Before its first visit, a telehealth practice should adopt written policies on clinical scope and standard of care, patient location, identity, consent, modality, emergencies, prescribing, PDMP checks, record retention, privacy and security, breach response, website tracking technology, licensure and credential tracking, and complaints, each with an owner, review date and training record.
A telehealth practice needs written, adopted and trained policies on fourteen subjects before the first patient visit: clinical scope and standard of care, patient location, identity, consent, modality, emergencies, prescribing, PDMP checks, records, privacy and security, breach response, website and tracking technology, licensure and credentials, and complaints. Some come straight from federal rules; the rest come from state law and from what a board or an investor will ask to see.
Policies are only as good as the evidence that people follow them. Each one below should name an owner, a review date, and the training record that proves staff read it.
1. What is the clinical scope and standard of care?
State the conditions you treat, the conditions you will not treat by telehealth, and the rule that the standard of care is the same as in person. Many state telehealth statutes say exactly that; Florida's, for example, requires practice "consistent with... the prevailing professional standard of practice for a health care professional who provides in-person health care services" (Fla. Stat. § 456.47(2)(a)). Include when a clinician must convert a visit to in-person care and how that referral happens.
2. How do you confirm where the patient is?
Licensure follows the patient's location at the time of the visit. Require the clinician or intake staff to ask and document the patient's physical location at the start of every encounter, and stop the visit if the clinician is not authorized there. See verifying where the patient is.
3. How do you verify identity?
Photo ID at the first visit, a defined match check at later visits, and a stricter process for controlled substances. DEA's proposed special registration rule (90 FR 6541) would require a photographic record of the patient's ID for special registration prescriptions; it is not final, but building to that standard now costs little. See patient identity verification.
4. What does consent cover, and how is it captured?
The Center for Connected Health Policy's Fall 2025 summary counts 45 states plus DC and Puerto Rico with a telehealth consent requirement. Write a base consent and state addenda, version them, and store the signed version with the timestamp. See what a telehealth consent form must cover.
5. Which modalities are allowed for which visits?
Spell out where synchronous video is required, where audio-only is acceptable, and where asynchronous review is allowed, by state and by visit type. Medicare's audio-only allowance for most services runs through December 31, 2027 under the Consolidated Appropriations Act, 2026; state Medicaid programs and commercial payers set their own rules. See audio-only telehealth rules.
6. What happens in an emergency?
Collect a callback number and the patient's address at the start of the visit, know how to reach the 911 center that serves the patient's location rather than your own, and write a script for suicidal ideation, chest pain and other high-risk presentations. See emergency protocols for a telehealth practice.
7. How are prescriptions decided?
One protocol per drug class: required history, exam elements by video, labs before the first prescription, follow-up interval, and refill rules. State the minimum interaction required before any prescription; several states prohibit prescribing on a questionnaire alone. For controlled substances, document the DEA basis for every telemedicine prescription and the plan for January 1, 2027. See our DEA telemedicine rules hub.
8. When is the PDMP checked?
Most states require prescribers to check the prescription drug monitoring program before certain controlled-substance prescriptions; the triggers and frequency vary. DEA's buprenorphine telemedicine rule (90 FR 6504) adds a federal requirement to review the PDMP of the state where the patient is located. Write which PDMP is checked, when, and where the check is documented. See PDMP checks for telehealth prescribers.
9. How long are records kept, and where?
Medical record retention is set by state law and varies, so use the longest period among your states. HIPAA separately requires you to keep your HIPAA policies and related documentation for six years (45 CFR 164.316(b)(2)). DEA requires controlled-substance records to be kept for at least two years (21 CFR 1304.04(a)). Record video only if you have a reason to and a consent that covers it.
10. What does the privacy and security program include?
A documented security risk analysis (45 CFR 164.308(a)(1)(ii)(A)), risk management plan, access controls, workforce sanctions, a notice of privacy practices (§ 164.520), business associate agreements with every vendor that handles PHI, and a device policy for clinicians working from home.
11. Who decides whether an incident is a breach?
Name the person, the four-factor risk assessment under 45 CFR 164.402, and the deadlines: notice to individuals without unreasonable delay and no later than 60 days after discovery (§ 164.404), media and HHS notice for breaches of 500 or more (§§ 164.406, 164.408), and any shorter state deadlines.
12. What tracking runs on the website and app?
This is the policy most practices forget. Inventory every pixel, tag and SDK, decide which pages may carry marketing tools, and route any change through compliance review. The FTC's actions against BetterHelp (2023) and Cerebral and Monument (2024) were about exactly this. See tracking pixels on telehealth sites.
13. How are licenses and credentials tracked?
A roster of every clinician's licenses, compact privileges, telehealth registrations, DEA and state controlled-substance registrations, board certifications and malpractice coverage by state, with expirations and a rule that scheduling blocks a clinician in a state the day a credential lapses. See building a telehealth compliance calendar.
14. How are complaints and adverse events handled?
An intake channel, a clinical review step, a timeline for response, and a log. Patterns in complaints are the earliest signal of a protocol problem.
How do you prove the policies are real?
- Board or owner adoption with a date.
- Training sign-offs for every clinician and staff member, repeated annually and on each revision.
- Periodic chart audits against the prescribing and location policies.
- A version history, so you can show which policy applied on the date of any visit.
Our Telehealth Policies & Consent Kit ($1,950) drafts all fourteen for your states and service line, written for your counsel's review. Telehealth CE for clinicians is available through White Glove CME. See pricing.
Common questions
- How long does HIPAA require telehealth policies to be kept?
- Six years. 45 CFR 164.316(b)(2) requires HIPAA policies, procedures and related documentation to be retained for six years from creation or the date last in effect, whichever is later. Medical record retention is a separate, state-law question.
- Does a telehealth practice need an emergency policy?
- Yes. A clinician must be able to reach emergency services where the patient is, not where the clinician is. Collect a callback number and address at the start of each visit and script responses to high-risk presentations.
- Do I need a policy on website pixels?
- You should have one. Tracking tools on telehealth sites have led to FTC orders against BetterHelp, Cerebral and Monument. Inventory every tag and SDK, limit marketing tools to pages you have reviewed, and require compliance sign-off on changes.
- How often should telehealth policies be reviewed?
- At least annually, and whenever a rule changes. In 2026 and 2027 that includes the end of DEA's temporary telemedicine flexibilities on December 31, 2026 and Medicare's telehealth flexibilities on December 31, 2027.
Planning a Telehealth Service Line?
We research every state's rules for your service line, write the policies and consent forms, file telehealth registrations and keep it current, at published prices.