Intro to telehealth policy

The majority of existing telehealth policy in the United States centers around reimbursement — that is, the specific services that are covered by Medicare on the federal level, and by Medicaid and private insurance companies on the state level. We know: it’s complicated.

Learn the basics

COVID-19 made telehealth policy even more complicated when the 2020 CARES Act introduced a slew of actions and exceptions to help expand the use of telehealth during the pandemic. That’s why CCHP is dedicated to providing the clearest picture of telehealth policy across the nation.

A 13-minute crash course in how telehealth policy works and the impact of COVID-19.

Watch all our policy explainers

How to
approach
telehealth policy

Because so much of policy is based on reimbursement, an easy way to understand how it’s structured is through four questions:

  1. What specific services are eligible for reimbursement?
  2. Who can be reimbursed — for example, physicians, therapists, nurses?
  3. Where can the patient be when receiving services?
  4. How is the service being delivered — as in, which modality?

Different federal and state agencies can answer those questions in different ways, and no two states define or regulate telehealth the same way.


For example, one Medicaid program may only reimburse for live video (How) that delivers telemental or telebehavioral health services (What), while another Medicaid program reimburses all medically necessary telemedicine services (What) to any licensed provider who is enrolled with Medicaid (Who).

We regularly update every state’s current laws and regulations in our Policy Finder.

Look up a state >


It can also be helpful to understand federal Medicare policy as a baseline, as it often has a trickle-down effect to other payers.

Look up current federal policies >


Both Medicare and Medicaid temporarily updated and expanded their reimbursement policies to help providers better serve patients who are sheltering in place during the COVID-19 pandemic. While in effect, those policies supersede all other existing regulations — and some will likely become permanent even after the pandemic is resolved.

Track active COVID-19 actions >

A deeper dive into
telehealth policy

Telehealth policy intersects with or is impacted by a multitude of government programs, regulations, laws, and policies related to health. Let’s take a closer look at the most common and influential.

Medicare

Medicare is the federal health insurance program for people 65 or older, people with certain disabilities under 65, and people with end stage renal disease. Medicare will reimburse for a limited set of telehealth delivered services if certain parameters are met. The program is administered by the Center for Medicare and Medicaid Services (CMS).

Medicare telehealth policies during COVID-19

Following is a description of Medicare telehealth permanent policy — but please note that currently telehealth reimbursement within Medicare is more expansive as a result of the public health emergency. These exceptions are temporary and being tracked by CCHP here. 

Reimbursement

Medicare reimburses only for specific services when they are delivered via live video. Store-and-forward delivered services are prohibited, except for CMS telehealth demonstration programs in Alaska and Hawaii. 

(Medicare does reimburse for certain other kinds of services that are furnished remotely using communications technology but are not considered Medicare “telehealth services.” To learn more about those, jump here.)

Telehealth Services

The specific telehealth-delivered services eligible for reimbursement under Medicare are identified by Current Procedural Terminology (CPT) or Healthcare Common Procedure Coding System (HCPCS) codes. Each year, the US Department of Health and Human Services considers submissions for new telehealth-delivered services to be approved. Submissions are allowed from providers, advocacy organizations, and other interested parties.

CMS will decide to approve a submitted CPT code for reimbursement based on whether the service meets the requirements in one of two categories:

  • Category 1: Services are similar to existing services, such as professional consultations, office visits, and office psychiatry services, which already are approved for telehealth delivery.In deciding whether to approve the new codes, similarities between the requested and existing telehealth services are examined, including interactions among the beneficiary and the practitioner at the distant site and, if necessary, the telepresenter, and similarities in the technologies used to deliver the proposed service.
  • Category 2: Services not similar to Medicare-approved telehealth services.Reviews of these requests include an assessment of whether the service is accurately described by the corresponding CPT code when delivered via telehealth, and whether the use of technology to deliver the service produces a demonstrated clinical benefit to the patient.
  • Category 3 — new in 2020: Services that are likely to provide clinical benefit via telehealth, yet lack sufficient clinical evidence to evaluate making them permanent under Category 1 or Category 2.These are to remain in effect until the end of the calendar year in which the COVID-19 public health crisis ends (not when the PHE ends).

CMS maintains a list of current CPT codes eligible for Medicare reimbursement for calendar year (CY) 2020, and codes that are specific to the public health emergency are available here. For more information on changes made for CY 2021, see CMS’ calendar year final physician fee schedule or CCHP’s factsheet on the CY 2021 proposed physician fee schedule. Newly approved services typically become eligible for reimbursement on January 1 of the following year.

Eligible providers

Medicare limits the types of health care professionals who can provide telehealth-delivered services. The small group of eligible professionals are:

  • Physicians
  • Nurse practitioners
  • Physician assistants
  • Nurse midwives;
  • Clinical nurse specialists
  • Certified registered nurse anesthetists
  • Clinical psychologists and clinical social workers (these professionals cannot bill for psychotherapy services that include medical evaluation and management services)
  • Registered dietitians or nutrition professionals.

Geographic location

The patient’s location at the time services are received via telehealth is known as the “originating site.” Medicare treats telehealth almost exclusively as a tool for rural areas, and has narrowly restricted the geographic areas that are eligible to use telehealth. The originating site must be in a Health Professional Shortage Area (HPSA) as defined by Health Resources and Services Administration (HRSA), or in a county that is outside of any Metropolitan Statistical Area (MSA) as defined by the US Census Bureau. Some argue against this restriction because many underserved areas are still barred from receiving telehealth-delivered services, and those that are eligible may not have an adequate population base to maintain a telehealth network.

In 2019, there were some exceptions made from both the geographic and originating site requirements for the end stage renal disease (ESRD) services, treatment of acute stroke and treatment of substance use disorder and co-occurring mental health conditions. Additionally, the Consolidated Appropriations of 2021, which passed in December 2020, also provided an exception for mental health patients. Those exceptions are outlined in a subsequent section. 

Effective as of January 2014, CMS redefined rural HPSAs as areas located in rural census tracts as determined by the office of Rural Health Policy (ORHP). This allows eligible facilities located in rural census tracts that are within an MSA to be eligible telehealth originating sites. HRSA also maintains a Medicare telehealth payment eligibility search tool, where eligibility of an originating site may be checked.

Eligible facilities

In addition to the rural restriction, Medicare limits the originating sites (where the patient is located) eligible for telehealth-delivered services to the following facilities:

  • Provider offices
  • Hospitals
  • Critical access hospitals
  • Rural health clinics
  • Federally qualified health centers
  • Skilled nursing facilities
  • Community mental health centers
  • Hospital-based or critical access hospital-based renal dialysis centers
  • Rural emergency hospitals (new designation for 2023)

Note that there are certain exceptions to the facility requirement in the case of end stage renal disease (ESRD) services, treatment of mental health disorder, acute stroke and treatment of substance use disorder and co-occurring mental health conditions. These exceptions are outlined in the section below.

Exceptions from geographic and facility restrictions

Effective as of January 2019, CMS finalized their regulations to reflect required changes in telehealth reimbursements made by the Bipartisan Budget Act of 2018. These changes specifically relate to end stage renal disease (ESRD) services and the treatment of acute stroke.  

  • End Stage Renal Disease: For ESRD services, renal dialysis facilities and the home now qualify as eligible originating sites. If the site is the home, an in-person visit is required once a month for the first three months and once every three months thereafter. Additionally, the geographic limitation would not apply to these new sites or hospital-based or CAH-based renal dialysis centers for the treatment of ESRD. There would be no facility fee if the home were the originating site.
  • Acute Stroke Treatment: For the treatment of acute stroke, a mobile stroke unit along with any currently eligible originating site is eligible for telehealth reimbursement. The Secretary has the ability to designate additional sites, but has not done so at this time. Additionally, the geographic limitation would not apply for the treatment of acute stroke in any of the eligible originating sites (including mobile stroke units). However, originating sites that would not otherwise qualify for telehealth reimbursement (under Medicare’s geographic and originating site requirements) would not be eligible for the facility fee.
  • Treating Individuals with Substance Use Disorders (SUDs) or co-occurring mental health disorders: The 2018 SUPPORT for Patient and Communities Act required CMS to adjust their reimbursement policy of telehealth for treating individuals with SUDs or a co-occurring mental health disorder. Specifically, it removed the originating site geographic requirements for telehealth services on or after July 1, 2019 for any existing Medicare telehealth originating site (except for a renal dialysis facility). Additionally, the home was made an eligible originating site for purposes of treating these individuals, however the home would not qualify for the facility fee.

    The normal telehealth service code limitations still apply for services rendered under this exception. Practitioners would also be responsible for assessing whether individuals have a SUD diagnosis and whether it would be clinically appropriate to furnish the telehealth services for the treatment.
  • Diagnosis, Evaluation or Treatment of Mental Health Disorder once COVID-19 emergency ends: Due to the passage of the Consolidated Appropriations Act of 2021 , eligible telehealth individuals under Medicare will be able to utilize telehealth for purposes of diagnosis, treatment or evaluation of mental health disorders without the geographic restrictions. This new rule will become permanent after the PHE. This new law also permits beneficiaries to receive telehealth services from their home for purposes of mental health diagnosis, treatment or evaluation (in addition to substance use disorder treatment, which was previously allowed).

There are important stipulations regarding the scope of eligible tele-mental health services. Specifically, eligible patients must have an existing in-person relationship with a provider, as defined by 1 in-person visit with the provider within a 6-month period prior to the telehealth encounter and subsequent periods as determined by the Secretary. However, as written, the bill’s language appears to require the in-person visit regardless of where the patient is located (e.g., home, clinic, doctor’s office) if that location is newly-eligible under the provision (e.g., a doctor’s office in an urban area). This in-person requirement would not apply to any location that is eligible under the previous rules (e.g., eligible originating sites in rural areas). 

Payment for communication technology-based services (CTBS)

Beginning in January, 2019, CMS will reimburse for certain kinds of services furnished remotely using communications technology that are not considered “Medicare telehealth services.” Medicare has labeled these services communication technology-based services, or CTBS. Because they are not defined specifically as telehealth, the limitations and restrictions outlined previously applicable to telehealth would not apply. These services include the following categories:

  • Brief communication technology-based service (or “virtual check-ins”): A brief, non-face-to-face check-in with an established patient via communication technology to assess whether or not an office visit or other service is necessary. This service is only available to practitioners who furnish E/M services, and could take place via live video or telephone call.
  • Remote evaluation of pre-recorded patient information: Remote professional evaluation of patient-transmitted information conducted via pre-recorded video or image technology to determine whether or not an office visit or other service is necessary. This would only be available for established patients.
  • Interprofessional internet consultation: Interprofessional internet consultations between professionals performed via communications technology. This service is limited to practitioners that can independently bill Medicare for E/M visits. This could take the form of either a telephone call or a live or asynchronous internet consultation. Both the consulting and treating provider could be reimbursed for this service.
  • Online Digital/Medical Evaluations (E-Visit): Allows a patient to communicate with a provider through an online patient portal. 

In the 2021 Physician Fee Schedule, CMS clarified that clinical social workers, clinical psychologists, physical therapists, occupational therapists, and speech language pathologists can furnish brief online assessment and management services, virtual check-ins and remote evaluation.

There are other restrictions for when and how these services can be provided. For instance, when the brief communication technology-based service or remote evaluation of pre-recorded patient information originates from a related E/M service provided within the previous 7 days by the same physician or other qualified health care professional, the service would be considered bundled into the previous E/M service and would not be separately billable. 

Likewise, if the service leads to an E/M in-person service with the same provider within 24 hours or the next available appointment it would also be bundled into the pre-visit time. CMS is requiring verbal consent be obtained from the patient for all three of these services, in order to ensure they are aware of any costs they may incur from these services.

How does the remote communication technology services apply to FQHCs and RHCs?

CMS will allow RHCs and FQHCs to receive payment for brief communication technology based services or remote evaluation of pre-recorded patient information services when at least 5 minutes of communications-based technology or remote evaluation services are furnished by an RHC or FQHC practitioner to a patient that has been seen in the RHC or FQHC within the previous year. They also have waived the RHC and FQHC face-to-face requirements for these services. RHCs and FQHCs, however, are not eligible to receive reimbursement for interprofessional internet consultations. For further details, see CCHP’s factsheet on the impact of Medicare’s CY 2019 changes on FQHC/RHCs.

Audio-only services

Although services delivered via audio-only means have been reimbursed throughout the pandemic for certain CPT/HCPCS codes, reimbursement will cease immediately at the end of the pandemic. In the 2021 physician fee schedule, CMS has put in place code C2252 as a temporary code for 2021 and meant to bridge audio only services provided by the telephone evaluation and management calls.

Chronic care management and remote monitoring

In January 2015, CMS created a new chronic care management (CCM) code, which provides for non-face-to-face consultation. Since then, CMS has released several instructional documents on billing the CCM codes, added reimbursement for complex CCM as well as two add-on codes. FQHCs and RHCs are allowed to bill for CCM. Additionally, in the final calendar year 2018 Physician Fee Schedule, CMS unbundled code 99091 allowing providers to get reimbursed separately for time spent on collection and interpretation of health data generated remotely. As is the case with CTBS, by not defining these codes as a “telehealth” service, these services are not subject to the restrictions other telehealth services currently face, such as geographic and location limitations and prohibitions on the use of asynchronous technology in most cases. In the finalized CY 2019 Physician Fee Schedule, CMS added three additional remote physiological codes in order to align with those created by the CPT Editorial Panel. For more information, see CMS’ CY 2019 Physician Fee Schedule, and other resources on the chronic care management codes.

Medicare advantage, APMS, and ACOS

Medicare does offer some exceptions to its geographic and originating site requirements through special programs, including the Next Generation ACO; Shared Savings Program; Episode Payment Models; and Comprehensive Care for Joint Replacement Models. According to the Bipartisan Budget Act of 2018, beginning in 2020, all Medicare two-sided ACOs are able to be reimbursed for telehealth delivered services to the home and be exempt from Medicare’s geographic requirement. CMS has finalized their rule to implement this change in the Shared Savings Program.

Under the Bipartisan Budget Act of 2018, Medicare Advantage (MA) plans are able to (although not required to) offer additional telehealth benefits, without the geographic, site and services restrictions currently imposed by Medicare applying. The list of eligible providers of telehealth services still apply to MA as do state requirements specific to telehealth (for example, if a state requires informed consent prior to a telehealth interaction).

Medicaid & State Policy

Established by legislation in 1965, Medicaid is a medical assistance entitlement program for low-income families. Medicaid is America’s largest medical and health-related funding source for the poor. 

Though the program is jointly funded by federal and state governments, the federal government allows each state to set many features for their programs, including how to structure and adminitier Medicaid telehealth policy. States may reimburse for telehealth under Medicaid so long as the service satisfies federal requirements of efficiency, economy, and quality of care. States are not required to submit a state plan amendment (SPA) when deciding to reimburse for services delivered via telehealth if they are reimbursed the same way/amount as services delivered via face-to-face.

Fifty states, fifty approaches

No two states approach telehealth the same way. Much of CCHP’s work is dedicated to identifying how different Medicaid programs define telehealth, and cataloging the ways those varying definitions influence policies and regulation. Look up states >

Spring 2021 highlights

CCHP’s most recent fifty-state survey of state telehealth laws and Medicaid program policies was completed in Spring 2021. Key findings include: 

  • 50 states and Washington, DC have a definition for telehealth, telemedicine, or both.
  • 50 states and DC provide reimbursement for some form of live video.
  • 22 Medicaid programs provide reimbursement for store-and-forward (S&F). Some states reimburse this modality solely as part of Communication Technology-Based Services (CTBS), which have their own separate codes and reimbursement rates.
  • 26 Medicaid programs provide reimbursement for remote patient monitoring (RPM). Similar to S&F, some states reimburse this modality solely as part of CTBS.
  • 15 states allow audio-only service delivery, although some reimburse this modality solely as part of CTBS.
  • 26 states and DC reimburse services to the home.
  • 27 states and DC reimburse services in the school-based setting. 

You can get the easy-to-read fact sheet summarizing additional recent findings here

Telehealth and private payers

Many private payer insurance plans do reimburse for telehealth-delivered services; however, federal law does not require these payers to provide coverage for any type of telehealth-delivered service. Some states have passed their own private payer laws, affecting private payer plans that operate in those states. Currently, forty-three states and DC have some private payer-related reimbursement laws. Some states mandate some sort of reimbursement, while others mandate reimbursement at the same level as in-person care under certain conditions.

Regulations governing telehealth also vary across states, with limitations on cross-state licensing of health professionals being the most restrictive. Additionally, state health professional boards are releasing special telehealth standards for practitioners in their state. 

Pending telehealth legislation

Each year, new federal and state legislation is introduced to address some of the barriers to telehealth use. On the state level, more than 200 telehealth-related bills were introduced in the 2020 legislative session, the majority of which addressed reimbursement in Medicaid programs and/or among private payers, COVID-19 specific expansions in telehealth policy, established telehealth professional board standards, and addressed cross state licensing. Some legislation also sought to establish telehealth pilot programs to test the efficacy and/or cost effectiveness of telehealth in public programs. Look up pending legislation >

Connectivity & Net Neutrality

Connectivity has always been a significant issue for telehealth. Without robust connectivity, telehealth would not be able to operate effectively and to its fullest capacity. COVID-19 has made more apparent the significant impacts lack of connectivity can have on access to health services. A part of this discussion is lack of net neutrality as it could disrupt consumer access to telehealth-delivered services. 

Under net neutrality, internet service providers would not intentionally slow down, block or charge more for access to specific websites or content; essentially everyone and everything is treated equal. Net neutrality is an issue in telehealth discussions because without a robust connection, telehealth would not work. There is debate that should net neutrality cease to exist, it could disrupt the use and growth of telehealth as connectivity may prove to be too costly for clinics, providers and consumers to access. However, others have argued that telehealth could benefit greatly if it was given priority status.

The Federal Communications Commission (FCC) adopted net neutrality principles in 2005. These principles were challenged in a lawsuit by Verizon and were struck down in January 2014. However, the ruling left it open for the FCC to decide on the next steps on net neutrality. 

In May 2014, the FCC introduced proposals for net neutrality rules. The rules were passed on February 26, 2015 as the Open Internet Order. The rules were challenged in court but the DC Circuit Court of Appeals, the same court that ruled the 2014 case, upheld the FCC’s rules in June 2016.

In November 2017, the new FCC Chairman proposed to repeal the net neutrality rules and the proposal passed in December 2017. The Senate passed a Congressional Review Act (CRA) resolution of disapproval in May 2018 to overturn the FCC’s decision and it is now over at the House. A CRA empowers Congress to review new federal regulations issued by government agencies and with a joint resolution overrule the regulation. The measure failed effectively allowing the FCC repeal to go forward.

However, several states passed net neutrality laws, some of them currently being fought in federal court. As for October 2020, California’s law, one of the most comprehensive net neutrality laws passed, is in federal court facing an attempt by the Department of Justice to block it.

Credentialing & Privileging

Telehealth providers, despite not being physically located at the hospital they are providing services to, must also go through the credentialing and privileging process for that distantly located institution. To credential and privilege a physician can be a lengthy and expensive process, utilizing a good amount of resources. 

Before a practitioner may provide services in a hospital, he or she must have their qualifications evaluated and verified. This process, known as credentialing, ensures an individual possesses the necessary qualifications to provide medical services to patients. Once a practitioner is credentialed, the hospital engages in the privileging process, which will assess the practitioner’s competence in a specific area of care.

Telehealth providers, despite not being physically located at the hospital they are providing services to, must also go through the credentialing and privileging process for that distantly located institution. To credential and privilege a physician can be a lengthy and expensive process, utilizing a good amount of resources. However, hospitals that have limited access to specialists need to contract with practitioners in other locations to provide virtual care to their patients. The alternative is that their patients have to travel to receive that care or go without. Telehealth has helped these institutions provide such services while allowing a patient to remain in his or her community. In the past, hospitals relied on “privileging by proxy” standards that The Joint Commission (TJC), a hospital accrediting organization, have utilized to make the credentialing and privileging process less burdensome on facilities utilizing telehealth. The process allowed the hospital receiving services to accept the distant site (where the telehealth provider is located) hospital’s credentialing and privileging decisions. It cut down on time, duplicative work and expense.

The Centers for Medicare & Medicaid Services (CMS) identified TJC’s privileging by proxy standards as being in conflict with their Medicare Conditions of Participation (CoPs). In order to participate in and receive reimbursement from the Medicare or Medicaid programs, a hospital must be certified as complying with the Medicare CoPs. Therefore, TJC’s process was rendered invalid. This created a difficult situation for many hospitals, particularly small and rural entities who could not afford to hire exclusively on-site specialists to service their communities’ needs.

To resolve this conflict while still maintaining safeguards on quality and safety, CMS approved regulations in July 2011 that would allow hospitals (and other health care organizations) to use a similar credentialing-by-proxy process that the TJC had once utilized. TJC followed suit with similar standards that were approved in December 2011.

The approved process is optional for hospitals to use. Should an institution chose, it may still go through the complete credentialing and privileging process of verifying a practitioner’s qualifications. However, if a hospital wished to utilize the credentialing by proxy process, certain requirements must be met:

  • There must be a written agreement between the two parties;
  • The distant-site hospital is a Medicare-participating hospital or telemedicine entity;
  • The telehealth provider is privileged at the distant-site hospital;
  • A current list of the telehealth provider’s privileges is given to the originating-site hospital;
  • The telehealth provider holds a license issued or is recognized by the state in which the originating-site hospital is located;
  • The originating-site hospital has an internal review of the telehealth provider’s performance and provides this information to the distant-site hospital;
  • The originating-site hospital must inform the distant-site hospital of all adverse events and complaints regarding the services provided by the telehealth provider.

Hospitals do need to ensure that their bylaws meet the requirements of this process. Some organizations may find meeting these necessary requirements prohibitive in time and resources and choose not to utilize this optional process.

The applicable CMS regulations are:

TJC applicable standards:

  • Standard LD 04.03.09 — Care, treatment, and services provided through contractual agreement are provided safely and effectively.
  • Standard MS. 13.01.01 — For originating sites only: Licensed independent practitioners who are responsible for the care, treatment, and services of the patient via telemedicine link are subject to the credentialing and privileging processes of the originating site.
Cross State Licensing & Compacts

The introduction of technology-enabled health care over secure, high-speed broadband connections has made it possible for consultations to occur over distances. While this can contribute significantly to improving access to care, professionally licensed providers in most cases are limited to practicing in the state(s) where they are licensed.

Typically, during a telehealth encounter the originating site (the location of the patient) is considered the “place of service”, and the distant site provider must adhere to the licensing rules and regulations of the state in which the patient is located, even if the distant site provider is not a resident of the patient’s state. The policies governing telehealth and physician licensure vary widely across the country. Some states provide exceptions to allow for cross-border delivery of health care in limited circumstances, while others ban it entirely.

Many telehealth proponents have cited licensing as one of the most significant barriers to the ubiquitous use of telehealth. Currently, medical licensing falls under the purview of each state, leading to the need to secure individual state licenses for multi-state practices. This endeavor can not only be time consuming, but expensive. Providers may find themselves limiting their potential practice areas to a few states, possibly furthering unequal distribution of expertise in the nation.

Current Activities Related to the Cross-State Licensure Barrier

Federal Legislation: State licensing requirements have been identified as a key policy barrier in telehealth. Over the years, several pieces of federal legislation have been introduced to address this. Some legislation attempted to re-define the “place of service” from the originating site (site of the patient) to the distant site (site of provider delivering care). This would resolve the licensing barrier because a provider would then only need to be licensed in the state in which they are physically located in, as opposed to the state of the patient. However, none of these bills have successfully made it through the legislative process and into law. 

Veterans Administration: In 2018, the Department of Veterans Affairs published its final rule to expand the ability of telehealth to more evenly distribute VA providers across regions by preempting state licensing requirements. Under the final regulation, VA health care providers may provide telehealth services, within their scope of practice to VA beneficiaries, irrespective of the State or location within a State where the health care provider or the beneficiary is physically located. The rule does not apply to VA contractors.

COVID-19 Related Licensing Exceptions: Some states have provided licensing waivers or exemptions as a result of the COVID-19 public health emergency in order to provide greater access to care. These waivers are sometimes made in executive orders that apply to a multitude of health care professionals, and other times are waivers for only specific professionals (such as physicians or psychologists). The federation of state medical boards is tracking the COVID-19 licensing exceptions and telehealth-specific licensing waivers through two charts available on their website. Providers should also inquire with the professional board in the state the patient is located to see if there are additional waivers or requirements.

On December 3, 2020, the US Department of Health and Human Services (HHS) issued a fourth amendment to the Declaration Under the Public Readiness and Emergency Preparedness Act (PREP Act) for Medical Countermeasures Against COVID-19. This declaration allows healthcare personnel who are permitted to order and administer a Covered Countermeasure through telehealth can do so for patients in different state so long as the healthcare personnel complies with the legal requirements of the state in which they are licensed or permitted to practice. Covered countermeasures include a qualified pandemic or epidemic product, security countermeasures, drug, biological product or device authorized for emergency use, or a respiratory protected device. Learn more about the PREP Act in our factsheet.

Interstate Compacts: In order to ease the burden of cross-state licensing, some professions have created interstate licensing compacts to make it simpler for professionals to practice across state lines. For a state to participate in a compact, they would need to enact standard legislative language that sets out the ground rules for the Compact. Each compact has its own rules and regulations. There are currently six compacts that CCHP is tracking:

  • Nurse Licensure Compact (NLC): Allows nurses to have one license viable in other compact member states, allowing for a nurse to practice in both 
  • Interstate Medical Licensure Compact: This particular Compact creates an expedited medical licensure process with the goal of allowing physicians to become licensed in multiple states more easily, while protecting patient safety. 
  • The Physical Therapy Compact: Under the Compact, a physical therapist or physical therapist assistant needs to obtain a “Compact Privilege” (the authorization to work in a Compact member state other than the PT or PTA’s home state) in each member state.
  • The Psychology Interjurisdictional Compact (PSYPACT): Gives psychologists in PSYPACT member states the authority to practice interjurisdictional telepsychology in other PSYPACT states. 
  • The Recognition of EMS Personnel Licensure Interstate CompAct (REPLICA): A multi-state compact that extends a privilege for EMS personnel to practice on a short-term, intermittent basis in another member state under certain circumstances. 
  • Audiology and Speech-Language Pathology Interstate Compact (ASLP-IC): Authorizes both telehealth and in-person practice across state lines in ASLP-IC states for audiologists and speech-language pathologists. (Not yet adopted by enough states to be active.)
  • Occupational Therapy Licensure Compact: Allows licensed occupational therapists and occupational therapy assistants to practice across state lines. (Not yet adopted by enough states to be active.)
  • APRN Compact: Allows an advanced practice registered nurse to hold one multistate license with a privilege to practice in other compact states. (Not yet adopted by enough states to be active.)

There are additional Compacts also in development including for Licensed Marriage and Family Therapists, and Licensed Professional Counselors.

Federal Trade Commission: The Federal Trade Commission has also shown interest in examining whether the restrictions on telehealth providers by state licensing boards are anti-competitive. See this section on the Federal Trade Commission website for more information.

Health Information Technology

HIT is used by health care providers to manage patient care and population health through using and sharing health information in a secure system. Electronic health records (EHRs) are included under the umbrella of HIT. 

EHRs automate access to information and have the potential to streamline clinician workflow and support other care-related activities, such as evidence-based decision support, quality management and outcomes reporting. The Office of the National Coordinator for Health Information Technology (ONC) leads the Administration’s HIT efforts.

Some common elements of Health Information Technology (HIT) include:

Electronic Health Records (EHRs): The Health Information Technology for Economic and Clinical Health Act (HITECH) provided the U.S. Department of Health and Human Services (HHS) with the authority to establish programs to improve health care quality, safety, and efficiency through the promotion of health IT, including electronic health records (EHRs) and a private and secure electronic health information exchange.

Additionally, the act worked to update and strengthen existing laws and HIPAA privacy protections to facilitate the secure movement of appropriate information through the health care system.

Under HITECH, eligible health care professionals and hospitals could qualify for Medicare and Medicaid incentive payments when they adopt certified EHR technology and use it to achieve specific objectives. If providers could show they have met a set of criteria, i.e., achieved “meaningful use,” they will receive incentive payments. Providers receiving Medicaid payments had until 2016 to achieve meaningful use or face penalties. Standards for structured data that EHRs must use to qualify for the incentive program were established by CMS and ONC. Providers must use a certified EHR to receive the incentive payment.

An EHR is an electronic version of a patient’s medical history. The EHR may include demographics, progress notes, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The EHR automates access to information and has the potential to streamline the clinician’s workflow. The EHR also has the ability to support other care-related activities directly or indirectly through various interfaces, including evidence-based decision support, quality management and outcomes reporting. 

Meaningful Use: Meaningful use is a set of specific objectives which eligible professionals and hospitals must achieve to qualify for the Centers for Medicare & Medicaid Services (CMS) incentive payments for electronic health records (EHRs). CMS issued specific qualifications that if met will allow providers to show they have achieved “meaningful use.” Each defined stage of achievement has a different focus that typically builds upon what was achieved in the previous stage. Failure to show “meaningful use” results in a reduction in Medicare reimbursement. Penalties began in 2015.

The three stages involved span over five years with a specific focus for each stage:

  • Stage 1 (2011-2012) Data Capture and Sharing
  • Stage 2 (2016) Advance Clinical Processes 
  • Stage 3 (2017) Improved Outcomes 

In 2018 CMS renamed the program the Promoting Interoperability Program and required reporting on Quality Payment Program (QPP) requirements. The shift moved the program beyond meaningful use into a new phase with an increased focus on interoperability and improving patient access to health information. The program objectives include:

  • Immunization Registry Reporting
  • Syndromic Surveillance Reporting
  • Electronic Case Reporting
  • Public Health Registries Reporting
  • Clinical Data Registries Reporting
  • Electronic Reportable Laboratory Test Reporting (for Hospitals only)

Federal Communications Commission (FCC): The Federal Communications Commission (FCC) administers the Healthcare Connect Fund, which directs up to $571 million annually from the Universal Service Fund toward supporting high capacity broadband services, designed to bring the benefits of telehealth to areas of the country in acute need of those services. Additionally, in August 2018 the FCC advanced a proposal for a $100 million pilot fund supporting remote monitoring programs.

The FCC also administers the COVID-19 Telehealth Program, which funds up to $200 million to assist eligible providers to purchase telecommunications services, information services and devices necessary to provide connected care services, both for the treatment of coronavirus as well as other conditions that occur over the course of the pandemic. 

mHealth Laws & Regulations: Mobile health, or mHealth, is a rapidly evolving aspect of technology-enabled health care.

Smart phones and portable monitoring sensors that transmit information to providers, as well as dedicated application software (apps) which are downloaded onto devices, are used in mHealth. Given its recent emergence into the telehealth field, policies governing the use of this technology are continually being shaped.

The Food and Drug Administration (FDA), the Federal Trade Commission (FTC), and the Federal Communication Commission (FCC) all share jurisdiction over some part of the federal regulation of mHealth.

Food and Drug Administration: The FDA has the responsibility of regulating equipment or software intended for use in the diagnosis or treatment of a disease or other condition. With passage of the Food and Drug Administration Safety and Innovation Act in 2012, the FDA was given approval to go forward with its regulatory work on medical apps.

If a device is classified as a medical device, FDA requires registration and listing, premarket notification and/or approval, good manufacturing practices, and post-market surveillance. FDA also regulates the software used in telehealth systems. The FDA does make a distinction and provides guidance on distinguishing what is considered a medical device and what is not.

In February 2015, the FDA issued guidance to provide clarity for mobile medical app manufacturers and other interested parties, which stated the FDA’s intent to exercise enforcement discretion on mobile medical apps that pose a low risk to patients’ safety. Additionally, in February 2015, the FDA also issued guidance stating that it would practice enforcement discretion on medical device data systems (MDDS) devices. MDDS is a device that is intended to transfer, store, convert or display medical device data without controlling or altering the functions or parameters of any connected medical devices. An MDDS may include software, electronic or electrical hardware, modems, interfaces, and a communications portal.

Notably, this definition does not include devices intended to be used in connection with active patient monitoring. For more information, see CCHP’s factsheet on the MDDS and Mobile App guidance.

As a result of the COVID-19 emergency, the FDA has issued guidance relaxing its pre-market certification on certain Class 2 prescription-only connected health tools, such as apps and devices that are designed to treat anxiety, insomnia and other conditions. It has also clarified its rules on low-risk devices aimed at health and wellness.

Federal Trade Commission:  The FTC protects consumers from unfair or deceptive acts or practices as well as false or misleading claims. Where mHealth is concerned, it has focused on the claims companies have made about the effectiveness of their devices or apps. The FTC also has jurisdiction over health data breaches when the entities involved are not HIPAA-covered entities. The FTC has already been active, taking enforcement action against several mobile health app marketers that have not met the requirements of the FTC. The FTC collaborates closely with both the FDA and FCC on areas where there is jurisdictional overlap. In the wake of the COVID-19 public health emergency, FTC staff have submitted a letter to the Centers for Medicare and Medicaid Services in support of its Interim Final Rule that reduces or eliminates restrictive Medicare payment requirements for telehealth during the pandemic.

Federal Communications Commission:  And finally, the FCC regulates devices that utilize electromagnetic spectrum, or broadcast devices. FCC regulates the device as a communications device, not as a medical device. With potential overlapping jurisdictions, the FCC and FDA entered into a Memorandum of Understanding, where they would collaborate with each other within the areas of their respective agencies.

In 2012, the FCC approved its mobile body area network (MBAN), which allocates an electromagnetic spectrum for personal medical devices. The allocated spectrum would be used to form a personal wireless network, within which data from numerous body sensors could be aggregated and transmitted in real time. This dedicated spectrum would allow for faster and more reliable transmission of information from patient monitoring devices to practitioner.

The rapid pace of development of this field and the wide range of applications available on the market today have also been the source of a number of legal and ethical questions regarding their use. Questions are being raised regarding privacy protection. With the vast amount of individual health data being generated by remote monitoring and mHealth devices, determining what are actionable health data, who monitors the data, and where it gets stored are challenges that we will need to address as the field evolves. For an interesting discussion on the subject, read Ethical Issues in mHealth: What is Good Enough? on the South Central Telehealth Resource Center website.

Online Prescribing

Online prescribing, or internet prescribing, refers to a provider prescribing a drug to a patient based upon an interaction that has taken place online. A concern with online prescribing is that the patient-provider relationship is solely established by an online encounter. There must be a patient-provider relationship before a prescription can be written. 

By having all interaction occur online, questions are raised regarding whether the provider has enough information to make an informed decision regarding treatment. Questions include whether adequate information of the patient’s health status and history has been obtained and confirmation that the patient is accurately representing himself or herself. In some states, a patient-provider relationship based solely on internet interactions is prohibited.

Please note: E-Prescribing is the act of a provider sending a prescription electronically to a pharmacy, such as through an EHR, and should not be confused with online or internet prescribing.

The background on internet prescribing

In 2008, the Ryan Haight Online Pharmacy Consumer Protection Act was passed by Congress, which prohibits dispensing controlled substances via the Internet without a “valid prescription.”

For a prescription to be valid, it must be issued for a legitimate medical purpose in the usual course of professional practice, meaning that, with limited exceptions, a doctor must conduct at least one medical evaluation of the patient in person or via telemedicine.

The Act provides a definition for the “practice of telemedicine,” which would allow prescribing to take place even if there was no physical encounter if certain conditions are met. The practice of telemedicine is defined as the practice of medicine by a practitioner who is at a location remote from the patient and is communicating with the patient or health professional treating the patient via a telecommunication system so long as the patient “is being treated by, and physically located in, a hospital or clinic” or “while the patient is being treated by, and in the physical presence of, a practitioner.”

The Drug Enforcement Agency (DEA) is the federal agency responsible for enforcement of the Controlled Substance Act (CSA). Among its duties is overseeing the distribution of controlled substances over the Internet. The Ryan Haight Act of 2008 added to the CSA and placed under DEA jurisdiction controlled substances prescribed via telemedicine.

The onset of the opioid epidemic and potential for telehealth to be used to deliver aspects of Medication Assisted Therapy (MAT) (which combines behavioral therapy and medication to treat opioid use disorder) has sparked some recent interest and legislation aimed at relaxing rules on controlled substances, specifically for methadone and buprenorphine, both controlled substances that can be used in MAT to treat opioid use disorder. In the 2018 legislative session, HR 6, the Support for Patients and Communities Act was signed into law, which requires the Attorney General (AG)to promulgate final regulations to specify the limited circumstances in which a telemedicine special registration may be issued to prescribe controlled substances and the procedure for obtaining a special registration within a year of enactment. The AG was previously required to promulgate regulations related to the telemedicine special registration process under the Ryan Haight Act, but had no deadline as to when a final rule must be issued.

State law & prescribing

States maintain a large amount of control over internet prescribing. Whether a prescription can be written based solely on an internet or online interaction can be impacted in several different ways. One of the primary considerations is whether an online consultation is adequate enough to establish a patient-provider relationship when one did not exist before. Until that relationship is established, a prescription cannot be made. Other requirements that states may place on online prescribing is the need for an in-person physical examination prior to writing a prescription. CCHP provides overview information on this topic per state. 

Exceptions to in-person requirement due to COVID-19

The declaration of a public health emergency (PHE) triggered one of the exceptions in the Ryan Haight Act for telemedicine. The DEA now states that:

For as long as the Secretary’s designation of a public health emergency remains in effect, DEA- registered practitioners may issue prescriptions for controlled substances to patients for whom they have not conducted an in-person medical evaluation, provided all of the following conditions are met:

  • The prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of his/her professional practice
  • The telemedicine communication is conducted using an audio-visual, real-time, two-way interactive communication system.
  • The practitioner is acting in accordance with applicable Federal and State law.

Additionally, the DEA has issued a letter to its registrants stating that a practitioner may conduct an initial evaluation via the use of a telephone for purposes of prescribing buprenorphine (commonly used in medication assisted treatment to treat substance use disorder).

In addition to the federal waiver, some states have taken steps to clarify their requirements for establishing a practitioner/patient relationship as well, while some have also provided for exceptions to in-person requirements as a result of the PHE. We’re tracking COVID-19 related state actions, including those related to prescribing, here.

Informed Consent

While Medicare does not require that an informed consent be obtained from a patient prior to a telehealth-delivered service taking place, a majority of states either require informed consent be obtained within their Medicaid program or in their statute or rules regulating healthcare professionals. 

This may be due to concerns over health information security or ensuring whether the patient fully understands what is to take place. In telehealth, informed consent is used to explain what telehealth is, lay out the expected benefits and possible risks associated with it to a patient, and explain security measures. It often requires a written form which needs to be signed by the patient and/or oral acknowledgement that is noted in the patient’s record.

In many cases, each state has varying informed consent requirements depending on a given profession. Sometimes laws are written in such a way that can be interpreted to mean a healthcare professional must obtain informed consent each and every time telehealth is used, while other laws only require informed consent for the first telehealth visit in a series of visits for the same condition. 

Typically, prior informed consent is reserved for invasive procedures and experimental studies, and not required when a patient is offered a choice in how they wish to receive services. Requiring a prior written or verbal informed consent for any telehealth consultation and treatment misrepresents telehealth as a different form of service, rather than as a useful tool that enhances diagnostic and treatment services.

Sample telehealth informed consent forms can often be accessed by contacting your regional Telehealth Resource Center.

FTC & Professional Licensure Boards

The Federal Trade Commission protects consumers from unfair or deceptive acts or practices as well as false or misleading claims. The FTC has taken several actions in recent years that indicates their increased interest in the manner in which telehealth is being regulated at the state level. 

In March 2016 the FTC sent comments in support of Alaska Senate Bill 74 (now enacted) which allows Alaska licensed physicians located out-of-state to provide telehealth services in the same manner as Alaska licensed in-state providers and allows certain Alaska licensed behavioral health professionals to provide services remotely. The FTC wrote that it believes the bill “would likely increase the supply of telehealth providers, enhance competition, and reduce health care costs, thereby benefiting Alaskans, especially underserved populations with limited access to health care.” 

The FTC also raised concerns in the letter over another aspect of the bill requiring that relevant professional boards adopt regulations establishing special standards of care for physicians and behavioral health practitioners who provide services remotely. The FTC writes, 

“A telehealth provider who has not made a physical examination is already subject to the state’s licensure requirements, including an obligation to meet the state’s existing standard of care. The development of additional ‘safeguards’ solely for telehealth providers might lead to the adoption of unnecessary restrictions that would only serve to restrict competition, and thereby undermine SB 74’s goal of enhancing access to telehealth services.” 

These comments in particular raise the question of whether the actions by many state professional boards to create standards associated with providing care via telehealth could be considered anti-competitive by the FTC.

Additionally, it was an FTC Supreme Court case that became the basis of the argument in a lawsuit in Texas involving the Texas Medical Board and the telehealth provider company, Teladoc (Teladoc, Inc. et al, v. Texas Medical Board). Teledoc alleged that the TX Medical board’s face-to-face consultation requirement illegally limited competition from telemedicine companies, citing the Supreme Court decision in North Carolina Board of Dental Examiners v. Federal Trade Commission (FTC) which ruled that medical boards comprised of private professionals (active market participants) are not exempt from federal anti-trust laws unless there is direct supervision by the state. In response to the case, the FTC released a report in October 2015 clarifying the meaning of an “active market participant” and “active supervision”. Then in Sept. 2016, the FTC, in conjunction with the US Department of Justice, filed an amicus brief urging the U.S. Court of Appeals for the 5th Circuit to reject a motion made by the Texas Medical Board (TMB) to dismiss the suit, which argued that in fact there is direct supervision. Consequently, the TMB withdrew their appeal. The case has since been resolved by compromise legislation (SB 1107) enacted into law in Texas in 2017.

The FTC also commented in 2016 on regulations proposed by the Delaware Occupational Therapy Board.

In February 2018, the FTC submitted a comment letter in response to Washington Substitute Senate Bill 5411/HB 1473. The bill would require licensed ophthalmologist and optometrists to conduct an in-person, comprehensive eye exam before prescribing eyeglasses and contact lenses. The FTC argued that this would restrict a distant site practitioner from using information received via telehealth as the basis for a prescription for a corrective lenses, and raised concerns about it reducing competition, access and consumer choice for eye care as well as potentially raising costs for consumers in the state of Washington. The FTC letter goes into detail on the types of tests needed to issue a prescription for corrective lenses noting that many of them do not typically require an in-person element.

More recently, in June 2020 the FTC submitted a comment letter in response to an Interim Final Rule the Centers for Medicare and Medicaid Services (CMS) released that expanded reimbursement in Medicare during the COVID-19 Public Health Emergency. The comment letter supports the interim rule’s provisions reducing or eliminating restrictive Medicare payment requirements for telehealth and other communication technology-based services. The letter indicates that CMS should use the experience to develop empirical evidence on the effects of these policies to consider whether the changes should be made permanent.

Malpractice

Medical malpractice is the professional negligence by act or omission by a health care provider. Claims of malpractice liability involving telehealth have been few and most existing cases have been settled out of court with the final settlements sealed. However, as telehealth becomes more pervasive, it is likely the number of malpractice suits will increase. 

Malpractice liability

The basic premise of medical malpractice exists whether the service is delivered in-person or via telehealth. Regardless of the modality in which the services are delivered, a provider must be aware that he or she may be subject to the potential of a malpractice suit.

Malpractice insurance

Providers should confirm with their carriers that their current malpractice insurance covers those services provided via telehealth and if the provider is practicing across state lines, that their coverage extends into that other state.

While some malpractice insurance will cover services provided via telehealth, not all carriers operate in the same fashion. Additional coverage may need to be purchased. Providers should ascertain they are adequately covered by their carrier or seek out another if necessary.

Additionally, carriers may not extend their coverage to other states. Due to various reasons such as lack of ceilings to malpractice awards, a provider’s current malpractice carrier may not be able or willing to provide coverage across state lines. Providers should check with their carriers before embarking on providing services outside of their home state.

Providers may also want to consider seeking out some type of cyber liability coverage to protect against data breaches and hacking.

Federal Tort Claims Act

Healthcare providers employed by FQHCs specifically, are covered by the Federal Tort Claims Act (FTCA) coverage, which provides medical malpractice liability coverage to employees and those with a contract with the federal government. FTCA guidance does not directly address the use of telemedicine, but specifies that to meet the FTCA’s requirements for providing services, a patient-provider relationship must be established. This can only be established by an individual accessing care at an approved site, or if health center triage services are provided by telephone or in person (for example, scheduling the patient an appointment). Because it does not address a telemedicine situation directly, it is unclear if coverage applies when the patient is not at the health center when they receive services. The Health Resources Services Administration (HRSA) has indicated they will update this guidance to incorporate telehealth, but as of the writing of this report has not.

HIPAA

Telehealth provision or use does not alter a covered entity’s obligations under HIPAA, nor does HIPAA contain any special section devoted to telehealth. Therefore, if a covered entity is utilizing telehealth that involves personal health information, the entity must meet the same HIPAA requirements that it would if the service was provided in-person. 

Enacted August 21, 1996, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), protects personal health information (PHI). 

In 2000, the US Department of Health and Human Services (HHS) finalized the “Privacy Rule,” (with modifications made in 2002) which addresses the use and disclosure of individuals’ health information, and provides standards for individuals’ privacy rights under HIPAA. The Health Information Technology for Economic Clinical Health (HITECH) Act of 2009 created or clarified provisions that impacted HIPAA. 

Only certain parties, called “covered entities,” are subject to HIPAA. These entities include:

  • Health plans
  • Health care providers
  • Health care clearinghouses
  • Business associates 

Telehealth provision or use does not alter a covered entity’s obligations under HIPAA, nor does HIPAA contain any special section devoted to telehealth. Therefore, if a covered entity is utilizing telehealth that involves PHI, the entity must meet the same HIPAA requirements that it would if the service was provided in-person. 

Telehealth does often require consultation with technical personnel, independent of the medical team, who may be exposed to patient data. Therefore, providers may need to enter into business associate agreements with these technical personnel organizations, which obligate them to maintain the same confidentiality required of the provider under HIPAA. 

The entity will also need to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability, of PHI. While there are some specifications, each entity must assess what are reasonable and appropriate security measures for their situation.

Use of specific telehealth equipment or technology cannot ensure that an entity is “HIPAA compliant” because HIPAA addresses more than features or technical specifications. Nevertheless, certain features may help a covered entity meet its compliance obligations. For example, a telehealth software program may contain an encryption feature, or the technology might provide security through the use of passwords. However, these examples only provide elements or tools to help a covered entity meet its obligations under HIPAA; they do not ensure compliance and cannot substitute for an organized, documented set of security practices.

Check out our HIPPA fact sheet for more information.

Enforcement discretion during COVID-19

The Office for Civil Rights (OCR) in the Department of Health and Human Services has released guidance stating that they will exercise enforcement discretion and waive penalties for HIPAA violations that serve patients in good faith through everyday communication technologies, such as FaceTime or Skype, during the COVID-19 public health emergency. It should be noted that many states also have laws and regulations regarding health information and what is required to protect and secure it. This will likely not impact those state laws and regulations. A separate state action will be necessary.