U.S. telehealth regulations: foundational concepts and key state-level differences

Halfway through my second cup of coffee, I realized my notes on telehealth rules finally felt like a map instead of a maze. I’ve been clipping headlines, skimming PDFs, and texting colleagues every time a state tweaked an audio-only rule or Congress nudged Medicare dates. Today I wanted to write it down the way I would in my journal—plain, practical, and honest about what I know and what I’m still watching. If you’re trying to make sense of the U.S. telehealth landscape—where federal timelines meet fifty different state rules—this is the field guide I wish I had sooner.

Why telehealth rules feel confusing until they don’t

My early mistake was treating “telehealth law” like one giant law. It isn’t. Think of it as layers that overlap:

• Federal anchors set the floor for Medicare, controlled-substance prescribing, and HIPAA privacy/security expectations.
• States define the walls and doors: licensure (who can see whom and from where), modality (video vs. audio-only), consent language, coverage mandates, and prescribing specifics.
• Payers set the furniture: coverage vs. payment parity requirements (if any), billing modifiers, and plan-by-plan wrinkles.

My highest-value takeaway: if I can quickly confirm (1) where the patient is, (2) how the clinician is licensed for that state, and (3) whether the modality and service are covered by the payer, 80% of the confusion melts away.

• HHS Telehealth Policy Updates (2025)
• Federal Register Buprenorphine Telemedicine Final Rule (2025)
• Federal Register DEA Telemedicine Flexibilities Extension (through 2025)
• CCHP State Telehealth Policy Finder
• OCR HIPAA & Telehealth

The scaffolding I use to read any telehealth rule

When a headline drops (“State X updates audio-only billing”), I run through a simple framework:

• Step 1 — Place the patient: The patient’s physical location at the time of service usually controls which state’s licensure and practice rules apply. I literally write “PT in: [state].”
• Step 2 — Validate licensure path: Full in-state license? Expedited via a compact (e.g., IMLC for MD/DO, PSYPACT for psychologists)? Or a state telehealth registration (some states allow out-of-state clinicians to register just for telehealth)?
• Step 3 — Match modality to service: Is live video required, or is audio-only allowed for this service and profession? Store-and-forward and RPM often have separate rules.
• Step 4 — Confirm payer specifics: For Medicare, check current federal timelines (dates matter this year). For Medicaid and commercial plans, verify coverage and any parity requirements in that state.
• Step 5 — Document consent + privacy: Many states require one-time or per-visit telehealth consent with specific elements; HIPAA-compliant tech is expected now that pandemic flexibilities ended.
• Step 6 — Prescribing guardrails: If controlled substances are involved, ensure the scenario fits current DEA rules (and any state PDMP checks) before writing a script.

I keep that checklist taped near my monitor. It saves me from rabbit holes.

Medicare timelines without the jargon

I like to think of 2025 in two phases—through September 30 and after September 30—because a lot of Medicare flexibilities hinge on that date. According to HHS, most non-behavioral Medicare telehealth flexibilities run through September 30, 2025: patients can receive telehealth at home with no geographic restrictions; audio-only remains permitted for certain services; and all eligible Medicare practitioners can furnish telehealth during this window. For behavioral health, several flexibilities are permanent (e.g., home as an originating site, audio-only allowances, no geographic limits), while the “in-person follow-up” requirement is delayed until fall 2025 for most professionals (and until Jan 1, 2026 for some RHC/FQHC situations). See the concise summary at HHS Telehealth Policy Updates (2025).

Why I write dates in the margin: policies evolve. If you bill Medicare, jot down the service, setting (home vs. facility), and whether audio-only is used, then align with the current HHS/CMS guidance for the period in question. That “paper trail” makes future audits far less stressful.

Prescribing through telemedicine what changed and what hasn’t

This is the part I double-check every time. Two federal pieces matter in 2025:

• DEA flexibilities remain in effect through December 31, 2025 for prescribing controlled medications via telemedicine under the pandemic-era framework (e.g., initial prescribing without a prior in-person exam when specified conditions are met). That extension is captured in the Third Temporary Extension (Federal Register).
• Buprenorphine via telemedicine received a separate, finalized pathway in 2025: clinicians can prescribe an initial six-month supply for opioid use disorder after reviewing PDMP data, including via audio-only telemedicine, with identity verification and follow-up requirements (e.g., in-person or other authorized telemedicine path for continuation). That’s spelled out in the Buprenorphine Final Rule (Federal Register).

Important nuance I keep in bold in my notes: the buprenorphine rule does not open the door to telemedicine prescribing of all controlled substances in the same way; it addresses schedule III–V medications for opioid use disorder with specific guardrails. State law still applies (PDMP, special consent, identity checks). I also remind myself to document the exact steps taken (PDMP check, modality used, identity verification) in the chart.

The big five state-level variables I check every time

When I talk to friends who practice across state lines, these are the five dials we all watch:

• Licensure and cross-state pathways: Most states still require a full in-state license to treat patients located in that state. Some states offer telehealth registration for out-of-state clinicians (you register rather than obtain a full license). Several professions also use compacts (e.g., IMLC for physicians, PSYPACT for psychologists, Counseling Compact for counselors) to expedite multi-state licensure. For a quick, up-to-date read on your profession and target state, I open the CCHP State Policy Finder and filter by “Licensure.”
• Modality permissions: Whether audio-only qualifies depends on the state, profession, and service. For instance, mental health is often more audio-friendly than procedural specialties; some states require video for initial establishment of care or certain evaluations. I note “AO ok?” next to each service in my cheat sheet.
• Consent content and timing: A majority of states require specific telehealth consent (sometimes once per patient, sometimes per encounter), and some specify elements like risks to confidentiality, what to do if technology fails, or the right to in-person care alternatives. This is an easy compliance win—template your consent to the strictest state you serve and keep it accessible in your EHR.
• Coverage and payment parity: Many states have private payer telehealth laws. “Coverage parity” means plans can’t deny a covered service just because it’s delivered via telehealth; “payment parity” means equal rates to in-person (less common and often nuanced). CCHP’s state pages summarize whether your state has service or payment parity and any carve-outs.
• Prescribing extras: Beyond federal law, states may require PDMP checks, restrict certain prescriptions to in-person exams, or dictate identity verification steps. I keep a short “Rx via telehealth?” matrix for the services I actually provide.

Concrete examples I’ve bumped into recently (summarized, because details change): Florida continues to use an out-of-state telehealth registration pathway instead of a full license for many clinicians; California requires one-time patient consent for telehealth with specific content; Texas expects informed consent documentation for telemedicine; and New York updated program modifiers for certain audio-only behavioral health services in mid-2025. I verify the latest wording in the CCHP finder before acting on any single blog post (including mine!).

Privacy expectations in 2025 and the HIPAA basics that matter

During the COVID emergency, the government temporarily relaxed some HIPAA enforcement for telehealth platforms; that ended in 2023 after a short transition. The practical meaning in 2025: covered providers and health plans are expected to use HIPAA-compliant communication technologies, address audio-only scenarios appropriately, and maintain the usual privacy, security, and breach-notification standards. If you need a single landing page to review what still applies and where the agency’s focus is, bookmark OCR’s HIPAA & Telehealth page.

My own routine: I ask, “Is the platform within our Business Associate Agreements? Do we have a downtime plan if video fails? Are we training staff to avoid recording sensitive content unintentionally?” I also borrow language from my state’s required consent elements so patients understand privacy trade-offs up front.

A practical checklist I’m actually using

Here’s the pared-down version that lives in my notes app. It’s unglamorous and it works:

• Patient location confirmed and documented (state, city).
• Licensure verified for that state (full license, compact, or state telehealth registration).
• Modality permitted for the service (video vs. audio-only; any special conditions for new patients).
• Payer rules checked (Medicare date windows, Medicaid policy notes, commercial plan parity or modifiers).
• Consent obtained using state-compliant language; stored in the record.
• Privacy confirmed (HIPAA-compliant tech; BAAs in place; no screen-recording unless authorized).
• Prescribing reviewed (PDMP check documented; DEA/state rules satisfied; identity verified when needed).
• Documentation includes modality, tech issues (if any), patient location, consent, and safety plan.
• Safety net: local emergency contacts and nearest urgent care/ED noted if an escalation is needed.

Signals that tell me to slow down and double-check

Some scenarios make me press pause. Not to alarm—just to be careful:

• Cross-border care where licensure or registration isn’t crystal clear.
• Initial controlled-substance prescribing without a prior in-person exam—rules here are specific and evolving.
• Audio-only for new diagnoses in states that limit it to established patients or to certain services.
• High-risk complaints (e.g., chest pain, focal neuro deficits) that may not be appropriate for telehealth evaluation alone.
• Documentation gaps—if consent text, patient location, or PDMP checks aren’t obvious in the chart, I fix that before signing.

What I’m keeping and what I’m letting go

What I’m keeping: a bias toward writing the date next to every rule, a living spreadsheet of states I care about, and a one-page consent template I can tweak by state. What I’m letting go: the idea that I’ll memorize all fifty sets of rules (I won’t), and the stress that I have to chase every rumor on social media. When something matters, I go back to primary sources—HHS, the Federal Register, and the CCHP policy finder—and then I update my notes.

FAQ

1) Do I need a license in the patient’s state to provide telehealth?
Answer: Usually yes. Most states require you to be licensed where the patient is located at the time of service. Some offer telehealth registration or participate in licensure compacts that ease multi-state practice. I verify current pathways via the CCHP State Policy Finder before scheduling.

2) Is audio-only still allowed?
Answer: It depends on the service, payer, and state. For Medicare, audio-only is generally permitted for certain services through September 30, 2025, with permanent allowances for behavioral health in the home setting. States can be stricter, so I check each state’s rules and plan policies. See HHS Telehealth Policy Updates for the federal baseline.

3) Can I prescribe controlled substances via telemedicine without an in-person exam?
Answer: In many scenarios, yes—through December 31, 2025 under the current DEA flexibilities (with conditions). There’s also a separate finalized rule allowing an initial six-month supply of buprenorphine for OUD via telemedicine (including audio-only) with PDMP review and identity verification. Details are in the DEA Extension and the Buprenorphine Final Rule.

4) What does HIPAA expect of my telehealth platform now?
Answer: The pandemic’s enforcement discretion ended in 2023, so the usual HIPAA Privacy, Security, and Breach Notification Rules apply. Use HIPAA-compliant technology, maintain BAAs where required, safeguard audio-only encounters appropriately, and train staff. The OCR HIPAA & Telehealth page is the cleanest refresher.

5) How do I track state-by-state differences without drowning?
Answer: Pick a reliable primary source and a simple workflow. I rely on the CCHP finder, then snapshot key items into a one-page cheat sheet: licensure path, audio-only rules, consent text, Medicaid notes, and any prescribing quirks. Re-check before each quarter.

Sources & References

• HHS Telehealth Policy Updates (2025)
• Federal Register Buprenorphine Telemedicine Final Rule (2025)
• Federal Register DEA Telemedicine Flexibilities Extension (2024)
• CCHP State Telehealth Policy Finder
• OCR HIPAA & Telehealth

This blog is a personal journal and for general information only. It is not a substitute for professional medical advice, diagnosis, or treatment, and it does not create a doctor–patient relationship. Always seek the advice of a licensed clinician for questions about your health. If you may be experiencing an emergency, call your local emergency number immediately (e.g., 911 [US], 119).