Telehealth Compliance Post-PHE: Where the Rules Landed in 2026

Telehealth compliance post-PHE is governed by four overlapping authorities: the CMS Medicare telehealth framework at 42 CFR § 410.78, the DEA's Ryan Haight Act framework at 21 CFR § 1306.04 and the active telemedicine flexibility extensions, the ONC interoperability and certification standards, and state telehealth practice and consent statutes. Most practices comply with one and miss the other three.

What the rules actually require for a telehealth program

The PHE expired on May 11, 2023. The flexibilities did not all expire on the same date. The post-PHE landscape sorts into four buckets, and a telehealth program needs a defensible position in each.

Medicare coverage. 42 CFR § 410.78 defines telehealth services, originating sites, and the modality (synchronous audio-video). Geographic and originating-site restrictions were waived during the PHE and extended through statutory language tied to subsequent Consolidated Appropriations Acts. As of 2026, behavioral and mental telehealth is permanently expanded (no geographic restriction; patient's home an eligible originating site); most other Medicare telehealth flexibilities run under congressional extensions through December 31, 2027 per HHS-published guidance, and absent further legislation revert to the pre-PHE framework after that date. The current Medicare Telehealth Services List, updated annually, controls which CPT/HCPCS codes are billable.

Controlled-substance telemedicine. The Ryan Haight Online Pharmacy Consumer Protection Act, codified at 21 USC § 829(e), requires an in-person medical evaluation before a controlled substance can be prescribed via the internet, with seven enumerated exceptions including the practice-of-telemedicine exception. DEA and HHS announced the fourth temporary extension on January 2, 2026, running the pandemic-era telemedicine flexibility from January 1 through December 31, 2026 (see the DEA Diversion Control rule page). The DEA's proposed Special Registration for Telemedicine framework is the long-term solution. Verify current status at DEA Diversion Control before relying on telemedicine controlled-substance prescribing.

HIPAA and platform. The OCR Notification of Enforcement Discretion permitting non-public-facing consumer video applications (FaceTime, Skype, etc.) during the PHE was rescinded effective August 9, 2023. Practices must use HIPAA-compliant platforms with executed BAAs, end-to-end encryption, and audit logging. The underlying Privacy and Security Rules at 45 CFR Parts 160 and 164 apply identically to telehealth and in-person encounters.

State practice and consent. Telehealth is practiced where the patient sits. Provider licensure, scope of practice, consent requirements, and prescribing rules follow the patient's location, not the provider's. State telehealth statutes added since 2020 add specific consent, modality, and documentation requirements that federal law does not preempt.

The documents you must maintain

A telehealth program audit binder should produce:

• Active state medical license for every provider in every state where patients are seen
• IMLC, PSYPACT, NLC, or comparable compact registrations where used
• DEA registration matched to a practice location for any controlled-substance prescribing
• HIPAA-compliant platform vendor BAA, with end-to-end encryption confirmation
• Telehealth informed-consent document, signed at the first telehealth encounter and re-affirmed at the practice-defined interval (annually is typical)
• Identity and location verification documentation in every telehealth encounter
• Emergency protocol per patient location (nearest ED, emergency contact, escalation path)
• Modality documentation in the encounter note (synchronous AV vs. audio-only)
• State-specific telehealth consent forms where state law requires a separate written acknowledgement (California Business and Professions Code § 2290.5, Texas Occupations Code § 111.002)
• Billing documentation matched to the encounter modality, with the correct POS (02 or 10) and modifier (95 or 93)

How telehealth audits actually work

The auditing entities in telehealth fall into three buckets:

1. OIG and CMS program-integrity reviews. The OIG Work Plan has called out telehealth billing patterns repeatedly since 2022. OIG audits sample telehealth claims for documentation matching the billed code, modality matching the place-of-service, and patient location matching state-licensure requirements.

1. DEA inspections of controlled-substance telemedicine. When a telemedicine controlled-substance prescription is filled by a pharmacy that questions it, the chain often ends at the prescriber's DEA registration. Inspectors will ask for the telemedicine flexibility documentation (which extension, which patient encounter), the patient identity and location verification, and the clinical rationale supporting the 21 CFR § 1306.04 legitimate-medical-purpose finding.

1. State medical board complaints. Patient complaints about telehealth care almost always go to the state board where the patient sits. The board will ask for the consent documentation, identity verification, and proof of state licensure or compact registration.

What we have seen drive telehealth enforcement, in order:

• Provider not licensed in the patient's state at the time of service. This is often discovered only after a complaint.
• Place-of-service mismatch on the claim — billing POS 02 for a patient who was actually at home (POS 10 since the 2024 update).
• Modifier 95 used on an audio-only encounter without the modifier-93 designation where audio-only is permitted.
• Telehealth consent documented once at intake and never refreshed, even after the practice's own policy required annual re-consent.
• Controlled-substance prescription issued under a telemedicine flexibility that expired before the encounter.

Common gaps unique to telehealth

The gaps we see most often:

• Multi-state expansion without a credentialing matrix tracking license status per provider per state
• BAA on file with the platform vendor but expired or superseded by a vendor reorganization
• Encryption confirmed at platform signup but not re-verified after a major platform release
• Emergency protocol stale or generic, not tied to the patient's actual location
• Audio-only encounters billed without documentation of why audio-only was appropriate (patient lack of camera, technical failure)
• Notes that do not document the modality (a chart note that reads identically to an in-person encounter, with no notation that this was video)
• Vendor changes (platform switches, scheduling-tool changes) without a BAA refresh

Maintenance cadence

• At every telehealth encounter: Verify provider licensure in patient's state, verify patient identity and physical location, document modality, document consent at first encounter or per the practice's reaffirmation interval.
• Monthly: Sample telehealth claims for POS and modifier accuracy. Review denials for telehealth-specific patterns.
• Quarterly: Re-verify BAA status for the telehealth platform vendor and any ancillary vendors (scheduling, document signing, payment processing) that touch PHI.
• Annually: Review the CMS Medicare Telehealth Services List for changes; update the practice's billable-telehealth-codes list. Refresh state telehealth statute review for each state the practice serves.
• At every DEA extension expiration: Re-confirm the practice's reliance on the current DEA telemedicine flexibility. Schedule the review to expire 60 days before the flexibility expires, so the practice has time to adjust.

State preemption to watch

Telehealth state rules are the wildest carve-out in U.S. healthcare regulation. The biggest divergences in 2026:

• California: Business and Professions Code § 2290.5 requires verbal or written informed consent for telehealth, documented in the chart. Under Cal. Health & Safety Code § 11165.4, CURES PDMP query is required at the first prescription of any Schedule II–IV controlled substance and at least every six months thereafter for ongoing therapy. Mandatory e-prescribing for all controlled substances.
• Texas: Occupations Code § 111 governs telemedicine practice; the Texas Medical Board rules at 22 TAC Chapter 174 add documentation and prescribing-by-modality requirements. Defined practitioner-patient-relationship requirements separate from federal Ryan Haight.
• Florida: Telehealth providers must register with the Florida Department of Health if located outside Florida and serving Florida patients (the Out-of-State Telehealth Provider Registration). E-FORCSE PDMP query at first controlled-substance prescription.
• New York: I-STOP query at every controlled-substance prescription regardless of modality. EPCS mandatory.
• Massachusetts and the New England states: Generally aligned with the Interstate Medical Licensure Compact; consent rules vary by board.

A telehealth program serving more than three states without a state-by-state policy matrix is a documentation gap waiting to surface in audit.

How d3rx fits

The d3rx compliance binder produces a telehealth section that names the platform BAA, the state-by-state license tracker, the telehealth informed-consent template, the encounter documentation template (identity, location, modality), and the emergency-protocol-per-location framework. Each element is sourced to the underlying federal or state statute. See the compliance binder overview for the broader binder structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.