Verifying Where the Patient Is at the Start of Every Visit

Telehealth law has one fixed point: care is delivered where the patient is. Oregon's statute says the practice of medicine by telemedicine occurs where the patient is located (Or. Rev. Stat. § 677.494). Florida deems a telehealth act to occur where the patient is located at the time or in their county of residence (Fla. Stat. § 456.47(5)). Colorado's Medical Board takes the same position. That makes the patient's location at the moment of the visit the input to every other compliance decision, and the one most practices capture worst.

Why does the address on file not work?

Because patients move around. The address in the EHR is where the bill goes. On a given Tuesday the patient may be at a college in another state, at a parent's house over the holidays, at work across a state line, or in a parked car at a rest stop. Each of those can change which license the clinician needs, which prescribing rules apply, which PDMP must be checked and where an ambulance should go. The question has to be asked at each visit.

Which rules depend on the patient's location?

• Licensure. The clinician needs a license, compact privilege, registration or exception for the state the patient is in. See licensure exceptions and states with a telehealth registration.
• Controlled substances. Under the Ryan Haight Act's telemedicine categories, the remote practitioner must be registered "in the State in which the patient is located" (21 U.S.C. 802(54)(A)-(B)), and the special registration statute uses the same test (21 U.S.C. 831(h)). The buprenorphine rule requires review of the PDMP of the state where the patient is located at the time of the encounter (21 CFR 1306.51). See PDMP checks for telehealth prescribers.
• State prescribing limits, such as Florida's Schedule II rule or Connecticut's bar on Schedule I to III by telehealth, attach to patients located in those states.
• Consent and visit content. Vermont, Connecticut, Delaware and others set requirements for patients located there. See telehealth consent requirements.
• Medicare. Through December 31, 2027, the patient's home and any county qualify as originating sites under the Consolidated Appropriations Act, 2026. When those flexibilities end, the originating site rules return, and location again determines whether many Medicare visits are covered. See the Medicare telehealth hub.
• Emergencies. A 911 call from the clinician's office reaches the clinician's local dispatcher, not the patient's. See emergency protocols.

Which states require location verification by rule?

Several put it in writing, from the statutes and rules we have verified:

• Alabama requires the physician to verify the patient's identity and "city and state" before a telehealth visit (Ala. Code § 34-24-703).
• Delaware requires "thorough verification and authentication of the location" of the patient as part of establishing a relationship (24 Del. C. § 6003(a)(1)).
• Maryland Board of Physicians rules require confirming at each synchronous visit that the patient is in Maryland, and identifying everyone present at both ends.
• Ohio requires the clinician to verify the patient's identity and Ohio location (Ohio Admin. Code 4731-37-01).
• Oklahoma requires confirming the patient's identity and location before establishing a relationship by telemedicine (Okla. Admin. Code 435:10-7-13).
• Tennessee and South Dakota require location verification as part of the telemedicine relationship (Tenn. Comp. R. & Regs. 0880-02-.16; S.D. Codified Laws § 34-52-3).
• Colorado Medical Board policy conditions a telehealth relationship on verifying the patient's identity and location.

Indiana's telehealth statute also lists identity and location among the elements of a relationship (Ind. Code § 25-1-9.5-7). Even where no rule names it, the standard of care does: a clinician who cannot say where the patient was cannot show which state's law they complied with.

What does a good location check look like?

1. Ask, every visit. "Before we start, where are you right now, city and state?" Ask even for long-standing patients.
2. Record the answer in a structured field, not in free text. The field drives everything downstream: licensure checks, PDMP state, consent inserts.
3. Ask for the physical address when the visit involves controlled substances, a mental health risk, or anything that could need emergency services. Record a callback number.
4. Compare it to the clinician's authorizations. If the patient is in a state where this clinician has no license, registration or applicable exception, stop and reschedule or hand off. Do not finish the visit and sort it out later.
5. Use technical signals as a cross-check, not a substitute. Device location or IP address can flag a mismatch, but VPNs, cellular routing and privacy settings make them unreliable. The patient's statement, recorded, is the primary evidence.

What should the scheduling system do?

• Ask for the expected visit location at booking, then confirm at check-in.
• Route bookings only to clinicians authorized in that state.
• Block the visit if the check-in state differs from the booked state and the clinician is not authorized there.
• Report monthly on mismatches caught. A count of zero usually means the question is not being asked.

Patient identity checks are a separate control that sits next to this one; see patient identity verification for telehealth. Our Telehealth Policies & Consent Kit ($1,950) includes the location and identity verification policy and scripts, and the Telehealth Launch Blueprint ($4,950) builds the routing rules into scheduling. This is operational guidance for your counsel to review, not legal advice.