Telehealth has transformed the delivery of medical care and created extraordinary opportunities for providers to build practices that serve patients far beyond their geographic location. It has also created a complex and frequently misunderstood regulatory environment that represents one of the most significant sources of license risk for providers who do not fully understand the rules. This article covers the foundational legal requirements for multi-state telehealth prescribing, the DEA framework for controlled substances, documentation standards that demonstrate compliance, and practical guidance for building a telehealth practice that is legally sound.
THE FUNDAMENTAL RULE: PATIENT LOCATION GOVERNS
The single most important principle in telehealth compliance is also the one most frequently misunderstood. In the United States, the practice of medicine is regulated at the state level - and the state whose laws govern any given clinical encounter is the state where the patient is physically located at the time of the visit.
This means that if you are licensed in Florida and your patient is physically located in Georgia during your telehealth visit, you are practicing medicine in Georgia. Georgia law applies to that encounter. Georgia's licensing requirements, scope of practice regulations, prescribing laws, and standard of care apply. Your Florida license does not authorize you to practice medicine in Georgia regardless of where you are sitting or where your practice is registered.
The practical implication is significant. Every state where your patients are physically located during telehealth visits is a state where you need a valid license to practice. Providers who conduct telehealth visits with patients in multiple states without holding licenses in each of those states are practicing medicine without a license in the unlicensed states - a serious regulatory violation with consequences that can include criminal charges, civil liability, and board action in your home state for unprofessional conduct.
This is not a technicality that regulators ignore. State medical and nursing boards have pursued disciplinary action against providers for unlicensed telehealth practice, and the increasing sophistication of regulatory monitoring makes the risk of detection higher than many providers assume.
STATE LICENSING OPTIONS FOR MULTI-STATE TELEHEALTH PRACTICE
For providers who want to serve patients in multiple states, several licensing pathways exist that make multi-state practice more accessible than it was a decade ago.
Individual state licensure. The traditional approach is to obtain a full license in each state where you want to practice. This is the most comprehensive protection but also the most time and cost-intensive approach. For providers serving patients in a small number of states, individual licensure in each state is straightforward if time-consuming.
The Nurse Licensure Compact. For registered nurses and advanced practice registered nurses, the Nurse Licensure Compact - NLC - allows multistate practice under a single license issued by the provider's home state. As of 2024, the majority of US states participate in the NLC. APRN practice under the NLC is subject to specific requirements that vary by state, and providers should verify the specific scope of APRN practice permitted under the compact in each state where they intend to practice.
The Interstate Medical Licensure Compact. For physicians, the Interstate Medical Licensure Compact - IMLC - provides an expedited licensing pathway that allows physicians to obtain licenses in multiple member states more efficiently than applying individually to each state. Participation requires holding a full unrestricted license in a qualifying home state and meeting specific eligibility criteria.
State telehealth registration and certificates of authority. Some states offer telehealth-specific registration or certificates of authority that permit out-of-state providers to conduct telehealth visits with patients in that state without obtaining a full license. These vary significantly in scope - some permit only consultation with in-state providers, while others allow direct patient care - and providers must review the specific requirements of each state's telehealth registration before relying on it as authorization to prescribe.
DEA REQUIREMENTS FOR TELEHEALTH PRESCRIBING OF CONTROLLED SUBSTANCES
The prescribing of controlled substances via telehealth is subject to both state law requirements and federal DEA regulations - and the federal framework has undergone significant change since the COVID-19 public health emergency that temporarily expanded telehealth prescribing flexibility.
The Ryan Haight Act baseline. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 established the general requirement that a valid prescription for a controlled substance requires at least one in-person medical evaluation before prescribing via the internet. The pandemic-era public health emergency created temporary exceptions to this requirement that allowed controlled substances to be prescribed via telehealth without an in-person evaluation.
Post-pandemic regulatory evolution. The DEA has worked to establish permanent regulations governing telehealth prescribing of controlled substances following the expiration of the public health emergency flexibilities. The regulatory landscape in this area has continued to evolve and providers who prescribe controlled substances via telehealth must stay current on the DEA's current requirements rather than assuming that pandemic-era flexibilities remain in effect.
State-level controlled substance requirements. In addition to federal DEA requirements, state laws governing controlled substance prescribing vary and may impose requirements beyond the federal minimum. Providers must comply with the controlled substance laws of both their home state and the patient's state for any controlled substance prescription.
DEA registration for multi-state practice. A DEA registration is generally specific to a registered location. Providers practicing in multiple states may need to consider whether their DEA registration covers prescribing to patients in all states where they practice, and should consult with a healthcare attorney familiar with DEA registration requirements if they have questions about their specific situation.
DOCUMENTATION STANDARDS FOR TELEHEALTH COMPLIANCE
Documentation in telehealth practice serves an additional compliance function beyond its standard clinical and legal purposes - it demonstrates that the provider complied with applicable telehealth laws at the time of the visit.
Patient location documentation. Every telehealth visit note should document the patient's physical location at the time of the visit. This confirms that the provider was licensed in the state where the patient was located and establishes the regulatory framework that governed the encounter. A brief note - patient located in [state] at time of visit - adds minimal time to the documentation process and provides important compliance evidence.
Technology and platform documentation. Document the telehealth platform used for the visit and confirm that it meets applicable HIPAA requirements for protected health information transmission. Telehealth visits conducted over non-HIPAA-compliant platforms- including standard consumer video conferencing applications - are a HIPAA compliance issue that is separate from but related to the licensure compliance issues discussed above.
Informed consent for telehealth. Many states require that patients provide specific informed consent for telehealth services - consent that is distinct from standard treatment consent and that acknowledges the nature of telehealth, its limitations, and the patient's right to in-person care. Confirming that telehealth-specific informed consent has been obtained and documenting it in the chart note addresses this requirement.
Prescribing documentation for controlled substances. When controlled substances are prescribed via telehealth, the chart note should document the specific clinical basis for the prescription, any prior in-person evaluation history, and the regulatory basis under which the prescription is being issued - whether that is a DEA-registered exception, compliance with current DEA telehealth regulations, or another documented basis.
PRACTICAL STEPS FOR BUILDING A COMPLIANT MULTI-STATE TELEHEALTH PRACTICE
The following practical steps provide a framework for providers who want to build or formalize a compliant multi-state telehealth practice.
Audit your current patient geography. Review your patient panel and identify every state where your patients are physically located during telehealth visits. This audit tells you which states you need licenses in - and may reveal states where you are currently practicing without a license that require immediate attention.
Obtain licenses in all states where you currently have patients. Prioritize obtaining licenses in states where you have current patients before expanding to new markets. Use the NLC or IMLC where applicable to streamline the multi-state licensing process.
Implement a patient location verification process. Build a process into your intake and scheduling workflow that verifies and documents the patient's physical location at the time of each telehealth visit. This can be as simple as a brief confirmation at the start of each visit that is documented in the visit note.
Review your controlled substance prescribing practices against current DEA requirements. If you prescribe controlled substances via telehealth, confirm that your prescribing practices are compliant with current DEA regulations - not the pandemic-era flexibilities that may no longer apply.
Consult with a healthcare attorney for a telehealth compliance review. For providers with established or rapidly growing telehealth practices, a formal compliance review by a healthcare attorney familiar with multi-state telehealth law is a worthwhile investment. The cost of a compliance review is minimal compared to the cost of defending a board complaint or responding to a DEA investigation.
BOTTOM LINE
Telehealth compliance is not optional and it is not a technicality. The state where your patient is located governs your prescribing. Every state where your patients are located is a state where you need a license. The DEA framework for controlled substance prescribing continues to evolve and requires active monitoring. Providers who build their telehealth practices on a foundation of current, accurate knowledge of the applicable regulatory requirements protect their licenses, their practices, and their patients.
