Telehealth Legal Considerations for DPC¶

Quick Summary: Telehealth expands your reach and convenience, but brings legal complexity. The rules changed dramatically during COVID and continue evolving. Know the basics before you click "Start Video."

[!CAUTION] Telehealth regulations vary dramatically by state and are actively changing. Many COVID-era flexibilities have expired or are expiring. Verify current rules with your state medical board before practicing telehealth across state lines.

The Basics¶

What Counts as Telehealth?¶

Generally includes: - Live video visits - Audio-only phone visits (varies by state) - Store-and-forward (asynchronous) - Remote patient monitoring - Text-based consultations

Key question: Where is the patient located when you provide care?

The Fundamental Rule¶

You need a license in the state where the patient is located at the time of the visit.

Not where they live. Not where you are. Where they are right now.

Example: Your patient is on vacation in Florida. You're licensed in Ohio. If you do a telehealth visit while they're in Florida, you may be practicing medicine in Florida without a license.

Licensing Requirements¶

Interstate Medical Licensure Compact (IMLC)¶

What it is: An agreement among participating states for expedited licensure.

Currently ~40 states participate (check current list at imlcc.org)

How it works: 1. Apply through compact 2. Get license in qualifying state 3. Get expedited licenses in other compact states 4. Still need separate license for each state 5. Still pay licensing fees

Cost: $700+ per additional state license

State-by-State Licensure¶

Without the compact: - Full application in each state - Months of waiting - Significant fees - Background checks each time

Reality for most bootstrap DPC: License in your home state only until volume justifies expansion.

Exceptions and Special Cases¶

Established patients traveling: - Some states have "continuity of care" exceptions - Limited scope and duration - Not a permanent solution

Emergencies: - Most states allow emergency care without full licensure - Narrow definition of "emergency"

Consultations: - Consulting with another physician (not treating patient directly) - Generally doesn't require local license - Must be true consultation, not primary care

HIPAA and Telehealth¶

Platform Requirements¶

Your telehealth platform must be HIPAA-compliant: - Business Associate Agreement (BAA) with vendor - End-to-end encryption - Access controls - Audit logs

HIPAA-compliant platforms: - Doxy.me (free tier available) - Zoom for Healthcare (not regular Zoom) - Google Meet (with Workspace BAA) - VSee - Teladoc (enterprise) - Most EMR-integrated solutions

NOT HIPAA-compliant: - Regular Zoom - FaceTime - Standard Skype - WhatsApp - SMS/text messaging

Post-COVID Reality¶

COVID flexibilities have ended or are ending: - FaceTime/Skype enforcement discretion expired - Audio-only restrictions returning in some states - Prescribing flexibilities tightening

Check current HHS guidance for any remaining flexibilities.

Informed Consent for Telehealth¶

What to Cover¶

Your telehealth consent should include:

1. Nature of telehealth
2. Not the same as in-person
3. Technical limitations

4. What can/cannot be assessed

5. Privacy considerations

6. How you protect information
7. Patient's responsibility for their environment

8. Recording policies

9. Technical requirements

10. Internet connection needed
11. Video preferred

12. Backup plan if technology fails

13. Limitations

14. May need in-person follow-up
15. Some conditions require examination

16. Emergencies require 911

17. Patient rights

18. Right to refuse telehealth
19. Right to request in-person
20. Complaint procedures

Consent Best Practices¶

• Written consent recommended (not required everywhere)
• Can be part of membership agreement
• Verbal consent acceptable with documentation
• Re-consent for significant changes

Prescribing via Telehealth¶

Controlled Substances¶

The Ryan Haight Act: - Generally requires in-person exam before prescribing controlled substances - Exceptions expanded during COVID - Many flexibilities have expired or are expiring

Current status (verify): - Audio/video visit may qualify as "in-person" for some substances - State rules vary significantly - DEA proposed rules still in flux - Check current DEA guidance

Safest approach: In-person exam before controlled substances unless you've verified current exceptions apply.

Non-Controlled Prescriptions¶

Generally permitted via telehealth if: - Established patient relationship (or appropriate new patient eval) - Adequate assessment via telehealth - Appropriate for telehealth prescribing - Documented appropriately

State Variations¶

Some states require: - Specific documentation for telehealth prescriptions - Pharmacy notification of telehealth visit - Limitations on certain medications

Documentation Requirements¶

Telehealth-Specific Documentation¶

Document: 1. Patient location at time of visit 2. Your location 3. Technology used 4. Who else was present (patient's side) 5. Any technical difficulties 6. Consent obtained 7. Assessment limitations (if any)

Example Documentation¶

Telehealth visit conducted via [Platform] on [Date].
Patient located in [City, State] at time of visit.
Provider located in [City, State].
Video and audio quality adequate.
Patient alone in private setting.
Consent for telehealth previously obtained [Date].
Physical exam limited by telehealth modality; 
vital signs self-reported.

Audio-Only (Phone) Visits¶

State Variations¶

Some states require video: - Phone visits may not count as "telehealth" - May limit what can be done/billed

Some states permit audio-only: - With documentation - For established patients - With limitations

CMS/Medicare¶

Audio-only allowed for certain visits (check current guidance).

Best Practice¶

• Use video when possible
• Document why audio-only if needed
• Know your state's rules
• Consider patient preferences vs. legal requirements

Cross-Border Practice¶

Patients Who Travel¶

Options:

1. Don't provide telehealth while out of state
2. Safest legally

3. Frustrating for patients

4. Continuity of care exception (if available)

5. Limited scope
6. Check specific state rules

7. Time-limited

8. Get licensed in common destination states

9. IMLC expedites this

10. Cost consideration

11. Limit care to advice vs. treatment

12. "Here's what you might discuss with a local doctor"
13. Gray area—document carefully

Snowbirds and Part-Time Residents¶

Common scenario: Patient lives in your state but winters in Florida.

Options: - Get Florida license - Limit to in-person when they're in your state - Hybrid approach (some states, not others)

International Patients¶

Generally: - U.S. license doesn't apply overseas - Major liability concerns - Country-specific rules - Most conservative: Don't do it

Platform Selection¶

Bootstrap-Friendly Options¶

What to Look For¶

• BAA available and signed
• Encryption (end-to-end preferred)
• Patient-friendly (no app required ideal)
• Documentation integration
• Technical support
• Reliability

Red Flags¶

• No BAA offered
• Consumer-grade product
• Data stored overseas
• Unclear privacy policy

Liability Considerations¶

Malpractice Coverage¶

Verify your policy covers: - Telehealth visits - All states where you practice - The specific telehealth modality (video, audio, text)

Some policies require: - Notification of telehealth practice - Endorsement for other states - Higher premiums for multi-state

Standard of Care¶

Telehealth standard of care: - Emerging area - Generally: same as in-person where possible - Document limitations appropriately - Refer for in-person when needed

Common Liability Risks¶

1. Missed diagnosis due to exam limitations
2. Failure to refer for in-person when indicated
3. Prescribing errors without adequate assessment
4. Technology failures during critical situations
5. Privacy breaches through insecure platforms

Compliance Checklist¶

Before Launching Telehealth¶

• Verify state allows telehealth for your practice type
• Select HIPAA-compliant platform
• Sign BAA with platform vendor
• Update informed consent/membership agreement
• Confirm malpractice coverage
• Understand prescribing limitations
• Train on technology

For Each Visit¶

• Confirm patient location (state)
• Verify you're licensed in that state
• Document location of patient and provider
• Appropriate for telehealth (or refer in-person)
• Consent verified
• Document any limitations

Ongoing¶

• Monitor regulatory changes
• Update consent as rules change
• Review malpractice annually
• Consider additional state licenses as practice grows

The Bootstrap Approach¶

Start simple: 1. License in your home state only 2. Telehealth for in-state patients only 3. Free or low-cost HIPAA platform (Doxy.me) 4. Clear consent in membership agreement 5. Grow into multi-state as volume justifies

Costs: - Platform: $0-50/month - Additional state licenses: $700+/state (if needed) - Malpractice endorsement: Varies

Related Guides¶

• HIPAA Compliance Basics
• Controlled Substances Compliance
• State-Specific Guides (check telehealth rules)
• Technology for DPC

Resources¶

• Federation of State Medical Boards: Telehealth policy by state
• Center for Connected Health Policy: State telehealth laws
• IMLC: Interstate Medical Licensure Compact
• DEA: Telehealth prescribing guidance

[!NOTE] Telehealth regulations are a moving target. What was true during COVID may not be true now. When in doubt, practice conservatively and verify current rules with your state medical board.

Telehealth is a powerful tool for DPC—it embodies the accessibility DPC promises. But cutting corners on compliance can jeopardize your license. Get the platform right, understand the rules, and document thoroughly.