Key Legal and Regulatory Issues with Telehealth

By John Domeika

Providing healthcare services through telemedicine is regulated by a myriad of evolving federal and state laws. The complexity of governmental requirements begins with what is considered telemedicine—an evolving concept that will differ among licensing jurisdictions.

A practitioner’s telemedicine services will generally require compliance with federal and state laws as if

the practitioner provides the services in an in-person setting, but may include additional requirements

that apply in the telehealth setting. This article focuses on three areas: licensure, privacy and security, and prescribing authority. 

LICENSURE

State licensure laws will apply as there is no nationwide license for telemedicine. With limited exceptions, states require practitioners who treat patients through telemedicine to be licensed in the state of the physical location of the patient at the time of service. A physician practicing in a state through telehealth is subject to the state’s medical practice act and all medical board regulations and policies.

Becoming licensed in several states to perform telemedicine is an arduous application process that is somewhat mitigated by the Interstate Medical Licensure Compact (IMLC), a group of 34 states, Washington, D.C. and Guam, that seek to streamline the application process (www.imlcc.org). However, please note that the IMLC process still requires a practitioner to obtain licensure from each state’s medical board in which the practitioner seeks to provide telemedicine services and to pay the applicable licensing fee. 

If a practitioner provides healthcare services in a state without that state’s license, the practitioner can be subject to disciplinary action. Additionally, any negative complaint against a practitioner is required to be reported to each state participating in the IMLC.

PRIVACY AND SECURITY

Practitioners must also comply with all privacy and security laws (state and federal, such as HIPAA) in a telemedicine setting to generally the same extent that apply when examining or treating a patient in person. 

The telemedicine technology platform and all patient records and information must be stored, preserved, and secured in compliance with all applicable requirements as in any other setting. Covered healthcare providers who seek additional privacy protections for telehealth while using video communication products should provide such services through technology vendors that are

HIPAA-compliant and will enter into HIPAA business associate agreements in connection with the provision of their video communication products. 

Additionally, patient records originating from a telemedicine setting must adhere to ONC’s Cures Act Final Rule requirements that a patient must have immediate access to his or her medical records.

PRESCRIBING

The authority to prescribe controlled substances originates from the practitioner’s state of licensure regardless of the patient setting. Before COVID-19, prescriptions for a controlled substance issued by means of telemedicine were generally predicated on an in-person medical evaluation (21 U.S.C. 829(e)). 

However, during the designated public health emergency, DEA-registered practitioners may issue prescriptions for all schedule II-V controlled substances to patients for whom they have not conducted an in-person medical evaluation, provided all of the following conditions are met:

• The prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of his/her professional practice;

• The telemedicine visit with the patient is conducted using an audio-visual, real-time, two-way interactive communication system; and

• The practitioner is acting in accordance with applicable federal and state laws. Practitioners must be registered with the DEA in at least one state and have permission under state law to practice using controlled substances in the state where the dispensing occurs.

Regardless of whether a public health emergency exists, if the prescribing practitioner previously conducted an in-person medical evaluation of the patient, the practitioner may issue a prescription for a controlled substance after having communicated with the patient via telemedicine, or any other means, so long as the prescription is issued for a legitimate medical purpose and the practitioner is acting in the usual course of his or her professional practice.

John Domeika is General Counsel at COPIC.