whatever can be ordered afterward.

FDA Rules for Telehealth Technology

Most ordinary video-conferencing technology is not regulated as a medical device simply because doctors use it. Some technologies used within telehealth are. FDA oversight may become relevant for:

• Connected diagnostic devices
• Remote monitoring hardware
• Certain clinical decision-support software
• Software intended to diagnose disease
• Some AI-enabled medical tools
• Software as a Medical Device, or SaMD

The distinction often depends on the product's intended use and the claims made about what it does. That question comes up more often as telehealth moves beyond video visits into continuous monitoring, artificial intelligence and home-based diagnostics. Read more in our guide to Remote Patient Monitoring.

Can a U.S. Doctor Treat a Patient Who Is Overseas?

Telehealth technology works almost anywhere. Medical licenses generally do not. A U.S. physician's state license does not automatically authorize that physician to practice medicine on a patient physically located in another country. The destination country's laws matter, and there may also be issues involving:

• Malpractice insurance
• Privacy law
• Data transfers
• Prescriptions
• Medication availability
• Emergency response
• Professional registration

The same logic applies in reverse. A physician located abroad generally cannot treat a patient physically located in a U.S. state simply because the interaction occurs online. The physician typically still needs authority to practice in the patient's state. For a broader look, see Telemedicine Around the World.

A Practical Telehealth Compliance Checklist

Before providing a telehealth encounter, a practice should be able to answer these questions.

Where is the patient? Confirm the patient's physical location.

Can the clinician practice there? Verify the relevant license, compact privilege, registration or exemption.

Can this service be delivered remotely? Consider state rules, modality requirements and standard of care.

Has the patient provided any required telehealth consent? Document it appropriately.

Can this medication be prescribed? Check state law and, for controlled substances, current DEA requirements.

Is the technology appropriate? Evaluate HIPAA, security, privacy and clinical limitations.

Will the payer cover it? Check Medicare, Medicaid or commercial payer requirements separately.

What happens if the patient needs in-person or emergency care? Have an escalation procedure before the appointment begins.

That framework will answer far more compliance questions than simply asking whether "telehealth is legal."

The Bottom Line

There is no single telehealth law in the United States. There is a stack of laws. State law usually starts with the patient's physical location and determines who may practice, what standard of care applies and what consent or prescribing rules must be followed. Federal law then adds rules involving Medicare, controlled substances, HIPAA, medical devices, fraud and other areas.

For providers, one question should come before almost everything else: Where is the patient right now? Once you know that, you can determine which state's rules apply and then layer the appropriate federal and payer requirements on top.

The underlying structure of telehealth law is relatively straightforward. The details change constantly, which is why good telehealth compliance is not a policy you write once. It is a system you keep current.

Related TeleMed Today Resources

• How State Telemedicine Laws Work
• State Law Comparison Table
• Telehealth Reimbursement
• Telehealth Security and HIPAA
• How to Start a Telemedicine Program
• Remote Patient Monitoring
• Telemedicine Around the World