Telemedicine Regulations: State-by-State Compliance Guide (2026)

A patient logs on from their living room in Texas. Their doctor is based in California. The visit takes ten minutes. But the legal trail that follows? That can stretch across two states, multiple rule sets, and a stack of compliance questions your front desk was never trained for.

Telemedicine has grown fast. What used to be a niche option is now a standard part of how many practices operate. And with that growth came a web of rules that are not always easy to navigate.

Telemedicine regulations by state do not move in lockstep. What is allowed in one state may require a separate license, a prior in-person visit, or a different consent form in another.

The stakes are real. A missed licensing step can put your practice at risk. A gap in your prescribing process can trigger a board complaint. A weak privacy setup can lead to a HIPAA violation. Most of these problems are avoidable with the right knowledge.

This guide was built for medical practices that want clear, practical answers. It covers federal rules, state licensing, prescribing restrictions, informed consent, payer policies, malpractice, privacy laws, and more.

You will also find a compliance checklist and a breakdown of requirements for some of the most populous states. Whether you are just starting with virtual care or expanding across state lines, this guide gives you a solid foundation to work from.

Federal Telemedicine Regulations Overview

Before you look at state rules, it helps to know what sits above them. Federal law sets a baseline that applies no matter where your patients are located. These rules cover prescribing, privacy, coverage, and oversight. Getting them right is step one.

Key Federal Laws That Govern Telehealth

Several federal laws shape how virtual care works across the country. Each one targets a different part of the process, from how you write prescriptions to how you store patient data.

The Ryan Haight Act and DEA Prescribing Rules

The Ryan Haight Act requires providers to conduct at least one in-person visit before prescribing controlled substances via telemedicine. The Drug Enforcement Administration (DEA) enforces this rule at the federal level.

During the COVID-19 public health emergency, the DEA issued temporary exemptions that allowed remote prescribing without a prior visit. As those waivers wind down, many providers are adjusting their workflows to stay in line with the original requirements.

The DEA has also proposed a special telemedicine registry that would let qualified providers prescribe certain controlled substances remotely, even without an in-person visit. This is still evolving, so checking current DEA guidance before prescribing controlled substances via video is always the right move.

HIPAA and the 21st Century Cures Act

HIPAA sets the standard for how protected health information (PHI) must be handled during a telehealth visit. Your platform must meet HIPAA requirements for telehealth, which means end-to-end encryption, signed business associate agreements with vendors, and secure data storage. Using a consumer-grade app like FaceTime or Zoom without a HIPAA-compliant setup puts your practice at risk.

The 21st Century Cures Act added another layer by pushing for better data sharing and interoperability between systems. For telehealth practices, this means patients should have easier access to their own records, and your systems should work with other platforms when needed. If you rely on an EMR, connecting it to your telehealth tools helps you meet this standard more easily.

Medicare Telehealth Coverage

Medicare has its own rules for what qualifies as a covered telehealth visit. For years, patients had to be in a rural area to qualify. The COVID-19 emergency expanded that significantly, and Congress extended several of those flexibilities. As of 2026, many of those expansions are still in effect, but they are subject to change. You should verify current Medicare telehealth coverage rules before assuming a visit will be reimbursed.

Medicare requires that covered telehealth services appear on an approved list, and that visits be conducted using interactive audio and video technology. Audio-only visits have limited coverage under Medicare, so knowing your patient's setup before the appointment matters.

FTC and FDA Roles in Telehealth

The Federal Trade Commission (FTC) watches over how telehealth companies market their services. Misleading claims about outcomes or privacy protections can attract FTC scrutiny. The Food and Drug Administration (FDA) plays a role when telehealth involves prescription drug dispensing or connected medical devices. If your practice uses remote monitoring tools or digital diagnostics, FDA guidelines may apply.

State Licensing and Interstate Practice

One of the biggest challenges in virtual care is making sure you are licensed where your patient is, not just where you are. Telemedicine licensing follows the patient's location, not the provider's. That one rule has major implications for any practice seeing patients across state lines.

How State Medical Board Jurisdiction Works

Each state's medical board governs who can practice medicine within its borders. When you see a patient via video, the care is considered to be delivered in the state where the patient is sitting, not where you are. This means you need a valid license from that state to provide care legally.

This rule catches many providers off guard, especially those who work near state borders or see patients who have moved. It applies even to single follow-up visits. One video call with a patient who relocated to another state can put you in violation if you are not licensed there.

Interstate Medical Licensure Compact (IMLC)

The Interstate Medical Licensure Compact (IMLC) was created to make multi-state licensing faster and less expensive. It allows eligible physicians to apply for licenses in multiple states through a single process. As of 2026, more than 40 states participate in the compact. Providers must hold a primary state of licensure that is also a compact member to be eligible.

The IMLC does not remove the requirement to hold a license in each state where you practice. What it does is simplify the application process significantly. Instead of going through each state's full board application separately, you submit one application and designate the states where you want to practice. Approval timelines vary, but the process is generally faster than applying to each state individually.

Costs and Complexity of Multi-State Licensing

Even with the IMLC, telemedicine licensing across multiple states has real costs. Each state charges its own licensing fee, and those fees vary widely. Annual renewal requirements, continuing education hours, and documentation demands add up quickly for providers with large telehealth panels.

Some practices hire a credentialing specialist to manage the process. Others use software platforms that track expiration dates and renewal deadlines.

Nurse practitioners, physician assistants, and other advanced practice providers face their own licensing rules. Not all of these professions are covered by interstate compacts, though the Nurse Licensure Compact (NLC) does exist for registered nurses and LPNs. If your telehealth team includes multiple license types, you will need to track compliance for each role separately.

Licensure Portability Efforts

There is ongoing advocacy at the federal level for broader licensure portability, which would allow providers to see patients across state lines with a single national license. As of 2026, no federal law has passed to mandate this, but proposals continue to move through Congress. Following these developments through your state medical association or the American Telemedicine Association can help you stay ahead of any changes.

Prescribing Regulations by State

Prescribing rules are one of the most variable parts of telemedicine laws. What you can prescribe, how you can prescribe it, and whether you need a prior visit all depend heavily on the state. Getting this wrong puts both your license and your patient at risk.

Controlled Substances and Prior Visit Requirements

At the federal level, the Ryan Haight Act requires at least one in-person visit before prescribing Schedule II through V controlled substances via telemedicine. Many states have added their own layers on top of this. Some states require a prior in-person visit for all prescriptions, not just controlled substances. Others allow an audio-visual visit to count as the initial encounter.

The variation is significant. Texas, for example, previously required an in-person visit before any telemedicine prescription could be written. That rule was later revised to allow established patient-provider relationships to qualify. Checking each state's current rules matters because these telemedicine laws continue to change.

State Prescription Drug Monitoring Programs

All 50 states now have prescription drug monitoring programs (PDMPs). These are state-run databases that track controlled substance prescriptions. Most states require providers to check the PDMP before prescribing an opioid or other controlled substance. Some states require checking it for all Schedule II through V drugs, even via telehealth.

PDMPs are a key tool in addressing overprescribing and drug diversion. When you see a patient via video, you should still follow your state's PDMP rules. Telehealth does not exempt you from this requirement. In fact, prescribing controlled substances without checking the PDMP can result in disciplinary action.

E-Prescribing Requirements

Most states now require or strongly encourage electronic prescribing (e-prescribing). For controlled substances, federal law under the SUPPORT Act and many state laws now mandate e-prescribing for Schedule II and III drugs. This is especially relevant for telehealth providers, since paper prescriptions are not practical in a virtual setting. Your electronic health record or telehealth platform should support electronic prescribing for controlled substances if you plan to prescribe them remotely.

Prescribing Variation at a Glance

The table below summarizes how a sample of states approach telemedicine prescribing rules. Always verify current state law, as these rules change often.

Note: This table is for general reference only. State laws change frequently. Always consult current state board guidance or legal counsel before prescribing.

Informed Consent Requirements

Informed consent is a core part of any medical visit. In telehealth, it takes on added meaning because patients are accepting a mode of care that comes with its own limits and risks. Both federal and state rules shape what you need to cover and how you need to document it.

What Federal Standards Require

Federal guidelines do not prescribe a single consent form for telehealth, but they do require that patients understand they are receiving care via technology. This includes knowing what platform is being used, what data is being collected, and what happens if the connection drops or the visit cannot be completed.

CMS has offered guidance on consent requirements for Medicare telehealth visits, which include informing patients of their right to refuse telemedicine and receive in-person care instead.

HIPAA also plays a role. Patients must be given a Notice of Privacy Practices, which should reference how their PHI is used during telehealth visits. If you are using a new platform or vendor, updating your privacy notice to reflect that is a good practice.

Written vs. Verbal Consent

Some states require written informed consent before a telehealth visit. Others accept verbal consent that is documented in the patient's chart. A handful of states require that consent be obtained at each visit, not just at enrollment. Knowing which rule applies in your patient's state is important. Getting this wrong does not automatically mean malpractice, but it can complicate your defense if a complaint is filed.

A practical approach is to default to written consent even when verbal consent is legally sufficient. Written consent creates a clear record, reduces ambiguity, and is easier to document in your EMR. If your practice uses digital intake forms, building telehealth consent into that workflow makes the process seamless.

What Must Be Disclosed to Patients

Regardless of state requirements, strong informed consent for telehealth should cover several key areas. Patients should know who they are speaking with and that provider's credentials. They should understand the limitations of a virtual exam compared to an in-person visit. They should also be told how to reach emergency services if needed, since a provider on a video call cannot call 911 on a patient's behalf.

Consent should also cover data privacy. Patients have a right to know if the session is being recorded, who can access that recording, and how long it will be stored. These are not just best practices. In many states, they are virtual care legal requirements.

State-Specific Consent Rules

Several states have specific telehealth consent laws that go beyond federal guidelines. California requires that providers give patients information about the limitations of telehealth and the right to in-person care. Texas requires written consent for telemedicine visits and has specific language requirements for mental health services. New York requires providers to document that consent was obtained before each telehealth encounter.

If your practice spans multiple states, maintaining a flexible consent form that meets the strictest state requirements in your patient pool can reduce compliance risk. Review your consent process any time you expand into a new state.

Reimbursement and Parity Laws by State

Getting paid for telehealth visits is not as simple as billing the same codes you use for in-person care. Reimbursement rules vary by payer, by state, and by service type. Knowing how your state handles telemedicine parity can have a big impact on your revenue.

What Telehealth Parity Laws Cover

Telehealth parity laws require private insurers to reimburse covered telehealth services at the same rate as in-person visits. The idea is that if a service is covered in person, it should also be covered when delivered via video. But parity laws are not uniform. Some states mandate only coverage parity (the insurer must cover the service), while others require payment parity (the insurer must pay the same rate).

As of 2026, more than 40 states have some form of telehealth parity law. However, the scope of these laws varies widely. Some apply only to certain types of services or providers. Others exclude Medicaid or self-funded employer plans, which fall under federal ERISA rules and are not subject to state insurance mandates.

Medicaid Telehealth Coverage by State

Medicaid is run jointly by the federal government and each state, which means coverage rules differ significantly from state to state. During the COVID-19 public health emergency, most states expanded their Medicaid telehealth coverage to include more services and provider types. Some states have made those expansions permanent. Others rolled them back.

Key variables include whether a state covers audio-only visits under Medicaid, which provider types can bill for telehealth, and whether there are limits on the number of telehealth visits covered per year. Federally qualified health centers and rural health clinics have their own telehealth billing rules under Medicaid, which adds another layer of complexity.

Medicare Telehealth Reimbursement

Medicare telehealth rules are federal, but they affect practices in every state. Medicare currently covers telehealth services delivered via real-time audio and video. Originating site requirements (the location of the patient) and distant site requirements (the location of the provider) both affect eligibility. The flexibilities put in place during the public health emergency extended many telehealth benefits, including allowing patients to receive telehealth from their homes.

Medicare payment rates for telehealth are generally the same as in-person rates for equivalent services. However, only services on Medicare's approved telehealth list qualify.

If you are billing a service that is not on that list, the claim will likely be denied. Checking the CMS telehealth services list before adding new services to your virtual care menu is a good practice.

State-by-State Reimbursement Snapshot

The table below gives a high-level view of how several major states handle telehealth reimbursement through private insurers and Medicaid.

Note: This table reflects general trends as of 2026. Payer policies and state Medicaid plans change frequently. Verify current coverage rules with each payer directly.

Standard of Care and Malpractice Considerations

Delivering care via video does not lower the bar for what is expected of you clinically or legally. The standard of care in telemedicine is the same as in person, and failing to meet it carries the same risks. Understanding your exposure is part of running a safe and compliant telehealth practice.

What Standard of Care Means in Telehealth

The standard of care is defined as what a reasonably competent provider would do in the same situation. In telehealth, that standard accounts for the limitations of a virtual exam.

You cannot listen to a patient's lungs through a screen, but you are still expected to recognize when a patient needs to be referred for an in-person evaluation. Knowing the limits of what telemedicine can diagnose and treating them accordingly is a key part of meeting the standard.

Courts and medical boards have generally applied the same standard of care to telehealth as to in-person visits. If a patient suffers harm from a missed diagnosis that would have been caught in person, you may still be held responsible for not flagging the need for further evaluation. Document your clinical reasoning clearly, especially when a visit ends without a definitive diagnosis.

Malpractice Insurance for Telehealth

Not all malpractice insurance policies cover telehealth. Some policies have exclusions for care delivered outside the state where you are based. Others may require a rider or endorsement for virtual care. Before seeing your first telehealth patient, review your policy and speak with your carrier to confirm you are covered in every state where your patients are located.

Tail coverage is another consideration for providers who leave a practice or change employers. If your telehealth coverage was tied to an employer policy, you may need to purchase your own policy to cover any claims that arise from past visits. This is the same issue that exists with in-person care, but the multi-state nature of telehealth can complicate it further.

Documentation Best Practices

Good documentation is your best defense against a malpractice claim. Every telehealth visit should include a note that describes what was assessed, what the limitations of the virtual exam were, what was prescribed or recommended, and what follow-up was arranged. If a patient declined a referral for in-person care, document that clearly. If the connection quality was poor and affected your assessment, note that as well.

Your documentation should also reflect that informed consent was obtained, that the patient's location was confirmed, and that the appropriate license was in place for that state. These details may seem minor during a routine visit, but they become important if a complaint is ever filed.

Risk Management in Telemedicine

Good risk management starts with patient selection. Not every patient or condition is appropriate for telehealth. High-acuity situations, complex physical exams, and cases where you cannot adequately assess the patient remotely should be redirected to in-person care. Having a clear policy for when to refer a patient for an in-person visit protects both the patient and your practice.

Staff training is another layer of protection. Everyone on your team who interacts with telehealth patients should understand the consent process, know how to handle technical failures, and be trained on what to do if a patient appears to be in crisis. Well-trained staff reduce liability and improve patient outcomes.

Privacy and Security Regulations

Privacy is not optional in telehealth. Every virtual visit involves protected health information moving across networks, stored in systems, and accessed by vendors. Knowing which laws apply and how to meet them is essential for any compliant telehealth practice.

HIPAA Compliance for Telehealth

HIPAA applies to all covered entities, including medical practices that use telehealth. The HIPAA Security Rule requires that electronic protected health information (ePHI) be protected through administrative, physical, and technical safeguards. In practical terms, that means your telehealth platform must use encryption, access controls, and audit logs.

The HIPAA Privacy Rule governs how PHI is used and disclosed. During a telehealth visit, this means not sharing patient information with anyone who is not involved in the patient's care without the patient's consent. It also means training staff on proper handling of patient data and conducting regular risk assessments of your systems.

Business Associate Agreements

Any vendor that handles ePHI on your behalf is considered a business associate under HIPAA. This includes your telehealth platform, your EMR, and any third-party tools you use for scheduling or communication. You are required to have a signed business associate agreement (BAA) with each of these vendors before they access any patient data.

When evaluating telehealth tools, asking vendors for their BAA and reviewing it before signing up is a must. Some platforms market themselves as HIPAA-compliant but do not offer a BAA, which means you cannot legally use them for telehealth visits. Curogram, for example, is built for healthcare communication and offers a compliant setup that supports this requirement.

State Privacy Laws

On top of HIPAA, many states have passed their own privacy laws that impose additional requirements. California's Consumer Privacy Act (CCPA) gives patients the right to know what data is being collected about them and to request that it be deleted.

While CCPA primarily targets businesses, healthcare organizations that also function as employers or that collect non-PHI consumer data may be subject to it.

Other states with notable privacy laws include Virginia, Colorado, and Texas. These laws vary in their scope and requirements, but they share a common theme: patients have more rights over their data than ever before. Staying current on state privacy laws is especially important if your practice operates in multiple states.

Recording and Data Retention

Recording telehealth visits raises specific legal and ethical questions. Many states have two-party consent laws that require all parties to agree before a call can be recorded.

California, for example, requires explicit consent from all parties before recording a conversation. If you plan to record any telehealth visits for clinical or training purposes, make sure your consent process covers this clearly.

Data retention rules vary by state and by the type of record. Most states require that medical records be kept for a minimum of seven to ten years.

Electronic records from telehealth visits are subject to the same retention rules as any other medical record. Make sure your platform stores data in a way that allows you to meet these requirements and produce records if they are requested by a patient, a payer, or a court.

State-Specific Regulation Highlights

While federal rules set the foundation, state-specific rules often determine what your day-to-day telehealth practice actually looks like. The states below represent the most populous markets, and each has its own approach to telemedicine compliance.

California

California has some of the most detailed state telehealth regulations in the country. The Telehealth Advancement Act requires that telehealth services meet the same standard of care as in-person services. Informed consent must include information about the limitations of telehealth.

The state has strong parity laws that cover both coverage and payment rates for private insurers. California also has expanded Medi-Cal (Medicaid) telehealth coverage, including audio-only visits for certain services.

California's CCPA adds a layer of data privacy responsibility on top of HIPAA. Practices operating in California should review their data handling practices to ensure they meet both federal and state standards.

Texas

Texas updated its telemedicine laws significantly after legal challenges to prior in-person visit requirements. The Texas Medical Board now allows telehealth for established patients without requiring a prior in-person visit.

However, written informed consent is required before each telemedicine encounter. Prescribing rules in Texas follow both state and federal guidelines, with specific restrictions for mental health medications and controlled substances.

New York

New York telehealth regulations require providers to document informed consent before each virtual care visit. The state has a strong parity law and broad Medicaid telehealth coverage.

New York also requires that telehealth platforms meet state-specific security standards, which go beyond HIPAA in some areas. Mental health telehealth is a particularly active area in New York, with ongoing regulatory updates from the Office of Mental Health.

Florida

Florida's virtual care laws are provider-friendly in several ways. The state allows out-of-state providers to deliver telehealth services to Florida patients under certain conditions, without requiring full Florida licensure.

However, providers must register with the Florida Department of Health and follow state practice standards. Florida also has a payment parity law for private insurers and broad Medicaid telehealth coverage.

Other Key States

Illinois has strong telehealth parity laws and Medicaid coverage that includes mental health and substance use services via video.

Ohio requires licensure in the state for providers treating Ohio patients, and Medicaid telehealth is subject to managed care plan rules.

Georgia has more limited telehealth parity requirements and stricter rules around audio-only visits.

Arizona has broad parity coverage and is a member of the IMLC, making it easier to add Arizona licensure to a multi-state practice.

Common Themes and Outliers

Across these states, a few themes emerge. States with strong consumer protection cultures, like California and New York, tend to have more detailed consent and privacy rules.

States with rural populations, like Arizona and Texas, have often pushed for broader telehealth access to address care gaps. The outliers tend to be states that have not yet passed parity laws or that still require in-person visits for specific conditions. Knowing which category your target states fall into helps you plan your compliance approach.

Compliance Checklist for Telemedicine Practices

A strong telehealth program does not just follow the rules today. It builds systems to stay compliant as those rules change. The checklist below covers the core areas every telemedicine practice should review regularly. Use it as a starting point for your own internal audit.

Licensing and Credentialing

Licensing is the first line of defense in any telehealth compliance review. Gaps here can expose your practice to board complaints, denied claims, and legal liability.

• Provider holds a valid license in the state where each patient is located
• Licenses are tracked for renewal dates across all active states
• Interstate compact memberships are current and documented
• All staff credentials are verified and on file

Patient Consent and Communication

Consent is both a legal requirement and a patient rights issue. Your consent process should be clear, documented, and easy for staff to carry out consistently.

• Telehealth-specific informed consent obtained before each visit (per state rules)
• Consent is documented in the patient's chart
• Patients are informed of their right to in-person care
• Recording consent is obtained where required by state law

Prescribing and Clinical Protocols

Prescribing errors are one of the most common compliance risks in telemedicine. Clear protocols reduce the chance of a mistake.

• Prescribing follows state and federal rules for controlled substances
• PDMP is checked before prescribing controlled substances
• E-prescribing is used for all controlled substance orders
• Prior in-person visit requirement is met where applicable

Documentation and Records

Complete, accurate documentation protects patients and providers alike. Every visit should leave a clear clinical record.

• Visit notes include assessment, limitations of virtual exam, and follow-up plan
• Patient location confirmed and documented at each visit
• Refusal of in-person referral is documented when applicable
• Records retained per state-specific minimum retention periods

Technology and Security

Your technology stack is only compliant if it is configured and maintained correctly. A one-time review is not enough.

• Telehealth platform meets HIPAA requirements for telehealth
• Business associate agreements are signed with all vendors handling patient data
• Access controls and audit logs are enabled in all clinical systems
• Staff are trained on data security and breach response protocols

Insurance and Liability

Coverage gaps can be costly. Verifying your malpractice and liability setup is a critical but often overlooked step.

• Malpractice insurance explicitly covers telehealth services
• Coverage extends to all states where patients are seen
• Tail coverage is in place for departed providers who previously conducted telehealth visits

Billing and Reimbursement

Billing errors in telehealth are common and can trigger audits. A clean billing process starts with understanding each payer's rules.

• Telehealth codes are used correctly for each payer
• Services billed are on Medicare's approved telehealth list (where applicable)
• Parity law status is verified for each private insurer you work with
• Medicaid billing rules reviewed for each state in your patient panel

Staff Training and Policy Review

Compliance is a team effort. Regular training and policy reviews keep everyone aligned.

• All staff trained on telehealth consent and privacy procedures
• Clinical staff trained on telehealth-specific documentation standards
• Compliance policies reviewed at least quarterly
• Regulatory changes are tracked and reflected in updated policies

Conclusion 

Telemedicine regulations by state are complex, but they are not unmanageable. The key is building systems that keep your practice compliant without slowing down your ability to care for patients.

Understanding the federal baseline, knowing which state rules apply to each patient, and maintaining clean documentation and licensing records are the three pillars of a solid compliance strategy.

The rules covered in this guide touch nearly every part of your telehealth operation. Licensing follows the patient, not the provider. Prescribing rules vary widely by state, with controlled substance requirements that go beyond what federal law alone requires.

Informed consent must reflect both what your patients are agreeing to and the specific requirements of the state they are in. Reimbursement depends on knowing each payer's rules, and malpractice coverage must be verified for every state in your patient panel.

Privacy and security are not one-time setup tasks. They require ongoing attention as your vendor relationships, platform configurations, and state privacy laws evolve. The compliance checklist in this guide gives you a practical tool to review your setup regularly, not just when you launch a new service line or expand into a new state.

Staying current is arguably the hardest part. Telehealth policy continues to shift at both the federal and state level. Building a review process, connecting with professional associations, and working with healthcare legal counsel when needed are the habits that separate practices that stay ahead of compliance issues from those that get caught off guard.

Virtual care has real potential to improve access and outcomes for patients across the country. Doing it right, with proper licensing, clear documentation, and a commitment to patient privacy, is what makes that potential sustainable.

The regulations can feel like a barrier, but they exist for good reasons. Meeting them is not just a legal obligation. It is part of delivering care that patients can trust.

If you are building or growing a telehealth practice, the right tools make compliance easier. Curogram's patient communication platform is designed to work within healthcare workflows and supports HIPAA-compliant messaging, digital consent forms, and two-way texting that integrates with your existing EMR. 

Request a free demo to explore how Curogram can support your virtual care operations.

Frequently Asked Questions