Ninety days at a time: telehealth’s stack of temporary permissions

The week

For millions of patients, the video visit had become ordinary by the spring of 2022. A therapy session from the kitchen table, a medication check from a parked car, a follow-up without a two-hour drive. It felt like a permanent part of health care. Legally, it was anything but.

On April 12, 2022, the Secretary of Health and Human Services renewed the COVID-19 public health emergency for another 90 days. A public health emergency is a formal federal declaration under the Public Health Service Act that unlocks temporary powers and waivers, rules relaxed so the health system can respond to a crisis. This one had first been declared at the end of January 2020 and renewed every 90 days since.

The renewal itself was expected. In early 2021, HHS had told governors it would give 60 days’ notice before letting the emergency end. No such notice had come by mid-February 2022, so the April renewal was close to certain. What remained uncertain was everything after it.

Three flexibilities on one declaration

That declaration underpinned many of the flexibilities behind widespread telehealth. Three mattered most.

First, Medicare waivers of geographic and originating-site limits. Before the pandemic, Medicare generally paid for telehealth only when the patient was in certain locations, often a clinic in a rural area, rather than at home. The waivers lifted those limits so beneficiaries could be seen at home. They also widened which clinicians could bill for telehealth and allowed some services by audio alone.

Second, enforcement discretion from the HHS Office for Civil Rights, the office that enforces HIPAA, the federal health privacy law. Enforcement discretion means the regulator said it would not penalize certain technical violations for now. Here, it covered common non-public-facing video tools, the ordinary video-calling apps many people already had on their phones, even if they did not meet every HIPAA requirement. Public-facing services such as live-streaming platforms were excluded.

Third, Drug Enforcement Administration flexibility to prescribe certain controlled substances, medicines with abuse potential that the DEA regulates, without a prior in-person visit. Since the Ryan Haight Act of 2008, federal law had generally required at least one in-person evaluation before such prescribing online. The emergency switched that requirement off.

The renewal document itself was short. It restated that the consequences of COVID-19 continued to constitute a public health emergency and renewed the declaration from mid-April. It changed nothing about HIPAA itself, state law or commercial insurance. Every downstream flexibility kept whatever terms its own owner had set, and every owner kept its own timetable.

Other clocks already running

A month earlier, Congress had added another layer. The Consolidated Appropriations Act, 2022, signed on March 15, extended many Medicare telehealth flexibilities for 151 days after the emergency ended. Medicare coverage would no longer stop the instant the declaration did. It would stop about five months later.

The 151 days were measured from a date nobody yet knew. A health system could not put the Medicare end date in a calendar, because it depended on a future decision by the Secretary. Planning had to work from scenarios: if the emergency ended in July, coverage would run to December; if it ran to the end of the year, coverage would run into the following spring.

The same law extended a separate flexibility that had nothing to do with the emergency declaration. It let high-deductible health plans paired with health savings accounts cover telehealth before the deductible, for plan months from April through December 2022. That was a different clock again, running on a tax rule and ending on a calendar date.

Meanwhile, state licensure waivers, emergency rules that let clinicians treat patients across state lines, varied by state, and many had already expired along with state emergency declarations. Commercial insurers and state Medicaid programs set their own telehealth payment policies, which some had made permanent and others had not.

So the April renewal bought time, but only for some of the permissions, and not all on the same clock. One flexibility now ran on the emergency, another on the emergency plus 151 days, another on a calendar date, and others on fifty separate state decisions. Patients saw one service. Health systems were running several legal regimes at once.

Take a 68-year-old man in a small town who has seen his cardiologist by video every three months since 2020. He logs in from his living room with a link his granddaughter set up. He does not know, and has no reason to know, what his visit depends on. It rests on a Medicare waiver tied to an emergency declaration, a privacy enforcement policy, and the state where his cardiologist holds a license. He only knows it works. If any one of those changes, he finds out when the visit is canceled, or when a bill arrives.

By spring 2022, telehealth had a practical problem as well as a policy one. Patients experienced a video visit as one service. Underneath, it rested on separate permissions with different legal owners and end dates. Each could change on its own schedule. When one changed, a patient who had done nothing different might find a visit unavailable, uncovered or unable to produce the prescription they expected.

Air travel works the same way. The passenger buys one ticket. Behind it, the airline needs a plane that is certified, a pilot licensed for that aircraft, landing rights at both airports and a fare the passenger has paid. If any of those lapses, the flight does not happen, and the passenger rarely cares which one it was. Telehealth in 2022 was a flight in which several of those permissions were temporary, issued by different authorities and renewed on different schedules.

We take the problem in five parts, following the visit. First, the platform the visit runs on. Second, the license that lets the clinician see the patient. Third, the payment rules that decide whether the visit is covered. Fourth, the prescribing rules that decide what can follow from it. Fifth, the register and booking machinery that tie the four together, and what it cost the health systems that built it.

The platform: video tools never meant for care

Early in the pandemic, OCR’s enforcement discretion let providers use common video tools that did not meet every HIPAA requirement, as long as they were not public-facing. The office’s guidance named familiar video chat apps as acceptable and live-streaming services as not. That made rapid adoption possible. Clinics could start seeing patients by video in days rather than months.

What the discretion covered, and what it left

The discretion was narrower than many clinicians assumed. It covered good-faith provision of telehealth during the emergency. It did not suspend the rest of HIPAA: patients still had rights to their records, and a breach of a telehealth vendor’s systems still raised questions. OCR encouraged providers to notify patients that third-party apps could introduce privacy risks, and to enable available encryption and privacy modes.

In effect, some care ran on tools never meant for it, without business associate agreements and with inconsistent settings. A business associate agreement is the contract HIPAA requires between a covered entity and any outside company that handles patient information on its behalf; it binds the company to protect that data. Without one, the provider is relying on a vendor that has made no such promise. Patients received links by text from one clinician, by email from another, and through the portal from a third.

The platform layer was the one most within a health system’s control, and the one whose end was most certain. The discretion would end with the emergency, and HIPAA would then apply in full. Nobody knew the date. Everybody knew the direction.

Consolidating onto one platform

Health systems that moved virtual visits onto platforms covered by business associate agreements, integrated with the record and the patient portal, gave patients one way to join every visit. They also gave clinicians reliable documentation and gave the privacy office a single place to configure recording, retention and access. The cost was migration: retraining clinicians attached to a tool they liked, and retiring departmental accounts. Doing it in 2022, on the health system’s own schedule, was cheaper than doing it under a deadline.

“Integrated with the record” means three things. The visit is launched from the same appointment the patient booked. The clinician’s notes land in the patient’s chart automatically. And the visit is billed from the same system as every other encounter. Without that, staff copy details by hand from one system to another, which is slow and invites mistakes. With it, a virtual visit is simply another kind of appointment, managed the same way.

Consolidation had real costs beyond retraining. Some departments had chosen tools for good clinical reasons, such as group therapy features or the ability to bring in a family member from another location. A single enterprise platform might not match those features on day one. The sensible approach was to list the features each department relied on, check them against the chosen platform, and grant time-limited exceptions where a gap was real, each with its own business associate agreement.

The strongest argument against consolidation was clinical freedom. Clinicians who had built a working practice on a tool they knew argued that forcing a change mid-treatment risked disrupting patients. That concern was legitimate, and it argued for careful timing and support, such as moving patients at a natural break in care and giving clinicians practice sessions first. It did not argue for leaving care on tools that would fall out of compliance on a date nobody controlled.

Audio, interpreters and the patients video leaves out

The platform also had to serve patients who could not use video. Audio-only visits mattered for older patients, rural patients with poor broadband and many behavioral health patients. A single platform that offered a dial-in fallback, captured the modality for billing, and sent reminders by text as well as email reached more patients than a video-only service.

Audio-only care raised its own privacy questions. In June 2022, OCR issued guidance on how HIPAA applies to audio-only telehealth. It explained that the Security Rule does not apply to calls over a traditional landline, but does apply to many internet-based voice services and apps. A health system needed to know which kind of call each of its audio visits used.

Interpreter access, captioning and a test link before the first visit belonged in the same design, because each failure at that stage becomes a missed appointment. Three-way video with a remote interpreter, for example, has to be supported by the platform rather than improvised on a second device.

Designing the patient’s side

Patients judged the platform by the first five minutes. A single way in, through the portal or one reminder link, removed the most common failure: the patient with three apps and the wrong one open. A pre-visit test of camera and microphone caught problems before the clinician’s time was spent. A staffed help line, reachable by phone during clinic hours, rescued visits that would otherwise have become no-shows.

These details sound minor to executives and matter enormously to patients. They also affect clinical capacity. Every visit lost to a technical failure is a slot that could have gone to someone else.

Controls an auditor would expect

Once full HIPAA enforcement returned, a telehealth platform would be judged like any other system holding patient information. The Security Rule requires a risk analysis, and telehealth belongs in it. That means documenting where video and audio travel, whether sessions are encrypted, whether they are recorded, where any recordings are stored and for how long, and who can access them.

Access controls matter at both ends. Clinicians should sign in with the same managed identity they use for the record, with multi-factor authentication, rather than personal accounts. Patients should join through unique, expiring links or the portal, with a virtual waiting room so that a clinician admits each patient deliberately. A brief identity check at the start of the visit, such as confirming name and date of birth, protects against the wrong person joining.

The vendor review belongs in the same file. A business associate agreement is necessary but does not prove the vendor’s controls are sound. Health systems with mature third-party risk programs asked for independent security assessments and breach notification terms, and checked where the vendor stored data.

How it differed by organization

Large health systems with an enterprise record usually had a telehealth module available and could consolidate around it. Community health centers and small practices often lacked that option and relied on stand-alone products, where the business associate agreement and the integration had to be negotiated separately. Behavioral health practices, many of them small and outside large systems, had leaned most heavily on consumer tools and had the most migration to do.

The license: care stops at the state line

Clinicians are licensed by states, and the state where the patient is located during the visit usually governs. That surprises many people. A doctor licensed in one state, sitting in her office there, is generally practicing in the patient’s state when she sees a patient who is physically in another state, even by video.

Waivers, compacts and their limits

Emergency waivers allowed cross-state care in many states, but they ended at different times, often with each state’s own emergency declaration. A federal renewal did nothing to extend them. That is the layer most often misunderstood: the April 2022 renewal kept Medicare’s rules in place while many state licensure waivers were already gone.

Interstate compacts, agreements among states that make it easier for a clinician licensed in one member state to practice in others, existed for physicians, nurses, psychologists and some other professions. They worked in different ways. The nurse compact gave a multistate license; the physician compact offered an expedited path to separate state licenses; the psychology compact authorized telepsychology across member states. Not every state took part, and compact privileges still had to be obtained and maintained.

Surprises for patients

For patients, the rule surfaced as a surprise. A student at college, a retiree wintering in another state or a worker on assignment could find that a familiar clinician could no longer see them by video. Some states allowed limited follow-up care for established patients; others did not. The rules were too varied for front-desk staff to hold in memory.

Location checks in booking

The operational answer was to ask for the patient’s location at booking and again at check-in, and compare it with the clinician’s licenses in the scheduling system. When they did not match, the booking stopped with a clear explanation and an alternative. Health systems near state borders, and those with national specialty programs, needed a licensure roster that scheduling could read, not a spreadsheet in the medical staff office.

Suppose a health system near a state line runs a popular virtual dermatology clinic. Half its patients live across the border. While the neighboring state’s waiver is in force, everything works. When the waiver ends, the scheduling system has no idea, because licenses are tracked in a separate credentialing database. For three weeks, visits continue to be booked that clinicians are not permitted to conduct. Some are caught by alert clinicians and canceled at the last minute; others are not.

Had the roster been connected to scheduling, the system would have offered those patients an in-person visit or a clinician licensed in their state at the moment of booking. The fix is a data feed, not a policy memo: credentialing becomes the source of truth for where each clinician may practice, and scheduling reads it.

Privileges and insurance as well as licenses

A license lets a clinician practice in a state. It does not, by itself, let them treat patients for a particular hospital. Hospitals grant privileges to clinicians, and Medicare’s conditions of participation allow a hospital to rely on the credentialing decisions of a distant-site hospital or telemedicine entity under a written agreement. That arrangement, often called credentialing by proxy, made cross-organization telemedicine programs workable, but it needs its own agreements and its own register.

Malpractice coverage adds another check. A clinician’s policy may cover practice in some states but not others, or may exclude telehealth to patients in states where the clinician is not licensed. Risk management teams that reviewed coverage against actual patient locations sometimes found gaps nobody had considered.

The cost of more licenses

The alternative to blocking cross-border visits is licensing more clinicians in more states. That is a real strategic choice, with real costs: application fees, renewal cycles, continuing education rules and the staff time to track them. Academic medical centers with national referral programs often found it worthwhile for specific specialties. Community hospitals generally did not. The decision deserved an explicit owner and a business case, rather than a scramble each time a waiver lapsed.

The case for simply stopping cross-border care

Some health systems responded by refusing all virtual visits with patients outside their home state. That is simple and legally safe. It also abandons patients at exactly the moments telehealth helps most: the student away at college, the patient recovering at a relative’s house, the seasonal resident. A blanket refusal shifts the cost of compliance onto patients. The better answer is a precise check, run at booking, that allows what the law allows and offers a clear alternative for the rest.

Payment: who covers the visit

Medicare’s flexibilities determined whether visits from home were covered, which clinicians could bill, and whether audio-only visits counted. Commercial insurers and Medicaid programs set their own rules, which varied by plan and state. Each payer followed its own clock.

Medicare’s split clock

Medicare was the most complicated because its rules had two sources. Some flexibilities rested on waivers tied to the emergency. Others were extended by statute for 151 days after it. Certain mental health services had their own permanent rules, including a statutory requirement for an in-person visit within six months before telehealth care began, which had been postponed while the emergency lasted. A revenue cycle team had to know which source each code relied on.

The mechanics mattered. A telehealth claim carries a place-of-service code and modifiers that tell Medicare where the patient was and how the visit was delivered. When a flexibility ends, the same visit coded the same way may be denied. Denials then arrive weeks later, after the clinician’s time has been spent.

Documentation that survives audit

Payment rules also shaped documentation. Each telehealth note needed to record the modality, video or audio, the patient’s location, the clinician’s location, and the patient’s consent where a payer or state required it. Missing elements turned a valid visit into a denied or recouped claim.

Oversight was predictable. The HHS Office of Inspector General made Medicare telehealth billing during the pandemic a subject of program integrity reviews from 2022 onward. Health systems that sampled their own telehealth claims each quarter, checking that notes supported the codes billed, found problems while they were small and correctable.

Commercial plans and Medicaid

Commercial coverage made the picture harder still. Plans changed their telehealth policies on their own schedules, sometimes with short notice, and employer plans varied within a single insurer. Some states had parity laws requiring insurers to cover telehealth on similar terms to in-person care; others did not. Medicaid programs set policy state by state, and many made at least some telehealth coverage permanent.

Revenue cycle teams, the staff responsible for billing, coverage checks and collecting payment, were best placed to maintain this part. They could feed eligibility rules into scheduling so that front-desk staff did not have to remember them. A real-time eligibility check at booking, for virtual visits specifically, prevented many denials before they happened.

What the patient pays

Coverage was only half of the patient’s question; cost-sharing was the other. Early in the pandemic, the HHS Office of Inspector General said providers would not face sanctions for reducing or waiving Medicare cost-sharing for telehealth during the emergency. Many commercial plans had also waived cost-sharing for virtual visits early on, and many had since reinstated it. For patients in high-deductible plans, the tax rule extended in March 2022 decided whether a virtual visit before the deductible was even allowed to be free.

The result was that two patients booking the same virtual visit on the same day could face very different bills. Price transparency at booking, even a simple statement that the visit would be billed like an office visit under the patient’s plan, prevented many complaints.

Different exposure for different providers

The financial exposure was uneven. Federally qualified health centers and rural health clinics, which are paid under their own Medicare methods, depended on emergency rules that let them serve as the clinician’s site for telehealth. Hospital outpatient departments faced questions about facility fees for virtual care. Physician groups with a large Medicare population carried the most direct risk. A health system with all three needed to model each separately.

Medicare Advantage added a further wrinkle. Since 2020, under the Bipartisan Budget Act of 2018, Medicare Advantage plans could offer additional telehealth benefits beyond what traditional Medicare covered. A patient in a Medicare Advantage plan might therefore keep home telehealth coverage after the emergency ended, while a neighbor in traditional Medicare lost it. Eligibility checks had to know which kind of Medicare each patient had, and front-desk scripts had to explain the difference without confusing anyone.

Prescribing: what can follow from the visit

The DEA flexibility determined whether some medications, including buprenorphine for opioid use disorder and stimulants for attention disorders, could be started after a telehealth visit alone. It was the permission with the most clinical weight. A lapse in coverage costs money; a lapse in prescribing authority can interrupt treatment.

How the rule worked

Under the Ryan Haight Act, a practitioner generally needed at least one in-person medical evaluation before prescribing a controlled substance over the internet. The act contained a telemedicine exception, but the special registration it contemplated had never been created. During the emergency, the DEA relied on a separate exception for public health emergencies, which removed the in-person requirement while the declaration lasted.

So a patient who began treatment by video in 2021 might never have met their prescriber. If the emergency ended without a replacement rule, the next refill could require an in-person visit the patient had never needed before. DEA registration is also state-specific, which tied this layer back to licensure.

Behavioral health showed the stakes

For many patients in therapy and medication management, telehealth had become the main channel, and some had never met their clinician in person. A change in prescribing rules could interrupt treatment abruptly. Programs that identified those patients early, and scheduled in-person visits or arranged referrals where a rule might require one, avoided gaps in care.

The data to do that was usually available. A query across the record could list patients receiving controlled-substance prescriptions whose encounters were all virtual. That list was the planning base for every possible prescribing deadline. It also told leaders how much in-person capacity they would need if the flexibility ended.

State rules on top of federal ones

Federal flexibility did not override state law. States regulate prescribing through their medical and pharmacy boards, and some had their own rules on prescribing controlled substances after a virtual visit. A prescriber had to satisfy both the federal rule and the rules of the state where the patient was located. For multi-state programs, that meant a second matrix sitting alongside the licensure roster.

Pharmacies as a checkpoint

Prescribers are not the only party with obligations. Under DEA regulations, a pharmacist has a corresponding responsibility to fill only controlled-substance prescriptions issued for a legitimate medical purpose. Pharmacies that saw large volumes of telehealth prescriptions, particularly for stimulants, could decline to fill them, and some did during this period.

For a patient, a pharmacy refusal looks the same as a rule change: the medication does not arrive. Health systems that prescribed through telehealth benefited from three things. They documented the clinical basis for each prescription clearly. They checked state prescription drug monitoring programs routinely. And they kept a working relationship with the pharmacies their patients used.

Telehealth-only providers carried the most risk

Organizations whose model was entirely virtual, including some digital mental health companies that prescribed stimulants, had no in-person capacity to fall back on. For them, the prescribing flexibility was existential. A traditional health system could absorb a rule change by booking clinic visits. A virtual-only provider might have to refer patients out, or stop prescribing entirely.

The register that ties the layers together

A health system needed a register showing, for each visit type, which rules it depended on, who set them, and when each was due to expire. Patients needed to know before booking whether a visit would be covered and whether it could lead to the prescription they expected. That information belongs in the booking flow, not in a denial letter afterward.

What the register records

The register does not need to be sophisticated. At its simplest, it is a shared table with one row per rule that telehealth depends on. Each row records a handful of facts:

• what the rule allows, for example “Medicare patients may be seen by video at home”;
• who sets it: HHS, Congress, a state licensing board, the DEA, a specific insurer;
• what it is tied to: the emergency declaration, a statute with its own clock, a state order;
• when it might end, and how much notice is likely;
• which visit types and which patients depend on it;
• who inside the health system owns it, and who must act when it changes.

Connecting it to action

The register only earns its keep when it is connected to action. Each owner checks their rows on a set schedule and whenever news breaks. When an end date moves closer, the owner triggers a short, pre-agreed sequence: confirm the change, update the scheduling rules, identify affected patients, draft and send patient notices, brief clinicians and front-desk staff, and adjust billing.

Suppose a health system’s compliance office keeps the register and reviews it every month with representatives from revenue cycle, scheduling, pharmacy, behavioral health and communications. When a federal renewal is announced, the meeting takes ten minutes: the affected rows are updated, and nothing else changes. When a state waiver is due to lapse, the same meeting sets off the sequence above, with named owners and dates. Front-desk staff never need to know the law. They see an accurate booking screen.

The register also gives leaders a single picture of exposure. A board member can ask what happens to virtual care if the emergency ends in July. The answer lists visit types, patient counts and actions already planned, rather than a promise to look into it.

Planning by scenario

Because the end date of the emergency was unknown, the most useful planning tool was a small set of scenarios. One assumed another routine renewal, with no action needed. A second assumed HHS gave the promised 60 days’ notice, starting a known clock for OCR discretion and the DEA flexibility, and a 151-day clock for Medicare. A third assumed a federal or state change with little notice, such as a licensure waiver lapsing or a payer changing policy.

Each scenario had a pre-agreed set of actions, owners and patient messages. When news broke, the organization chose a scenario and started work, rather than convening a task force to begin thinking. The scenarios also clarified which tasks could be done in advance regardless of outcome, such as platform consolidation and the licensure check, and which had to wait.

Who owns the register

The register needs a single accountable owner and several contributors. Compliance is the usual owner, because it already tracks regulatory change. Revenue cycle owns the payer rows, medical staff services owns licensure and privileges, pharmacy owns prescribing, and the privacy office owns the platform rows. Information technology owns the integrations that turn each row into a booking rule.

The pattern differs by organization. An academic medical center may have a dedicated virtual care office that coordinates all of this. An ambulatory network may give the job to its operations leader. A federally qualified health center with a small administrative team may keep the register itself but rely on its record vendor and its primary care association for regulatory updates. The size of the machinery should match the organization; the questions it answers do not change.

Measures that show it working

A few measures tell leaders whether the machinery works. Track telehealth denials by reason, and bookings blocked by the licensure check along with what happened to those patients. Count patients on controlled substances with no in-person visit. Measure the lead time between a known rule change and the first patient notice. Each is easy to produce from existing systems. Together they show whether the organization is ahead of the next deadline or behind it.

Telling patients before, not after

The same register lets communications teams draft patient notices weeks before each possible end date instead of days after it. Notices work best when they are specific: which visits change, what the patient needs to do, and what alternative is on offer. A generic message that “telehealth rules are changing” generates calls without helping anyone.

Booking screens can carry the same information. A patient choosing a virtual visit can be told, in simple language, whether the visit is covered by their plan and whether it can lead to a new prescription for a controlled medication. Telling them at booking costs a line of text. Telling them through a denial letter costs a complaint, a write-off or a lost patient.

What it cost, and who paid

None of the machinery was free. Connecting credentialing to scheduling took integration work. Real-time eligibility checks added cost per transaction. Monthly register reviews took time from senior people in five departments. For a large system, the cost was modest against the revenue at risk. For a small practice, it was a meaningful burden, which is why many small practices relied on their record vendor or billing company to carry part of it.

The trade-off also had a patient side. Stricter booking checks stop some visits that would, in the end, have been allowed, because the rules were ambiguous. Health systems had to decide how conservative to be. A reasonable approach was to block clear violations, flag ambiguous cases for a human decision, and record the reason either way.

The case against building it

The strongest objection was that the rules would settle soon, so building machinery for temporary rules was wasted effort. In April 2022, that was a reasonable bet. Congress had shown interest in extending Medicare telehealth, and many expected a permanent settlement. The objection deserved a hearing.

It failed for two reasons. First, even a permanent federal settlement would leave state licensure, commercial payer policy and DEA rules on separate tracks, so the register would still be needed. Second, the cost of the machinery was low compared with the cost of one badly handled deadline. Building it was cheap insurance against an outcome nobody could rule out.

Habits of the systems that coped

Across academic centers, community hospitals, health centers and behavioral health practices, the organizations that handled this period well shared a handful of habits. None required new technology so much as connecting systems they already owned.

• one approved telehealth platform, covered by a business associate agreement and reached through the patient portal, with an audio-only fallback;
• patient location captured at booking and at check-in, and checked automatically against the clinician’s licenses;
• a single register of every rule telehealth depended on, with the authority that set it, an owner inside the health system and the expected end date;
• coverage and prescribing limits shown to patients at booking, in words they understand;
• a list of patients who had never been seen in person, used to plan ahead of each possible prescribing deadline.

If a permission ended next month

• Do we capture where the patient is at the time of every virtual visit, and does scheduling check it against the clinician’s licenses?
• Do we have one register listing every telehealth rule we depend on, who sets it, who owns it here and when it ends?
• When a patient books a virtual visit, are they told whether it will be covered and whether it can lead to the prescription they expect?
• How many of our patients receive controlled-substance prescriptions and have never been seen in person, and what is our plan for them if the rules change?
• If one of these permissions ended next month, how quickly could we notify affected patients and offer them an alternative?

With hindsight

The 90-day rhythm of spring 2022 turned out to be a preview of years of rolling deadlines.

The emergency ends, and the clocks separate

The emergency was renewed several more times in 2022. At the end of January 2023, the administration announced that it planned to let it end, and it ended on May 11, 2023. Congress had already separated one major dependency: the December 2022 omnibus appropriations law ended Medicaid’s pandemic continuous enrollment requirement on its own date, March 31, 2023, rather than with the emergency.

The same December 2022 law extended Medicare’s telehealth flexibilities through the end of 2024, replacing the 151-day tail with a fixed date. It also postponed the in-person requirement for Medicare mental health telehealth.

OCR’s telehealth enforcement discretion ended with the emergency, followed by a 90-day transition period that ran to early August 2023. From then on, health systems were expected to run virtual care on platforms that met HIPAA in full, which rewarded those that had migrated early.

Medicare, extended a piece at a time

Congress continued to extend Medicare’s telehealth flexibilities in brief increments rather than settle them permanently. They lapsed when the federal government shut down on October 1, 2025, and were later applied retroactively as if there had been no lapse. For patients and providers, that meant a period of real uncertainty followed by a paper fix, a pattern that strains scheduling, billing and trust alike. CMS now says beneficiaries can receive Medicare telehealth services at home anywhere in the country through December 31, 2027.

Prescribing, extended year by year

The DEA and HHS extended the prescribing flexibilities repeatedly through temporary rules, first to November 2023, then to the end of 2024, the end of 2025 and most recently December 31, 2026. In January 2025 they also finalized a narrower permanent rule allowing buprenorphine for opioid use disorder to be started by telemedicine, and proposed a special registration for telemedicine prescribing. The broader question, a permanent framework for other controlled substances, remained open.

Each extension tended to arrive late in the cycle, weeks rather than months before the previous date. That left health systems drafting contingency plans and patient notices they hoped not to send, cycle after cycle, and taking staff time away from care.

The December 2026 date is now close. The patients it affects, many in addiction and mental health treatment, are among those least able to absorb a sudden change.

What held up

The core observation held up. By this point in 2026, the layers still end on different dates, as they did in April 2022. Medicare coverage, prescribing rules, privacy obligations and state licensure each follow their own clock. The October 2025 lapse showed that even a flexibility everyone expected to continue could stop without warning.

Health systems that kept a register of which rule each visit type depends on, and built licensure and coverage checks into booking, have handled each deadline with less disruption to patients. Licensure compacts have grown, but the patient’s location still decides which state’s rules apply.

What did not

The expectation, common in 2022, that Congress would soon settle Medicare telehealth permanently did not hold. Four years on, the most important flexibilities still run on dated extensions. Organizations that waited for a permanent answer before building their machinery waited a long time.

“Temporary” can last for years, and a permanent-looking service built on temporary permissions needs permanent machinery to manage them. The register, the booking checks and the patient list belong to the everyday running of virtual care, not to crisis response. For health systems that still manage these rules by memo and memory, the end-of-2026 prescribing date is a good moment to change that.