After the emergency, telehealth’s rules landed on clinicians one deadline at a time

The week

The federal COVID-19 public health emergency ended on May 11, 2023, more than three years after it was declared. A public health emergency is a formal federal declaration that unlocks temporary flexibilities in how health care is regulated and paid for.

The declaration dated from January 31, 2020, when the HHS Secretary declared a public health emergency under Section 319 of the Public Health Service Act, effective from January 27. Each declaration lasts 90 days unless renewed, so it had been renewed again and again. On January 30, 2023, the Biden administration said it would let the emergency lapse on May 11, giving the health system about three months of notice.

Other pandemic arrangements had already come apart on their own schedules. A separate national emergency under the National Emergencies Act ended on April 10, 2023, when the President signed a congressional resolution terminating it. The Consolidated Appropriations Act, 2023 had cut the link between Medicaid’s continuous enrollment requirement and the emergency, so states could begin removing people who no longer qualified from April 1. Many state licensure waivers had expired earlier still, as governors ended their own emergency orders.

Those flexibilities had changed how care was delivered. For three years, a patient could see a psychiatrist on a video call from her kitchen table, get a prescription for a controlled medication without ever meeting the doctor in person, and do it all over an ordinary video app. A nurse practitioner could see patients across a state line. The clock now started running out on many of those temporary rules, though not all at once. The end of the emergency did not remove every pandemic-era flexibility, because different rules had been tied to different decisions by different authorities.

Congress had already extended most Medicare telehealth flexibilities through the end of 2024 in the Consolidated Appropriations Act, 2023, a large federal spending law. So for Medicare patients, video visits from home would continue to be paid for.

That extension carried specific terms. Through 2024, Medicare patients could be seen at home and outside rural areas, and audio-only visits were allowed for many services. Physical and occupational therapists, speech-language pathologists and audiologists could bill for telehealth. Federally qualified health centers and rural health clinics could keep acting as the clinician’s site for telehealth visits. The law also postponed a requirement, enacted at the end of 2020, that patients receiving mental health care by telehealth at home first see their clinician in person. And it extended the Acute Hospital Care at Home waiver, which lets hospitals treat some inpatients at home, through 2024.

Prescribing was another matter. On May 9 the Drug Enforcement Administration, the federal agency that regulates controlled substances such as opioids, stimulants and certain sedatives, announced a temporary rule extending flexibilities for prescribing controlled substances by telemedicine without a prior in-person visit. It did so after the proposals it had released in late February drew more than 38,000 public comments, a striking volume for a technical rule.

There were two proposals, published in the Federal Register on March 1: one for telemedicine prescribing generally, and one for buprenorphine, a medication used to treat opioid use disorder. The comment period closed on March 31. The DEA counted 38,369 comments, 35,454 on the general rule and 2,915 on the buprenorphine rule. Broadly, the proposals would have allowed a limited first supply of some medications by telemedicine and then required an in-person evaluation. Schedule II drugs, which include most ADHD stimulants, would generally have needed an in-person evaluation first.

The temporary rule, signed on May 4 and published on May 10, worked in two tiers. Any practitioner could keep prescribing under the pandemic flexibilities through November 11, 2023. For patient relationships formed by that date, the flexibilities would continue for another year, through November 11, 2024. The DEA issued it jointly with the Substance Abuse and Mental Health Services Administration and made it effective immediately to avoid gaps in care. In the same document the agency noted that it was investigating certain telemedicine companies over possibly problematic prescribing.

Privacy rules were on their own timetable. The HHS Office for Civil Rights, which enforces the HIPAA privacy and security rules, had announced in April that its enforcement discretion for telehealth on platforms that did not fully comply with HIPAA would end with the emergency, followed by a 90-day transition to August 9. Clinicians who had been allowed to use everyday consumer video apps would need to move to properly secured platforms.

OCR’s April notice ended four pandemic enforcement discretion policies at once. Three of them, covering community testing sites, vaccine scheduling apps and some business associate disclosures for public health, ended outright on May 11. Only the telehealth policy received a transition period. The original March 2020 notice had named everyday tools such as FaceTime, Skype and Zoom as acceptable when used in good faith, and had excluded public-facing services such as Facebook Live, Twitch and TikTok. OCR said it would not penalize good-faith telehealth during the transition, and would keep its discretion for conduct while the policies were in force.

Many Section 1135 waivers that had relaxed hospital and staffing rules ended with the emergency. These waivers, named for the section of the Social Security Act that authorizes them, had temporarily eased requirements on hospitals and other providers during the crisis.

The result was a patchwork of deadlines, and the people who felt it most were the clinicians, schedulers and credentialing staff who had built virtual care in the first place.

While flexibilities were being renewed every 90 days, telehealth was mostly discussed from the patient’s side. The end of the emergency moved the pressure to the workforce. Virtual care had been built by clinicians, schedulers and credentialing staff working under rules that were now expiring on different dates, set by different authorities.

A single telehealth transition project, owned by one team, tended to miss whatever fell outside that team’s view. Three questions with three natural owners covered the ground: what clinicians may prescribe remotely, where they may practice from, and which tools they may use. Each needed its own owner inside a health system, and a common calendar to hold them together.

The pressure did not fall evenly. A large academic medical center had compliance, credentialing and pharmacy teams to split the work. A federally qualified health center or a rural clinic often had one administrator holding all three questions. Digital-first behavioral health companies, built almost entirely on remote prescribing, faced the sharpest version of the prescribing question. Physician groups that had grown virtual practices across state lines faced the sharpest version of the licensure question. The questions were the same for all of them, while the capacity to answer them varied widely.

Four rulebooks behind one video visit

To a patient, a video visit is one simple thing: a conversation with a clinician on a screen. Behind it sit several separate systems of rules, each written by a different authority for a different purpose.

• Payment rules decide whether an insurer pays for the visit. For Medicare, the federal program for older adults, Congress sets many of these. Commercial insurers and state Medicaid programs set their own.
• Prescribing rules decide what a clinician may prescribe without seeing the patient in person. For controlled substances, the DEA sets them.
• Licensure rules decide where a clinician is allowed to practice. Each state sets its own.
• Privacy and security rules decide which technology may be used. OCR enforces these under HIPAA.

The arrangement resembles a long-distance delivery run. The employer decides whether the driver is paid, one authority decides whether the van is roadworthy, each state decides whether the license is valid on its roads and another regulator decides what may be carried. During the pandemic, all of those authorities relaxed their rules at once. When the emergency ended, each tightened again on its own schedule, and anyone tracking only one of them would sooner or later be stopped by another.

So a single “telehealth project” rarely works. Payment, prescribing, licensure and technology each belong to different experts inside a health system. The practical answer is to split the work into the questions those experts own, and to keep one shared view of all the deadlines.

Why the dates came apart

The deadlines diverged because each flexibility rested on a different legal hook. The Ryan Haight Act already contained an exception for telemedicine during a public health emergency declared by the HHS Secretary. That exception switched on automatically in 2020, and it would switch off automatically when the declaration ended. The DEA therefore needed a rule of its own to avoid a hard stop on May 11.

Medicare’s telehealth limits are written into the Social Security Act, in Section 1834(m). They restrict where the patient may be, which clinicians may bill and what technology counts. The emergency let HHS waive them. Congress then replaced that dependency with dates of its own: first a 151-day tail after the emergency, then a fixed end date of December 31, 2024. Once Congress had set a date, the end of the emergency no longer mattered for Medicare payment.

OCR’s position was different again. Enforcement discretion is a decision about when the agency will pursue penalties; the HIPAA rules themselves never changed. OCR could end it on any date it chose, and it chose a 90-day transition. State licensure waivers depended on each governor’s emergency orders or on state law, so they ended state by state.

Each mechanism had its own decision maker and its own way of moving. Congress acted through spending bills, often close to the deadline. The DEA acted through rulemaking with notice and comment. OCR acted through notices. States acted through legislatures, licensing boards and executive orders. A compliance team that understood the mechanism behind each date could judge how likely it was to move, and how much warning there would be.

Commercial insurers and Medicaid added another layer. During the pandemic many states made Medicaid telehealth coverage permanent or adopted payment parity rules for commercial plans, and those rules differ widely. A multistate network could see one video visit paid at parity in one state and at a reduced rate, or not at all, in the next. Revenue cycle teams needed payer-by-payer rules built into scheduling and billing systems, rather than one telehealth policy for every patient.

What clinicians may prescribe remotely

Medicare coverage of most telehealth services had been extended by Congress, so the immediate payment change for Medicare patients was small. Commercial and Medicaid coverage depended on each payer and state.

Prescribing was the sharper problem. The Ryan Haight Act of 2008 generally requires an in-person medical evaluation before a practitioner prescribes controlled substances over the internet. The emergency had suspended that requirement. The DEA’s February proposals would have reinstated limits, with exceptions, before an in-person visit. The volume of objections led the agency to extend the flexibilities instead, first to November 2023.

An extension is still a deadline. Behavioral health, addiction treatment and ADHD programs had enrolled patients who had never met their prescriber in person. If the rules tightened, those patients would need visits that clinics might not have the capacity to provide. The workforce question was concrete: how many in-person appointments would be needed, in which locations, within what period, and which clinicians would provide them.

Answering it required data most organizations had not assembled. Pharmacy and clinical informatics teams could identify patients receiving controlled substances through telehealth-only relationships, by prescriber, drug schedule and patient location. Drug schedules are the DEA’s categories for controlled substances, ranked by potential for misuse; the rules can differ by schedule. From there, leaders could model several possible final rules and the visit capacity each would require.

Drug schedules, start dates and the pharmacy counter

The February proposals sorted patients by drug schedule. A clinician could have started some patients on lower-schedule medications by telemedicine, for a limited first supply, and then needed an in-person evaluation to continue. Schedule II drugs would generally have needed an in-person evaluation before the first prescription. Buprenorphine for opioid use disorder had a track of its own. Under that design, the schedule of each patient’s medication would have decided how urgently the patient needed a visit.

The May temporary rule changed the sorting question from which drug to when the relationship began. Patients whose telemedicine relationship started on or before November 11, 2023 would keep the flexibilities a year longer than patients who started afterward. That made the start date of each prescribing relationship a compliance fact. Many systems did not record it cleanly. A patient might have had a video intake with one clinician, been handed to another, and then moved between programs.

The practical step was to define, in writing, what counted as the start of a telemedicine relationship. Informatics could then tag each patient and keep the definition stable across later rules. When the DEA extended the flexibilities again in October 2023, that particular cliff disappeared. A clean record of relationship dates kept its value, because any permanent rule was likely to treat existing patients differently from new ones.

Pharmacies were part of the same chain. Under DEA rules a pharmacist has a corresponding responsibility to fill only prescriptions issued for a legitimate medical purpose. During 2022 some large pharmacy chains had become wary of stimulant prescriptions from telehealth-only companies. The FDA had announced a shortage of immediate-release amphetamine salts in October 2022. A health system could be fully compliant and still find patients unable to fill a prescription, which turned a regulatory question into a care coordination one.

Organizations faced different versions of the problem. Opioid treatment programs that dispense methadone operate under separate SAMHSA rules as well as DEA registration, so their telehealth questions differed. Office-based buprenorphine prescribers had just lost one barrier, since Congress removed the separate federal waiver for prescribing buprenorphine in December 2022. Digital-first ADHD and psychiatry companies had panels made largely of telehealth-only patients, so their whole model rested on the rule. A hospital psychiatry department usually had clinics nearby and could absorb in-person visits more easily.

The work belonged to the chief medical officer and pharmacy leadership, with compliance advising. It needed refreshing at every extension, because panels grew in the meantime.

Running the numbers

Suppose a regional behavioral health network grew its virtual ADHD and addiction programs quickly during the pandemic. When its pharmacy team runs the analysis, it finds that a large share of its patients on controlled medications have never had an in-person visit with their prescriber, and that many live hours away from any of its clinics. If a final rule required an in-person visit within a set period, the network would need to find hundreds of appointment slots, in places where it has no clinic, with prescribers who are mostly working remotely. The analysis does not tell leaders what the rule will be. It tells them how much capacity each version of the rule would demand, which is exactly what they need to plan hiring, partnerships with local clinics and patient communication. Run again a year later, after another extension, the numbers have grown, which is why it cannot be a one-time study.

The inputs for that model already exist in most health systems. Electronic prescribing records for controlled substances show the prescriber, the drug and the date. Encounter data shows whether each visit was virtual or in person. Patient addresses, used with care, give a rough sense of travel distance to the nearest clinic. The model then needs a few assumptions, and clinical leaders must own them: how long an in-person visit takes, how many a clinician can add per week, and which patients could be seen by a partner clinic instead.

The output should be a small set of scenarios rather than a single forecast. One scenario keeps the flexibilities; one requires an in-person visit for new patients only; one requires it for everyone within a year. Each shows the visits needed by month and location. Leaders can then pick trigger points, such as a final rule being published, that would release hiring or partnership spending already approved in principle.

Where clinicians may practice from

Licensure is governed by states. In general a clinician must be licensed where the patient is located at the time of care. This surprises many executives: what matters is where the patient is sitting during the visit, not where the clinician works or where the patient usually lives.

During the pandemic many states waived or relaxed that rule for out-of-state clinicians. Most of those waivers had ended before May 2023, each on its own timeline, but habits formed under them persisted.

The exposure sat in scheduling. A health system near a state border, a virtual program serving students away at college, or a patient visiting family can easily produce a visit with a clinician not licensed where the patient is that day. Controls are specific:

• Capture the patient’s location at check-in for each virtual visit, not the address on file.
• Match it automatically to the clinician’s active licenses in the scheduling system and stop the booking when they do not match.
• Track license expiry dates centrally.
• Make sure malpractice coverage matches the states where clinicians actually see patients.

Medicare added a related wrinkle. It had let clinicians providing telehealth from home list their enrolled practice location instead of their home address, and CMS extended that flexibility past the emergency for a limited period. CMS, the Centers for Medicare & Medicaid Services, runs Medicare. Organizations with clinicians working from home needed to track that date as well.

Interstate compacts for physicians, nurses, psychologists and other professions make additional licenses easier to obtain, but only where both states participate. A compact is an agreement among states to recognize or speed up each other’s licensing. Deciding which clinicians should hold which extra licenses is a workforce planning choice with a budget attached. Licensing fees, application time and renewal tracking add up across a large group. The credentialing and medical staff offices own this question, but the scheduling system enforces it.

How the compacts work, and where they stop

The compacts work differently from one another, and the difference matters for planning. The Interstate Medical Licensure Compact gives physicians an expedited path to separate full licenses in each member state. The physician still holds, renews and pays for each license. The Nurse Licensure Compact works by mutual recognition: a nurse whose primary state of residence is a member holds one multistate license valid in other member states. PSYPACT gives psychologists an authorization to practice telepsychology across member states, with conditions.

So a compact can shorten the time to license a physician without removing the renewal and tracking burden. It can let a nurse cover several states with one license, but only if the nurse lives in a member state. Some of the most populous states were not members of some compacts. Credentialing teams had to plan license by license and profession by profession.

State laws also contain narrow exceptions that are easy to misread. Many states allow an out-of-state physician to consult with a local colleague, which differs from treating the patient directly. Some allow brief follow-up with an existing patient who is traveling. The details vary and change, so organizations should confirm them with counsel rather than rely on a general rule. An academic medical center offering second opinions nationally needs a written policy on which exceptions it relies on, and when it requires a license instead.

The location check also needs an escalation path. A front-desk worker or a virtual check-in tool that finds a mismatch should be able to offer a clinician licensed in the patient’s state, reschedule, or move the visit in person. Without that path, staff must choose between turning a patient away and booking a visit they suspect is improper. Counting how often the block fires, and for which states, also tells credentialing which extra licenses would pay for themselves.

Supervision from a distance

Medicare raised a second question about where clinicians may be: where they must be when they supervise. During the emergency CMS let physicians meet the “direct supervision” requirement through real-time audio and video, rather than being on site. Teaching physicians could also be present virtually for some services furnished by residents. CMS extended these flexibilities a year at a time through the physician fee schedule. They shaped staffing in infusion suites, cardiac rehabilitation and other services billed under a supervising physician, where someone must be immediately available.

Each annual extension left medical staff leaders deciding whether to build schedules around virtual supervision or keep a physician on site. Building around it saved physician time but risked a rapid reversal. Keeping physicians on site cost capacity every day. Most organizations hedged, which is itself a workforce cost that rarely shows up in a budget.

Which tools clinicians may use

In March 2020 OCR said it would not penalize good-faith use of non-public-facing communication tools for telehealth. That covered consumer video and messaging apps that did not meet HIPAA requirements or come with business associate agreements. A business associate agreement is the contract HIPAA requires when an outside company handles patient information on a provider’s behalf; it commits the vendor to protect that information.

Most large health systems moved to enterprise platforms within months. Some clinicians, affiliated practices and community clinics kept using whatever had worked in the first weeks of the pandemic.

After August 9, every telehealth encounter needed a platform that met HIPAA Security Rule requirements, with a business associate agreement where the vendor handled protected health information. The Security Rule sets standards for safeguarding electronic patient information, such as controlling who can access it and protecting it in transit.

The hard part was finding the exceptions. Useful sources include expense reports showing app subscriptions, mobile device management inventories, call logs from personal phones used for audio-only visits, and short surveys of clinicians. Mobile device management is the software organizations use to keep track of and secure the phones and tablets staff use for work. Each exception then needs an approved alternative that works as easily, or the habit returns.

This question belongs to IT and the privacy officer, but it shapes clinicians’ working day. A platform that adds steps to every visit will be bypassed. Training, support for clinicians working from home, and a clear rule for audio-only visits matter as much as the contract.

Audio-only calls, messaging and the parts of a visit no one inventories

Audio-only care needed its own rule. OCR issued guidance in June 2022 on how HIPAA applies to audio-only telehealth. A conversation over a traditional landline does not involve electronic protected health information under the Security Rule. Calls carried over internet-based phone services, apps, or systems that record and store data generally do. Most organizations now run calls through cloud telephony, softphones and mobile apps, so the Security Rule usually applies.

A video visit also involves more than the call. Patients are invited by text or email, wait in a virtual lobby, share photos and receive follow-up messages. Clinicians may record, take screenshots or use transcription. Each feature can create a copy of protected health information somewhere. An inventory of tools has to cover those features, the settings that control them and where their data is stored, as well as the platform itself.

The Security Rule’s risk analysis requirement applies here as everywhere else. Moving from a consumer app to an enterprise platform should produce an updated risk analysis, a business associate agreement, configuration standards and access reviews. Those are the documents an OCR investigator would ask to see after a complaint or a breach. A signed agreement with no configuration standard behind it proves a contract exists, and very little about how the system is set up.

Substance use disorder programs carry an extra layer. Federally assisted programs covered by 42 CFR Part 2 face stricter limits on disclosure than HIPAA alone imposes. A telehealth vendor serving those programs needs to support those limits, including how records are labeled and how consent is captured. A network with a Part 2 program inside a larger practice needs to know which visits fall under it, and configure the platform accordingly.

Holding it together: the shared deadline tracker

The three questions have different owners, but they share a calendar, and that calendar is set by others. A shared tracker is the simplest tool for keeping them connected. It sounds mundane. In practice it is what separates organizations that see a deadline coming from those that discover it afterward.

A useful tracker is a short, living list rather than a policy document. Each line names one rule or flexibility, the authority that controls it, the date it currently expires or changes, the people and patients it affects, the internal owner, and the action planned if it lapses. A line might read, in effect: “Controlled substance prescribing without prior in-person visit; DEA; current expiry date; telehealth-only patients in behavioral health and addiction programs; chief medical officer and pharmacy; capacity plan for in-person visits ready.”

Several habits make it work:

• One list, many contributors. Compliance often keeps the list, but each owner is responsible for keeping their own lines current.
• A regular review. A short monthly meeting of the owners, with an executive sponsor, is enough to catch changes and look a few months ahead.
• State rules included. Federal deadlines get headlines. State licensure and Medicaid rules change with less fanfare and are easy to miss.
• Plans as well as dates. Each line should say what happens if the rule lapses or tightens, so the organization is choosing in advance rather than reacting.
• Affiliates in scope. If affiliated practices or contracted clinicians deliver telehealth under the health system’s name, their exposure belongs on the list too.

A tracker also gives the board something concrete to look at. Rather than a general assurance that “telehealth is under control,” directors can see the handful of deadlines that matter, who owns each one and whether a plan exists. It makes a better basis for oversight, and takes very little time to read.

Evidence that the tracker works

A tracker earns trust when evidence stands behind it. Internal audit, an outside examiner or a board committee would reasonably ask for a handful of measures. One is the number of telehealth-only patients on controlled substances, by drug schedule and relationship start date. Others are the share of virtual visits with the patient’s location recorded, the number of bookings blocked for a licensure mismatch, and the number of unapproved tools found and retired. Each measure needs an owner and a named source system.

The tracker also needs inputs. Someone has to watch the Federal Register, CMS guidance, DEA announcements, OCR notices and state medical and nursing boards. Trade associations and outside counsel publish alerts, but they do not know the organization’s own exposure. The owner of each line is the right person to read an alert and decide whether it changes the plan.

A spreadsheet is often enough for a single hospital. A multistate network with many affiliated practices may want the tracker inside its governance, risk and compliance system, linked to policies and to the evidence above. The tool matters less than review dates that are kept and owners who answer for their lines.

Bringing clinicians along

Every one of these changes lands on clinicians, and how it is communicated affects whether it sticks. A prescriber told without explanation that some patients must now be seen in person may feel the organization is second-guessing their judgment. A clinician whose favorite video app is switched off may simply return to it on a personal phone. Explaining which authority set each rule, why it matters to patients and to the clinician’s own license, and what support is available tends to work far better than a policy email. Clinical leaders who understand the reasons can carry the message to their colleagues more credibly than any compliance notice.

What a missed deadline costs

Revenue. Visits that fall outside payment rules, or that are delivered by a clinician not licensed where the patient sits, may not be paid, and may need to be refunded if discovered later.

Revenue exposure also has a clock. Under the Affordable Care Act, a provider that identifies a Medicare or Medicaid overpayment must report and return it within a set period, generally 60 days. Visits billed for a clinician not licensed where the patient was located can create such overpayments. Finding a licensure gap in an audit therefore starts a repayment process as well as a remediation project.

Regulatory and legal exposure. Prescribing controlled substances outside the rules, practicing without a license in the patient’s state, or using a non-compliant platform each carries its own enforcement risk, from different regulators.

Patient care and continuity. If prescribing rules tighten without a plan, patients on stable treatment may face gaps. For addiction treatment in particular, an interrupted prescription is a clinical risk to the patient.

The workforce. Many clinicians had built their working lives around remote practice, sometimes moving or taking on patients in other states. Changes in licensure and practice-location rules affect where they can work and how. Clear guidance and support help retain them; uncertainty pushes them toward organizations that seem to have a plan.

Remote clinicians also create questions that sit outside the clinical rules. A psychiatrist who moved to another state during the pandemic still needs licenses where the patients are. The clinician’s own home state, meanwhile, affects payroll taxes, employment law, malpractice terms and, for nurses, eligibility for a multistate compact license. Human resources, finance and credentialing each hold part of the answer. A short intake checklist for any clinician who changes their home address keeps those pieces from drifting apart.

Reputation. Patients rarely see the rules behind their care, but they notice when a long-standing video appointment is suddenly cancelled, a prescription is delayed or a clinician says they can no longer see them. Planned changes, explained early, feel like good management. Last-minute ones feel like the organization lost track, and patients tell others.

Malpractice coverage. A policy that does not match where clinicians actually see patients is a gap leaders often discover only after a claim.

How the prepared systems split the work

A health system in good shape has divided the work by question and owner, and keeps one shared tracker. The chief medical officer and pharmacy can say how many telehealth-only controlled substance patients they have and what each possible rule would require. Credentialing can show which clinicians hold which licenses, and the scheduling system blocks mismatches. IT and privacy can show that every telehealth tool in use has the required agreement and safeguards, and know how they found the exceptions.

The organizations that struggled tended to trip in the same places. A telehealth task force led from one department missed whatever lay outside its expertise. Schedulers relied on the address on file, which says nothing about where the patient is during the visit. Some leaders treated an extension as a solution, when each extension was a new deadline and patient panels grew in the meantime. Others replaced a convenient app with a cumbersome one, and clinicians drifted back to whatever worked. And affiliated practices and community clinics were often still running on old habits that the main health system had long since fixed.

How the split differs by type of organization

• Academic medical centers tend to have the deepest bench and the widest exposure: national referral patients, residents supervised virtually and many affiliated practices.
• Federally qualified health centers and rural health clinics follow Medicare telehealth payment rules of their own and often rely on audio-only care for patients without reliable broadband. One leader may own all three questions, which makes the shared tracker more valuable.
• Ambulatory and physician networks grown by acquisition inherit clinicians with different licenses, tools and habits. Their main risk is inconsistency between practices.
• Digital-first behavioral health providers carry concentrated prescribing exposure and usually treat patients in many states. For them, licensure and controlled-substance rules define the business model.

The case for waiting, and why it was weak

A reasonable executive in May 2023 could have argued for waiting. Every deadline had been extended so far. Congress and the DEA were under heavy pressure from patients and clinicians. Building capacity models for rules that might never take effect could look like wasted effort, especially for a stretched clinic.

The argument had some merit. Organizations that hired for in-person capacity ahead of a rule that never came would have spent money they did not need to spend. The better answer was to build the analysis without committing the spending. A model of telehealth-only patients, their medications and their locations costs analyst time, not capital. It lets leaders decide quickly once a rule is final, and the same data serves every later extension.

Waiting had a second weakness: extensions often arrived late. Congress repeatedly acted close to expiry dates, and on occasion after them. An organization that waited for certainty had very little time left to act when certainty came.

Deadlines that are still moving

1. Who owns prescribing, licensure and tools here, and are those names written down?
2. How many of our patients receive controlled substances through a telehealth-only relationship, and if the prescribing rules tightened next quarter, how many in-person visits would they need, where, and who would provide them?
3. Do we record where the patient is at the start of each virtual visit, and does our scheduling system stop bookings when the clinician is not licensed there?
4. How do we know that no clinician, including at affiliated practices, is still using a consumer video or messaging app for patient care?
5. Where is our shared tracker of federal and state telehealth deadlines, and who updates it?

The common thread across all three questions is ownership. A shared tracker of deadlines from Congress, the DEA, CMS, OCR and the states, with a named owner for each line, kept organizations from discovering a lapse after it had happened.

With hindsight

The temporary extensions became a pattern. What looked in May 2023 like a short bridge to permanent rules turned into years of rolling deadlines.

The DEA extended its telemedicine prescribing flexibilities again in late 2023 and late 2024. In January 2025 it proposed a special registration for telemedicine, a separate permission clinicians could obtain to prescribe controlled substances remotely. It also finalized a separate rule on buprenorphine, a medication used to treat opioid use disorder. At the end of 2025 it extended the flexibilities through December 31, 2026, with the special registration still not final.

The sequence is worth tracing because each step reset planning. The DEA held public listening sessions on September 12 and 13, 2023. On October 10, 2023 it issued a second extension, carrying the full flexibilities through December 31, 2024 for every patient and removing the November 2023 cohort cutoff. A third extension in November 2024 ran through 2025. The buprenorphine rule and a companion rule for Veterans Affairs patients, both published in January 2025, had their effective dates delayed twice, to December 31, 2025.

The special registration proposal would have created new registrations for telemedicine prescribers and for telemedicine platforms, and required checks of state prescription monitoring databases. For health systems, it signaled that remote prescribing would eventually carry its own credential to track, much like a state license. Enforcement against telehealth prescribing also arrived. In June 2024 the Justice Department charged executives of Done, a digital ADHD company, over alleged distribution of stimulants. The case concerned conduct rather than the flexibilities, but it kept pharmacies and payers wary of telehealth-only prescribing.

Congress extended Medicare telehealth flexibilities a few months at a time. They lapsed during the government shutdown in October and November 2025, were restored, and in February 2026 were extended through the end of 2027. The lapse showed that even payment rules many assumed were settled can stop at short notice, and that organizations need a plan for what happens to scheduled visits when they do.

The October 2025 lapse had practical effects. CMS told its contractors to return certain telehealth claims while Congress acted. The law that ended the shutdown on November 12, 2025 restored the flexibilities through January 30, 2026, and CMS applied it retroactively. A brief lapse followed at the end of January 2026. The February package then extended Medicare telehealth through 2027 and the hospital-at-home waiver through September 30, 2030.

Some workforce flexibilities became permanent. In its 2026 physician fee schedule rule, CMS made virtual direct supervision through real-time audio and video permanent for most services, excluding those with 010 or 090 global surgery periods. Teaching physicians kept virtual presence only for services furnished as Medicare telehealth. CMS also confirmed that clinicians working from home who have a physical practice location need not enroll their home address. The in-person requirement for tele-mental health at home now applies only after December 31, 2027.

Interstate licensure compacts added member states, though coverage remains incomplete. Licensure is still a state-by-state puzzle, and the check at the moment of scheduling remains the most reliable control.

OCR’s requirement that telehealth platforms comply with HIPAA has been stable and is now unremarkable. Of the three questions, it was the one a health system could settle with its own decisions, and most did.

The bar for those platforms kept rising. In January 2025 OCR proposed amendments to the HIPAA Security Rule that would require, among other things, a written inventory of technology assets and more specific safeguards. The 2024 rule on substance use disorder records under Part 2, with compliance due in February 2026, brought those records closer to HIPAA’s framework. Telehealth tools are covered by both.

In 2026 the hardest questions are still where clinicians are licensed and what they may prescribe remotely. Both are governed outside the health system and keep moving. Some rules can be complied with once and then left alone. Others you must track continuously, with named owners, capacity plans and a shared view of every deadline, because the people who set them have shown they will keep revisiting them. Treating telehealth regulation as a permanent operating discipline rather than a one-off transition project is what kept the organizations that did so from being surprised.