Telemedicine requirements come from several owners at once. State boards license the clinician, the DEA controls remote prescribing of controlled substances, CMS sets Medicare coverage and claim coding, and HHS enforces HIPAA. A telemedicine service has to satisfy each of them on every visit.
This guide sorts those requirements by owner at the federal level, marks the points where state law takes over, and turns each requirement into a check a product or operations team can test before launch.
What requirements does a telemedicine service have to meet?
Turning telemedicine rules into product requirements?
Agnotic designs licensure routing, consent records, prescribing controls and claim logic into the telemedicine platforms it builds for clients.
A telemedicine service has to meet five sets of requirements: authority to practice in the patient's state, documented patient consent, DEA and state rules for remote prescribing, Medicare and payer billing rules such as place of service and modifiers, and HIPAA safeguards backed by a business associate agreement with each vendor handling PHI.
Accessibility is a sixth requirement for many organizations. Federal accessibility rules reach a large share of providers, so patient-facing web and app screens should be designed and tested for accessibility from the first release, not retrofitted.
Accessibility work is cheapest in the design system. Color contrast, focus order, captions for video and screen reader labels on the join button are easier to build once than to fix screen by screen.
Which licensure rules apply to a telemedicine visit?
Licensure follows the patient: the clinician generally needs authority to practice in the state where the patient is physically located during the visit. There is no federal telemedicine license, so each state's law decides which licenses, compact privileges or telehealth registrations count.
- Medicare: Medicare telehealth also rests on state licensure, because Medicare pays only a practitioner whom state law licenses to furnish the service.
- Compacts: Interstate compacts for physicians, nurses and other professions shorten the path to practicing in several states, under rules each compact publishes for its member states.
- Telehealth-only registrations: Some states let out-of-state clinicians register for telehealth only. Florida is one example, with its own eligibility, insurance and notice conditions, covered in the Florida guide linked below.
- Controlled substances: A clinician who prescribes controlled substances also needs a DEA registration, and state controlled-substance law applies on top of it.
In software, licensure becomes a lookup at the start of every visit. The patient's current location is compared against each clinician's active state authorities, which live in a credentialing table with expiry dates and a named owner.
Credentialing data goes stale quietly. Licenses expire, compact privileges lapse and telehealth registrations follow their own renewal cycles, so the table needs alerts for upcoming lapses and a rule that removes a clinician from routing the day an authority ends.
What consent does telemedicine need?
Consent rules for telemedicine come mostly from state law and payer policy, with Medicare adding consent requirements for specific services. Capture consent as a structured record with the date, method and scope, so it can be produced for an auditor or a payer later.
- State telehealth consent: Many states set their own informed consent rules for telehealth, so the consent text and method follow the state where the patient is located.
- Medicare remote services: CMS expects documented patient consent for some remote services, such as remote physiologic monitoring, so the consent step belongs in the enrollment flow rather than the first visit.
- Audio-only: Medicare allows audio-only for a telehealth service to a patient at home when the practitioner can use video but the patient cannot use, or does not want, video. Record that reason with the visit.
- Recording: Consent to record a session is a separate decision from consent to treatment, and state recording laws may add their own terms.
Store consent once per scope, not once per screen. A patient who consents to RPM has not consented to session recording, and the data model should keep those apart.
Visits with minors, or with patients who have a legal representative, need consent from the person with authority under state law. The consent record should name who consented and in what capacity.
What are the federal rules for prescribing by telemedicine?
Federal prescribing rules matter mainly for controlled substances. Federal law generally requires an in-person medical evaluation before a controlled substance is prescribed over the internet, and the current telemedicine flexibilities suspend that requirement for a limited time.
- Temporary flexibility: Until 31 December 2026, the fourth temporary rule from the DEA and HHS allows Schedule II to V prescribing over audio-video telemedicine, and audio-only prescribing of certain FDA-approved opioid use disorder medications, with no prior in-person evaluation.
- Electronic prescribing: Controlled-substance e-prescriptions need two-factor authentication when the practitioner signs, so the signing step needs its own identity design and device enrollment.
- State limits: State law can be stricter than the federal flexibility. Florida, for instance, limits Schedule II prescribing by telehealth to a few listed situations.
- Other medications: Prescribing non-controlled drugs by telemedicine is governed by state practice and pharmacy law and the standard of care, not by the federal controlled-substance rules.
A platform that prescribes controlled substances needs a switch for the day the flexibility ends. If no further extension is issued, the in-person evaluation rule returns, and prescriptions for new patients must stop or route to an in-person visit.
How does Medicare pay for telemedicine visits?
Medicare pays for services on its telehealth list when they run over real-time, two-way audio and video, with audio-only allowed in limited home cases. Claim coding then records the patient's setting and the visit's modality.
- Location flexibilities: The Consolidated Appropriations Act, 2026 (H.R. 7148) keeps Medicare telehealth available to patients at home and outside rural areas through 31 December 2027.
- Place of service: A claim for a patient at home carries POS 10 and one for any other location carries POS 02.
- Modifiers: 95 marks an audio and video visit and 93 an audio-only one. Payment follows the place of service, not the modifier.
- After 2027: Unless Congress acts again, the older location limits return for many services, so claim rules need effective dates.
- Other payers: Medicaid programs and commercial plans set their own telehealth coverage and coding rules, which differ by state and plan.
Derive these codes from visit data rather than asking clinicians to pick them. The patient's reported location sets the place of service, and the session's modality events, including any drop to audio-only, set the modifier.
Test the coding with real scenarios before launch: a home visit that drops to audio-only, a visit from a clinic room, and a patient who reports a location no clinician is licensed for. Each one should produce a different claim or stop at routing.
What does HIPAA require of a telemedicine platform?
HIPAA requires a telemedicine platform used by a covered provider to protect ePHI with the Security Rule's administrative, physical and technical safeguards, and every vendor that stores or transmits that ePHI for the provider needs a business associate agreement. The pandemic-era relief for everyday video tools has ended, so the full rules apply.
- Technical safeguards: Unique user IDs, an emergency access procedure, audit controls and authentication are required. Encryption of stored and transmitted ePHI is addressable, so the team either encrypts or writes down the reasoning for an alternative.
- Business associates: Video, messaging, transcription and hosting vendors that create, receive, maintain or transmit ePHI for the provider are business associates, including a cloud host that cannot view the data.
- Audio-only guidance: HHS OCR has published guidance on providing audio-only telehealth consistent with the Privacy, Security and Breach Notification Rules.
- Non-HIPAA apps: When a consumer health app is not a covered entity or a business associate, HIPAA does not reach it, and the FTC's Health Breach Notification Rule applies instead.
- Multi-factor authentication: HHS has proposed making MFA required under the Security Rule. It is not required today, but it is good practice for clinician and admin accounts.
Telemedicine creates ePHI stores that an office visit does not: session recordings, chat transcripts, uploaded photos and device readings. Each one belongs in the HIPAA risk analysis with its own access rule and retention period.
A pre-launch telemedicine requirements checklist
Run this checklist with product, credentialing, billing and compliance owners before the first patient visit. Each line is a requirement that can be tested, not a policy statement.
- Licensure table: Every clinician's state licenses, compact privileges and telehealth registrations, with expiry dates and an owner in credentialing.
- Location capture: The patient's current location recorded at the start of each visit and used for routing and coding.
- Consent records: Treatment, recording and service-specific Medicare consent stored separately with date and method.
- Prescribing rules: The DEA flexibility end date, two-factor EPCS signing and each state's schedule limits held as configuration.
- Claim logic: Place of service and modality modifier set from visit data, with an effective date for the end-2027 Medicare deadline.
- Vendor register: Every vendor that touches ePHI, each with a signed business associate agreement.
- Risk analysis: The HIPAA risk analysis updated for the telemedicine data flows and vendors.
- Accessibility: Patient-facing web and app screens tested with screen readers, keyboard navigation and captions before launch.
- Downtime path: A written fallback for failed video, such as switching to audio-only with its modifier or rebooking, linked to the organization's HIPAA contingency plan.
- State review: A summary from counsel of the telehealth rules in each state where patients are located.
How Agnotic can help
Every requirement in this guide ends up as data, a rule or a test in the platform. Agnotic Technologies builds those pieces into the client's telemedicine service: the credentialing table and location routing, consent records by scope, prescribing controls with configurable dates, and claim coding derived from visit events.
The client's compliance and legal teams decide how each rule applies to their care model. Agnotic implements those decisions with an audit trail and test cases, so a new state or a changed federal date is a reviewed update rather than a rewrite.
Build a telemedicine service that meets its requirements
Read how Agnotic approaches telemedicine platform builds, or continue with more articles in our Telehealth hub.
Related reading on Agnotic
Continue with Florida telehealth law, platform architecture, software choices, EHR integration and the benefits of virtual care.
