Telehealth Rules for Therapists in 2026: A Practical Guide to Licensure, HIPAA, Consent, Documentation, and Billing
Aug 5, 2026
For many therapists, telehealth has moved from being an emergency adaptation to becoming a permanent part of clinical practice. The difficult question in 2026 is no longer whether psychotherapy can be delivered remotely. It is how to structure a telehealth practice so that clinical judgment, licensure, privacy, documentation, reimbursement, and emergency procedures remain aligned.
That distinction matters because there is no single "telehealth rule" in the United States. A therapist may simultaneously be subject to federal privacy requirements, state professional licensing law, payer-specific rules, professional standards, informed-consent requirements, and rules governing practice across state lines. These layers do not always change at the same pace.
For behavioral health professionals, the most important practical principle remains straightforward: telehealth does not remove the therapist from the regulatory framework governing in-person practice. It adds another layer to it. State requirements for behavioral health professionals continue to apply to telehealth, while cross-state practice may require a full license, temporary authorization, reciprocity, telehealth registration, or participation in an interstate compact depending on the jurisdictions involved.
The result is that a therapist who can legally see a client in an office cannot automatically assume that the same client can be treated remotely from another state, another country, or even another location within the therapist's own state.
For a practice operating in 2026, telehealth compliance is therefore best approached as a clinical workflow, rather than as a single consent form or software setting.
The Most Important Telehealth Rule: Know Where the Client Is
One of the most consequential pieces of information in a telehealth session is not the client's diagnosis or the appointment time.
It is the client's physical location at the time of service.
This becomes particularly important when a client travels.
A client who normally receives therapy from their home in one state may spend two weeks visiting family elsewhere. From a clinical perspective, the session may appear identical. From a regulatory perspective, it may not be.
State laws differ regarding the circumstances under which an out-of-state clinician can provide telehealth to a person physically located in that state. Some jurisdictions have telehealth registration systems or temporary practice provisions; others may require a full license or rely on specific exceptions. Interstate compacts can also create pathways for eligible professionals, but participation does not eliminate the need to understand the compact's requirements and the laws of the state in which the patient is located.
This makes patient-location verification an important part of routine telehealth workflow.
A therapist should not treat the question "Where are you today?" as casual conversation. It is part of determining whether the clinician can legally provide the service.
A practical workflow might be:
"Before we begin, can you confirm the address or location where you are physically located today?"
The exact wording can be adapted to the practice, but the process should be consistent.
This is particularly important for practices that serve clients who travel frequently, college students, military families, executives, seasonal residents, or clients who relocate between states.
Cross-State Teletherapy: A License in One State Is Not Automatically a License Everywhere
Cross-state practice is one of the areas in which therapists can make significant assumptions.
A clinician licensed in State A may not automatically have authority to provide psychotherapy to a client physically located in State B.
There are several mechanisms through which interstate practice may become permissible:
holding a license in the client's state;
temporary practice provisions;
reciprocity;
telehealth-specific registration;
interstate licensure compacts;
other state-specific exceptions.
The applicable mechanism depends on the profession and jurisdictions involved. Federal guidance specifically identifies these different pathways and emphasizes that cross-state telehealth rules vary.
For psychologists, PSYPACT is particularly relevant because it provides an interstate pathway for eligible psychologists to practice telepsychology across participating jurisdictions. It should not, however, be generalized to every behavioral health profession.
The practical implication for therapists is important:
Do not use another clinician's interstate practice arrangement as evidence that your own arrangement is legal.
A psychologist, clinical social worker, professional counselor, marriage and family therapist, and psychiatrist may be subject to different rules.
Telehealth Consent: More Than a Checkbox
Telehealth consent is often treated as an administrative formality. Clinically, it should be more meaningful than that.
A well-designed telehealth consent process should help the client understand what is different about receiving treatment remotely and what limitations follow from the medium.
Depending on applicable law and professional requirements, the practice may need to address matters such as:
the nature of telehealth;
potential limitations of remote treatment;
privacy risks;
technology interruptions;
alternative methods of communication;
emergency procedures;
circumstances requiring transition to in-person care;
patient responsibilities regarding privacy;
relevant billing arrangements.
State-specific requirements may dictate additional elements.
Importantly, therapists should distinguish between consent to treatment and consent to telehealth. They address overlapping but not identical issues.
A client may consent to psychotherapy while still needing to understand and agree to the particular risks and procedures associated with remote delivery.
What Should Happen When the Connection Fails?
A telehealth practice needs a plan for technology failure before technology fails.
A session should not depend entirely on a single video platform remaining operational for 53 minutes.
The therapist should establish in advance:
What happens if video fails but audio continues?
What happens if the entire connection drops?
Will the therapist call the client?
Which phone number should be used?
How long will the therapist wait before attempting another connection?
How will the therapist document the interruption?
When should the session be rescheduled?
This becomes particularly important during high-risk clinical encounters.
For example, if a client discloses active suicidal intent immediately before the video connection fails, "we'll reconnect when the internet comes back" is not an adequate emergency protocol.
The clinician needs a predetermined method of maintaining contact.
HIPAA and Telehealth in 2026
HIPAA remains central to telehealth compliance, but it is important to understand what HIPAA actually requires.
HIPAA does not simply mean "use a HIPAA-compliant video platform."
The Privacy Rule requires covered entities to implement reasonable safeguards for protected health information. In telehealth, this extends to the physical and technological environment in which communication occurs.
Current federal guidance specifically addresses audio-only telehealth and explains that covered entities can use remote communication technologies for audio-only services when the applicable HIPAA requirements are satisfied. Providers are expected to use reasonable safeguards to protect privacy, including conducting sessions in private settings when feasible.
This has practical implications for both clinician and patient.
A therapist conducting a session from a shared home office may need to consider:
who can hear the conversation;
whether headphones are appropriate;
whether notifications appear on screen;
whether documents are visible behind the clinician;
whether smart speakers or other devices could create privacy concerns;
whether another household member can enter unexpectedly.
The same principle applies to the client.
A therapist cannot control the client's physical environment completely, but can establish expectations.
For example:
"Because we're discussing confidential information, I'd like to make sure you're somewhere you can speak privately. If someone enters the room during the session, please let me know."
This is a clinical communication, not merely an IT instruction.
Telehealth Platforms: What Therapists Should Actually Evaluate
Choosing a platform based on whether it advertises itself as "HIPAA compliant" is not enough.
The practice should consider the entire information flow.
Questions include:
Is the platform designed for healthcare use?
Is a Business Associate Agreement available when required?
Where are recordings stored?
Are sessions automatically recorded?
Can participants record locally?
How are transcripts handled?
Is audio retained?
Who can access administrative metadata?
How long is information retained?
What happens when an account is deleted?
How are passwords and authentication handled?
Does the platform integrate with the EHR?
Does it expose patient information through notifications or email?
What happens if a third-party AI feature processes session content?
The last question is increasingly important.
A therapist may use a telehealth platform for video while separately using transcription, AI documentation, scheduling, messaging, and storage systems. HIPAA compliance therefore cannot be evaluated solely at the level of the video call.
The entire technology stack should be considered.
Telehealth and Psychotherapy Notes
Telehealth does not change the fundamental distinction between ordinary clinical documentation and separately maintained psychotherapy notes.
Under HIPAA, psychotherapy notes receive special protection when they meet the regulatory definition and are maintained separately from the medical record. Routine information such as diagnosis, treatment plan, symptoms, prognosis, treatment modality, frequency, and session information is not automatically considered a psychotherapy note simply because it relates to psychotherapy.
This distinction matters when therapists use digital systems.
A clinician should know whether a platform is storing:
the clinical note;
a transcript;
an AI-generated summary;
private process notes;
metadata;
an audio recording.
These are not necessarily interchangeable from a privacy or documentation perspective.
For practices using AI-assisted documentation, the therapist should also understand where session information is processed, what is retained, and whether the technology vendor's contractual and privacy arrangements are appropriate for the intended use.
Documentation Standards for Telehealth Sessions
Telehealth documentation should demonstrate that the clinician knew they were conducting a remote service and exercised appropriate clinical judgment.
The exact documentation requirements depend on the jurisdiction, payer, profession, and service.
A clinically useful telehealth note may include information such as:
modality used;
whether the encounter was synchronous video or audio-only;
patient location;
clinician location when relevant;
relevant consent information;
significant technology disruptions;
clinical observations;
interventions;
risk assessment;
disposition or follow-up plan.
The purpose is not to create an enormous telehealth-specific note.
It is to ensure that the record accurately reflects what happened.
For example, if the clinician conducted the entire session by video but the client experienced a brief connection failure during a safety discussion, documenting the interruption and how contact was re-established may be clinically relevant.
Telehealth Risk Assessment Requires a Different Level of Preparation
One of the most important clinical differences between in-person and remote psychotherapy concerns environmental control.
In an office, the therapist knows where the client is.
In telehealth, the therapist may not.
That becomes highly relevant when risk escalates.
Before beginning treatment, the therapist should have enough information to establish:
the client's current address;
an emergency contact when appropriate;
local emergency resources;
relevant crisis contacts;
a reliable telephone number;
procedures for loss of contact;
procedures for situations in which the therapist believes the client is in imminent danger.
This information should be maintained in a way that is accessible during the session.
The therapist should not discover the client's physical address for the first time when a crisis occurs.
A Telehealth Emergency Plan Should Be Operational, Not Merely Documented
A policy stating "call emergency services if necessary" is not the same as an emergency protocol.
Consider a client who says:
"I have taken the pills. I don't think I can stay awake."
Then the connection drops.
The therapist needs to know:
Where is the client?
What emergency service covers that location?
Can the client be reached by phone?
Who else is physically nearby?
Is there an emergency contact?
What information can legally and ethically be disclosed to facilitate emergency intervention?
Who will make the call?
What happens if the client stops responding?
These questions should be addressed before a crisis occurs.
Telehealth therefore requires location-aware risk management.
Telehealth for High-Risk Patients
Telehealth is not inherently inappropriate for patients with significant clinical risk.
The relevant question is whether the treatment arrangement provides a reasonable framework for managing that risk.
Factors to consider include:
severity and immediacy of risk;
history of suicide attempts;
access to lethal means;
psychosis;
intoxication;
cognitive impairment;
environmental instability;
availability of support;
ability to maintain reliable communication;
geographic distance from emergency resources;
patient's ability to participate safely.
For some patients, telehealth may actually improve continuity because treatment remains accessible when transportation, disability, geography, or other barriers would otherwise interfere.
For others, the absence of physical proximity may make certain levels of risk harder to manage.
The clinical decision should therefore be individualized rather than based on a blanket rule that telehealth is either appropriate or inappropriate for high-risk patients.
Audio-Only Therapy in 2026
Audio-only telehealth remains particularly relevant in behavioral health.
Video is not always clinically or practically superior. Patients may lack reliable broadband, experience technical problems, have privacy limitations, or feel more comfortable speaking without video.
Federal HIPAA guidance confirms that audio-only telehealth can be provided in compliance with HIPAA when applicable safeguards are implemented.
Medicare policy is also particularly important for behavioral health. Current federal telehealth policy states that Medicare behavioral and mental health services can permanently be delivered through audio-only communication, while other telehealth flexibilities have different expiration dates and conditions.
However, therapists should not assume:
Medicare allows audio-only → every payer allows audio-only.
Commercial insurers, Medicaid programs, and individual state programs may impose different requirements.
The reimbursement question therefore needs to be checked separately from the clinical and legal question.
Medicare Telehealth Rules for Behavioral Health in 2026
Medicare telehealth underwent several important policy changes and extensions during 2026.
Behavioral health has received more permanent treatment than many other categories of telehealth. Current federal guidance states that Medicare beneficiaries can continue receiving behavioral and mental health telehealth from home, and that certain behavioral health telehealth flexibilities have been made permanent. It also states that marriage and family therapists and mental health counselors can permanently serve as Medicare distant-site providers.
For clinicians serving Medicare beneficiaries, this is significant because Medicare telehealth policy is not identical across all medical specialties.
A therapist should therefore distinguish:
general Medicare telehealth rules
from
Medicare behavioral-health-specific rules.
CMS continues to maintain a specific 2026 telehealth services list and related billing guidance, and reimbursement should be verified against the applicable service, provider eligibility, setting, and current payer requirements.
Telehealth Billing: Don't Assume That "Telehealth" Is One Billing Category
Billing for remote psychotherapy involves several separate questions.
First:
Is the service clinically and legally permissible via telehealth?
Second:
Does the payer cover that telehealth service?
Third:
What coding and modifier requirements apply?
Fourth:
What place-of-service requirements apply?
Fifth:
Does the patient's plan impose additional restrictions?
These questions are related but not interchangeable.
A therapist may be legally allowed to provide a telehealth session while a particular payer does not reimburse the service under the same conditions.
Likewise, a service may be reimbursable by one insurer but subject to different requirements under another.
The practice should therefore avoid building its entire billing workflow around assumptions formed during the COVID-era expansion of telehealth.
The 2026 Controlled-Substance Exception: Why Therapists Should Care
This issue is primarily relevant to psychiatrists and other authorized prescribers rather than non-prescribing therapists, but it matters for multidisciplinary behavioral-health practices.
Federal telemedicine flexibilities for prescribing controlled medications have been extended through December 31, 2026. Under the current temporary extension, eligible DEA-registered practitioners can prescribe Schedule II–V controlled substances through telemedicine without a prior in-person medical evaluation when the applicable conditions are satisfied. There are additional provisions for certain Schedule III–V medications used in the treatment of opioid use disorder, including audio-only pathways under specified circumstances. This is important because therapists working in integrated practices may coordinate care with psychiatrists or other prescribers.
However, the temporary federal flexibility does not eliminate:
state prescribing law;
DEA requirements;
professional scope-of-practice rules;
documentation requirements;
applicable controlled-substance regulations.
A psychiatrist should therefore treat the federal extension as one component of the regulatory framework, not as blanket permission for unrestricted remote prescribing.
Telehealth and State-Specific Consent Requirements
Federal rules are only part of the picture.
States can impose additional requirements involving:
telehealth consent;
patient location;
provider location;
emergency planning;
documentation;
prescribing;
technology;
professional liability;
reimbursement.
This is why a national article can explain the framework but cannot responsibly provide one universal consent form that satisfies every state.
For a therapist practicing across several states, the operational challenge becomes maintaining a state-specific compliance matrix.
For example:
Issue | State A | State B | State C |
|---|---|---|---|
Therapist license | Required | Compact pathway | Telehealth registration |
Telehealth consent | Specific requirement | General consent | Specific requirement |
Cross-state practice | Restricted | Permitted under conditions | Registration required |
Audio-only | Specific rules | Permitted | Payer-dependent |
Emergency procedure | Required | Professional standard | Specific requirement |
The exact contents will vary, but the concept is valuable.
Instead of attempting to memorize dozens of rules, the practice maintains a current operational reference.
International Travel Is a Separate Problem
A particularly common mistake is assuming that interstate rules also answer international questions.
They do not.
A therapist licensed in the United States may encounter additional legal issues when treating a client who is temporarily located in another country.
The clinician may need to consider:
whether the foreign jurisdiction considers the activity to constitute practice of a regulated profession;
local registration or licensing;
privacy laws;
data-transfer requirements;
professional liability coverage;
emergency access;
malpractice policy exclusions.
The fact that the client is normally located in the therapist's licensed state does not automatically resolve the legal question.
For practices serving frequent international travelers, this deserves a clearly defined policy.
Telehealth and Professional Liability
Malpractice coverage should explicitly be evaluated for telehealth.
The therapist should verify whether the policy covers:
telehealth services;
patients located outside the therapist's home state;
interstate practice;
international sessions;
audio-only encounters;
services delivered through specific technologies.
A clinician may be legally permitted to conduct a particular telehealth encounter but still discover that their insurance policy does not provide the expected coverage.
This is one of the reasons telehealth compliance should involve not only the licensing board and payer but also the professional liability carrier.
When Telehealth May Not Be the Best Clinical Format
Telehealth should not become the default merely because it is convenient.
There are clinical situations in which an in-person encounter may provide information or containment that is difficult to reproduce remotely.
Examples can include:
rapidly deteriorating psychiatric status;
severe intoxication;
acute behavioral dysregulation;
significant cognitive impairment;
situations where privacy cannot be maintained;
inability to establish reliable location;
repeated technology failures;
situations requiring immediate physical assessment;
circumstances in which the clinician cannot adequately assess or manage risk remotely.
The appropriate response is not necessarily immediate termination of telehealth.
A therapist may instead transition the client temporarily or permanently to an in-person setting, involve another provider, increase the level of care, or develop a more appropriate hybrid treatment structure.
Telehealth Policies Every Private Practice Should Have
A mature telehealth practice should ideally have written policies covering more than consent.
At minimum, consider policies addressing:
Patient location
How and when location is verified.
Technology failure
What happens when video or audio stops working.
Emergency situations
How the therapist responds to acute safety concerns.
Privacy
What the therapist expects regarding the patient's environment.
Recording
Whether sessions may be recorded and under what circumstances.
Communication outside sessions
How clients should use phone, portal messaging, email, or text.
Interstate travel
What happens if the client is temporarily located elsewhere.
International travel
Whether the practice permits sessions while clients are outside the United States.
Audio-only sessions
When they are clinically appropriate and whether payer requirements permit them.
Transition to in-person care
When telehealth may no longer be clinically appropriate.
These policies should be integrated into the actual workflow rather than placed in a document that neither therapist nor patient ever revisits.
A Practical Telehealth Pre-Session Checklist
For clinicians who want a simple operational workflow, the following checklist can be more useful than a lengthy policy manual.
Before beginning the session, verify:
1. Patient identity
Confirm that you are speaking with the intended patient.
2. Current location
Confirm where the patient is physically located.
3. Privacy
Establish that the patient can communicate with reasonable privacy.
4. Technology
Confirm that the connection is functioning sufficiently for clinical communication.
5. Emergency information
Ensure that the patient's location and relevant emergency information are accessible.
6. Clinical appropriateness
Consider whether telehealth remains appropriate given the patient's current presentation.
7. Documentation
Record relevant telehealth information in the clinical record.
The purpose is not bureaucracy for its own sake.
The checklist reduces the probability that a critical issue is discovered only after the session has already begun.
A Sample Telehealth Opening Script
A therapist does not need to sound like a compliance officer at the beginning of every session.
A concise clinical workflow can sound natural:
"Before we get started, I want to confirm a couple of things. Where are you physically located today? And are you somewhere you can speak privately? If we lose the connection, I'll first try to reconnect through the video platform, and if that doesn't work I'll call the number we have on file. Does that still work for you?"
This takes very little time but establishes several important elements of the telehealth framework.
For higher-risk clients, the therapist may need a more explicit emergency procedure.
Common Telehealth Compliance Mistakes
Assuming the client's usual location is sufficient
It is not. The client may be traveling, and the legal framework may change with the client's physical location.
Treating HIPAA compliance as a software purchase
A compliant platform does not make an otherwise inappropriate telehealth workflow compliant.
Using one consent form for every state
State requirements vary. A national template may need state-specific modifications.
Forgetting emergency planning
A therapist should not wait for the first crisis to determine how emergency intervention will work remotely.
Assuming Medicare rules apply to commercial insurance
They do not.
Assuming interstate compacts eliminate all licensing questions
Compacts provide specific pathways for eligible professionals; they do not create unrestricted nationwide practice.
Ignoring audio-only requirements
Audio-only treatment may be clinically appropriate but can have different payer and regulatory requirements.
Allowing clients to travel internationally without a policy
International telehealth introduces a separate legal and professional-risk analysis.
Treating telehealth as clinically identical to office treatment
The therapeutic modality may be similar, but the environmental and risk-management variables are different.
How to Build a Telehealth Compliance System for a Growing Practice
A solo clinician can manage many of these requirements manually. A group practice needs a more formal system.
One useful approach is to create three layers.
Layer 1: Universal practice policy
These are rules that apply to every telehealth client, such as:
identity verification;
location verification;
technology failure;
privacy expectations;
emergency procedures;
documentation standards.
Layer 2: State-specific rules
Maintain a current matrix covering each jurisdiction in which clinicians provide services.
Layer 3: Payer-specific rules
Maintain information about Medicare, Medicaid, and commercial insurers separately.
This structure prevents one common problem: confusing legal permission to provide telehealth with payer permission to reimburse telehealth.
They are different questions.
Conclusion
Telehealth in 2026 is best understood as a mature form of clinical practice rather than an emergency substitute for office-based therapy.
The fundamental obligations remain familiar: practice within scope, protect patient information, document appropriately, maintain clinical standards, obtain meaningful consent, and respond appropriately to risk. What changes is the operational environment in which those obligations have to be fulfilled.
For therapists, the most important variables are usually patient location, licensure, state-specific telehealth requirements, privacy safeguards, emergency planning, documentation, and payer rules. Federal policy provides an important framework, but it does not eliminate state-level variation.
The strongest telehealth practices therefore do not rely on a single consent form or a "HIPAA-compliant" video platform. They build a repeatable system in which the therapist knows where the patient is, whether treatment is legally permissible there, how privacy is protected, what happens if technology fails, how emergencies will be managed, and how the encounter will be documented and billed.
For clinicians practicing across multiple states, that system becomes even more important. Interstate compacts and other authorization pathways can expand access, but they should be treated as tools within a broader licensing strategy rather than as blanket permission to practice nationwide.
Ultimately, good telehealth compliance should be almost invisible during a normal session. The therapist should be able to focus on the clinical work because the regulatory and operational questions have already been built into the practice workflow.
FAQ
Is telehealth legal for therapists in all 50 states?
Telehealth is permitted in some form throughout the United States, but the requirements for providing therapy vary by state and profession. A therapist generally needs to determine whether they are authorized to practice where the patient is physically located at the time of the session.
Does a therapist need to be licensed in the state where the client is located?
Not always. Some states provide temporary practice provisions, telehealth registration, reciprocity, or other exceptions, while interstate compacts may provide an additional pathway for eligible professionals. The specific rules depend on the profession and states involved.
Does HIPAA apply to telehealth therapy?
HIPAA applies to covered entities and their business associates within its scope. Telehealth must be conducted using reasonable safeguards to protect protected health information. HIPAA does not simply mean that a therapist must select a platform marketed as "HIPAA compliant."
Do therapists have to verify the client's location before every telehealth session?
Requirements vary, but verifying patient location is an important telehealth practice because the client's physical location can determine whether the therapist is authorized to provide care. A consistent location-verification workflow is particularly important for clients who travel or relocate.
Can therapists provide telehealth when a client is traveling to another state?
Possibly, but therapists should not assume that a short trip creates an automatic exception. The laws of the state where the client is physically located may apply.
References
https://telehealth.hhs.gov/licensure/licensure-for-behavioral-health
https://telehealth.hhs.gov/licensure/licensing-across-state-lines
https://telehealth.hhs.gov/providers/telehealth-policy/telehealth-policy-updates
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html
https://www.cms.gov/medicare/coverage/telehealth/list-services
If you’re ready to spend less time on documentation and more on therapy, get started with a free trial today
Not medical advice. For informational use only.
Outline
More articles
