Checklist · Healthcare

Launching or Auditing a Telehealth Practice: A Practical Checklist

42 U.S.C. § 1395

Type
Checklist
Jurisdiction
National
Date
2025-11-27
Topic
Healthcare

This checklist covers launching a telehealth practice and auditing an existing one. It begins with the structural decisions — entity, ownership, and state footprint — then moves through licensure, credentialing, and payer enrollment. Separate sections address clinical protocols, consent, prescribing policy, and escalation planning. Later sections cover technology and vendor diligence, privacy and website review, marketing and compensation arrangements, and the documentation standards that defend an encounter. The final sections supply an audit program and a wind-down sequence for closing or transferring a practice.

Launching or Auditing a Telehealth Practice: A Practical Checklist

Healthcare > Telehealth and Remote Care | Published 27 November 2025 - Updated 16 May 2026 | UpLaw - uplaw.us

Structure and footprint

☐ Define the clinical model precisely — specialties, acuity, modalities, whether prescribing is contemplated, and whether any encounter type requires an in-person component. ☐ Choose the state footprint from data, not ambition. Every added state multiplies licensure, consent, prescribing, payer, and disciplinary exposure. ☐ Determine which footprint states enforce corporate practice restrictions, and design the entity structure accordingly. ☐ Form the professional entity or entities with ownership that satisfies each state's requirements, and register with licensing boards where required. ☐ Draft the management services agreement with a fee that is not a share of professional fees, and with clinical governance clearly reserved to the professional entity. ☐ Check fee splitting rules separately in each state; they operate independently of corporate practice doctrine. ☐ Confirm the ownership structure survives the friendly-professional-entity scrutiny that regulators apply — including what happens to shares on the owner's death, disability, or departure. ☐ Document clinical governance — who sets protocols, who reviews charts, who hires and disciplines clinicians, and who controls encounter length.

Licensure and credentialing

☐ Build the licensure matrix: practitioner, state, license type, number, expiration, compact status, and responsible owner. ☐ Confirm compact eligibility for each practitioner, including disciplinary history and education conditions. ☐ Understand what each compact actually provides — expedited licensure in some professions, a practice privilege in others. ☐ Confirm scope of practice for each practitioner type in each state, including independent practice authority. ☐ Execute collaborative or supervisory agreements meeting each state's content requirements, and confirm whether the supervising practitioner must be licensed in that state. ☐ Check supervision ratio limits, which can constrain the staffing model. ☐ Calendar every renewal with a ninety-day lead, and assign one accountable owner for the whole matrix. ☐ Confirm reporting obligations — a board action in one state is reportable in every other. ☐ For hospital or health system work, confirm the credentialing method, including whether credentialing by proxy is available under 42 C.F.R. Part 482 or 42 C.F.R. Part 485 and whether the agreement satisfies its conditions.

Payer enrollment and billing setup

☐ Enroll and credential each practitioner with each payer in each state where patients will be treated. ☐ Build the payer matrix: payer, state, covered modalities, eligible codes, place-of-service and modifier requirements, documentation elements, and rate. ☐ Confirm Medicare authority and current sunset dates under 42 U.S.C. § 1395m and its implementing rules at 42 C.F.R. Part 410 and 42 C.F.R. Part 414. ☐ Confirm Medicaid rules state by state within the frame at 42 U.S.C. § 1396a. ☐ Identify coverage parity and payment parity statutes in each state, and model the economics on the actual rates. ☐ Confirm audio-only coverage where the patient population needs it. ☐ Establish a cost-sharing policy that does not routinely waive amounts, given 42 U.S.C. § 1320a-7b. ☐ Set up claim edits enforcing place of service, modifiers, and required documentation elements before submission.

Clinical protocols and consent

☐ Write modality-selection criteria: which presentations may be handled by video, audio-only, or asynchronous review, and which require in-person care. ☐ Write the escalation protocol with specific triggers and a state-specific emergency resource list. ☐ Build location verification into the encounter workflow, with an affirmative patient answer recorded each visit and a hard stop for unlicensed states. ☐ Build identity verification for both patient and practitioner. ☐ Assemble the consent library — a base form plus a supplement for each state with specific disclosure requirements. ☐ Include in consent: modality limitations, circumstances requiring in-person care, emergency instructions, practitioner identity and licensure with verification method, recording and data use, financial disclosure, and prescribing limits. ☐ Address minors — consent authority, minor-consent categories, and a scripted question confirming whether the patient can speak freely. ☐ Address interpretation and accessibility, including captioning and screen-reader compatibility on the platform.

Prescribing policy

☐ State the drug classes the practice will prescribe remotely, by state, and the classes it will not. ☐ Map the federal framework — 21 U.S.C. § 802, 21 U.S.C. § 823, 21 U.S.C. § 829, and 21 U.S.C. § 831, with implementation at 21 C.F.R. Part 1300, 21 C.F.R. Part 1301, and 21 C.F.R. Part 1306. ☐ Identify which exception or flexibility each remote controlled-substance prescription relies on, and require the chart to say so. ☐ Calendar the expiration of every temporary flexibility the model depends on, and write the contingency plan now. ☐ Build prescription monitoring program checks into the workflow, at the frequency each state requires. ☐ Apply state examination requirements that exceed federal law. ☐ Prohibit prescribing from a questionnaire alone where any footprint state forbids it, and confirm the platform enforces it. ☐ Document the clinical basis for every controlled substance prescription in terms that survive review under an objective standard, notwithstanding the subjective criminal standard confirmed in Ruan v. United States. ☐ Track declined prescriptions as a quality metric; a practice that never declines is a practice with a problem.

Technology, vendors, and privacy

☐ Diligence the platform — security architecture, encryption, access controls, audit logging, uptime, support, and incident history. ☐ Execute business associate agreements with the platform and every subcontractor touching protected information, consistent with 45 C.F.R. Part 160 and 45 C.F.R. Part 164. ☐ Confirm data ownership and export rights in a usable format, before signing. ☐ Confirm breach notification timelines in the contract are short enough to meet the practice's own obligations under 42 U.S.C. § 1320d and its rules. ☐ Conduct and document a security risk analysis covering the platform, endpoints, and clinicians' remote work environments. ☐ Audit the patient-facing website for tracking technologies that transmit condition-identifying information; remove or gate them. ☐ Review recording practices against two-party consent states and record-set obligations. ☐ Review offshore support and transcription arrangements for contractual controls and disclosure obligations. ☐ Confirm device data arrangements for remote patient monitoring, including who holds the data and under what terms. ☐ Establish record production capability, so a patient request can be met on time regardless of which system holds the record.

Marketing, referrals, and compensation

☐ Review every marketing and lead-generation contract for compensation that varies with orders, prescriptions, tests, or completed consults. ☐ Restructure to time-based or flat compensation where volume-linked payment exists. ☐ Confirm the marketing vendor does not control clinical protocols, scripts that direct outcomes, or encounter length. ☐ Review clinician compensation for the same defect. ☐ Review relationships with laboratories, equipment suppliers, and pharmacies against 42 U.S.C. § 1320a-7b and 42 U.S.C. § 1395nn. ☐ Review advertising claims for substantiation and for professional advertising rules in each state. ☐ Remember the materiality standard in Universal Health Services, Inc. v. Escobar: billing while failing to disclose noncompliance with a material requirement can make the claim false. ☐ Confirm no arrangement produces an exclusion risk under 42 C.F.R. Part 1001.

Insurance

☐ Confirm the malpractice policy names telehealth expressly and covers every state where patients are located. ☐ Confirm coverage for every modality used, including asynchronous and messaging-based care. ☐ Confirm tail coverage arrangements for departing clinicians. ☐ Confirm cyber coverage for platform incidents and its interaction with the vendor's indemnity. ☐ Re-confirm at every renewal and every new state, and keep certificates in the compliance file.

Documentation standards

☐ Modality used and one sentence on why it fit this presentation. ☐ Patient's verified physical location and identity verification method. ☐ What could not be assessed remotely. ☐ Escalation instructions given, with specific triggers and timeframes. ☐ Technology problems, noted contemporaneously. ☐ Follow-up plan and the patient's acknowledgment. ☐ Consent obtained, including any state-specific supplement. ☐ For controlled substances, the exception or flexibility relied on. ☐ ⚠️ A telehealth note that is indistinguishable from an in-person note is a defect, not a virtue.

The audit program

☐ Chart audit — sample encounters for location verification, modality justification, escalation instructions, and consent completeness. ☐ Licensure audit — confirm each practitioner held a valid license in every state they treated in during the period. Run this before a regulator does. ☐ Claims audit — sample claims against documentation, codes, modifiers, and place of service. ☐ Prescribing audit — controlled substance encounters against policy and applicable exception, plus monitoring program query compliance. ☐ Access audit — who viewed which records and whether access was job-related. ☐ Vendor audit — agreements current, subcontractors disclosed, breach terms adequate, export capability tested. ☐ Website audit — tracking technologies, accessibility, and advertising claims. ☐ Compensation audit — confirm no arrangement rewards ordering. ☐ Document each audit, its findings, and the corrective actions taken, because the audit file is the compliance program's proof of life.

Wind-down or transfer

☐ Test data export before it is needed, and confirm the format is usable. ☐ Provide patient notice meeting each state's timing and content rules. ☐ Arrange record custody for each state's retention period, with a named custodian and contact. ☐ Address prescription continuity, especially for controlled substances and chronic therapy. ☐ Notify payers, boards, and the malpractice carrier as required, and secure tail coverage. ☐ Terminate vendor agreements with data return or destruction certified in writing. ☐ Preserve the compliance file, which will outlive the practice and may be needed for years.

📌 Two controls prevent more problems than everything else on this list: an accurate licensure matrix and a location verification hard stop. Build those first, and build the rest around them.

Working notes on the items that go wrong

Location verification. The temptation is to collect the patient's address at registration and treat that as the answer. It is not. Patients travel, patients have two homes, patients join from a car, and college students join from a dormitory in a state nobody entered into the record. The verification must be an affirmative question the patient answers at the start of each encounter, recorded in the chart, and it must be enforced by the system rather than by the clinician's memory. When a practice tells you it verifies location, ask to see the screen.

The licensure matrix. Practices build the matrix once and then let it decay, because renewals happen at different intervals in different states and compact status changes. A matrix without a named owner and a quarterly review date is a document, not a control. The audit that finds problems is the one that compares treated states against licensed states for the actual period, patient by patient.

Consent supplements. A national consent form fails in the specific states that require specific disclosures — practitioner identity and licensure verification, the right to refuse telehealth and receive in-person care, security limitations, and recording practices. Build the base form and a one-page supplement per state, and review them annually.

Prescribing policy drift. Policies written when a flexibility was in force are rarely rewritten when it changes. The result is a clinician relying on training that is no longer accurate. Date every prescribing policy, name the authority it relies on, and review it on the calendar rather than on the news.

Vendor data export. Practices discover the export problem at the worst possible moment: when they are changing platforms, responding to a records request, or closing. Test the export at contracting and again annually, and confirm the format is something another system can ingest.

Website tracking. Marketing teams add analytics and advertising tags without clinical or legal review, and the tags transmit page URLs that identify a condition. This is the most common privacy defect in the field and among the easiest to fix. Audit quarterly, and require legal review before any new tag is deployed.

Compensation structures. The arrangement that pays a clinician per completed consult, with a product available at the end of the consult, is the shape enforcement targets. It is also the shape that investors like, because it scales. Raise this before the term sheet, not after the subpoena.

Malpractice coverage gaps. A practitioner licensed in twelve states and covered in eight will not discover the gap until a claim arrives from one of the other four. Compare the coverage schedule against the licensure matrix at every renewal, in writing.

A quick-start sequence for a new practice

☐ Week one. Define the clinical model and the initial state footprint. Identify corporate practice states. Engage counsel in the two or three states with the most restrictive rules, because their requirements will shape the national design. ☐ Weeks two to four. Form entities, draft the management services agreement, and begin licensure applications, which have the longest lead time. ☐ Weeks four to eight. Select the platform and complete security and contractual diligence. Execute business associate agreements. Test data export. ☐ Weeks six to twelve. Build the consent library, the prescribing policy, the escalation protocol, and the location verification workflow. Begin payer enrollment, which is slower than anyone expects. ☐ Before the first encounter. Confirm malpractice coverage in every launch state, confirm every clinician's licenses, run a test encounter end to end including the unlicensed-state hard stop, and confirm the record can be produced. ☐ Ninety days after launch. Run the first full audit. Fix what it finds. The first audit always finds something, and finding it at ninety days is cheap.

If a complaint or investigation arrives

☐ Identify the source — patient complaint, board inquiry, payer audit, or subpoena — because each has different timelines and different stakes. ☐ Preserve everything immediately, including platform logs the vendor controls. ☐ Determine which state's board has jurisdiction, which will be the patient's state. ☐ Engage counsel licensed in that state, and notify the malpractice carrier promptly. ☐ Do not respond substantively before the record is assembled, and never assume an informal inquiry is informal. ☐ Check the reporting obligations triggered in every other state where the practitioner holds a license. ☐ Assess whether the conduct implicates billing, because a licensure defect can convert into a payment problem quickly. ☐ Document the corrective action taken, which matters at every stage of every proceeding this field produces.

Modality-specific additions

If the practice uses audio-only care, confirm coverage by payer and state, document why video was not used in each instance, and confirm the clinical protocol identifies which presentations audio-only cannot support. Several states require the documentation explicitly, and payers increasingly audit for it.

If the practice uses asynchronous review, confirm each footprint state accepts it as establishing a practitioner-patient relationship, confirm prescribing from a questionnaire alone is not prohibited, and set a maximum turnaround time that the workflow enforces. Build in a mechanism for the reviewing clinician to require a synchronous encounter, and track how often that happens.

If the practice offers remote patient monitoring, confirm the device supply and data transmission requirements for each billed code, track transmission days per patient per period, log clinical review time contemporaneously, and confirm who holds the device data and under what agreement. Billing months with insufficient transmission days is the most common audit finding in this service line.

If the practice offers messaging-based care, define response-time commitments in the patient agreement, state after-hours limits plainly, route urgent messages to a monitored channel, and confirm that clinical messages become part of the record. Undefined expectations create both clinical risk and complaints.

If the practice serves patients in institutional settings — correctional facilities, long-term care, schools — confirm who consents, who may be present, how records are shared, whether a facility fee is billed and by whom, and what the escalation path is inside that facility.

If the practice provides crisis or behavioral health services, build a state-specific crisis resource list, confirm duty-to-warn and mandatory reporting obligations in each state, and rehearse the protocol. A crisis plan that names only a national hotline is not a plan.

The seven questions to answer before every encounter

☐ Where is the patient, physically, right now? Recorded, this visit. ☐ Is this clinician licensed there, or does a documented exception apply? ☐ Does this modality support the standard of care for this presentation? ☐ What consent applies in this state, and has it been obtained? ☐ May this clinician prescribe what this patient is likely to need, from here? ☐ Will this encounter be paid for, in this modality, by this payer? ☐ Who will hold the record, and can we produce it on request?

A practice that can answer all seven, on every visit, without stopping to research, has built the program. A practice that cannot answer the first one has not started.

Related Documents