Toolkit · Healthcare

The Telehealth Licensure, Prescribing, and Reimbursement Toolkit

21 U.S.C. § 829

Type
Toolkit
Jurisdiction
National
Date
2025-10-21
Topic
Healthcare

This toolkit supplies working documents for a telehealth practice. Tool 1 is a licensure and coverage matrix that anchors the entire compliance program, and Tool 2 is a location and identity verification script with the hard-stop logic that enforces it. Tool 3 is a telehealth consent framework with a state supplement template, and Tool 4 is a prescribing policy template keyed to drug class and state. Tool 5 is a payer and billing matrix, and Tool 6 is a platform and vendor diligence questionnaire with business associate terms. Tool 7 is an escalation and crisis protocol template, and Tool 8 is a chart audit worksheet. Tool 9 is a marketing and compensation review memorandum, and Tool 10 is a consolidated authority table.

The Telehealth Licensure, Prescribing, and Reimbursement Toolkit

Healthcare > Telehealth and Remote Care | Published 21 October 2025 - Updated 16 April 2026 | UpLaw - uplaw.us

How to use this toolkit. Tool 1 is the foundation; build it first and keep it current. Bracketed text is for completion. The guide supplies the doctrine and the checklist supplies the sequence.

TOOL 1 — LICENSURE AND COVERAGE MATRIX

Practice: [name] · Updated: [date] · Owner: [name, role]

Clinician Profession State License no. Expires Compact Scope notes Supervision required Malpractice covers state Payer enrollment
[name] [MD/NP/PA/LCSW] [ST] [no.] [date] [Y/N, type] [independent / collaborative] [name of supervisor] [Y/N] [payers]

States we treat in but are not licensed in: [must be empty]

States licensed in but no longer serving: [consider not renewing — each license carries disciplinary exposure]

Next review date: [date] · Renewals due in next 90 days: [list]

☐ Reconcile quarterly against actual encounter data, not against intentions. ☐ Compare against the malpractice coverage schedule at every policy renewal. ☐ Record compact status and its conditions, since eligibility can lapse. ☐ Note every disciplinary action anywhere, because it is reportable everywhere.

⚠️ If this table is not accurate, nothing else in the compliance program can be.

TOOL 2 — LOCATION AND IDENTITY VERIFICATION SCRIPT

At the start of every encounter, recorded in the chart:

"Before we begin, I need to confirm a few things. First, what state are you physically in right now? [Record.] Second, please confirm your full name and date of birth. [Verify against the record.] Third, are you somewhere you can speak freely, or is anyone else present? [Record.] Fourth, in case we get disconnected or you need urgent care, what is the address where you are right now? [Record.]"

System logic

☐ If the state is one where the treating clinician is licensed → proceed. ☐ If not → hard stop. Present the scripted path: offer to reschedule for when the patient returns, offer transfer to a clinician licensed in that state, or, if the presentation is emergent, direct to emergency care and document. ☐ If the patient declines to answer → do not proceed with treatment; document the refusal.

Scripted rescheduling language: "I am not licensed to provide care to patients located in [state], so I cannot treat you while you are there. Here is what we can do instead: [options]. If this is an emergency, please call emergency services or go to the nearest emergency department."

📌 The hard stop must be enforced by the system, not by the clinician's memory. Ask any vendor to demonstrate it before signing.

TOOL 3 — CONSENT FRAMEWORK

Base telehealth consent — core elements

1. Nature of the service. [Description of telehealth, the modalities used, and what it can and cannot do.]

2. Limitations. [Physical examination is not possible; some conditions require in-person evaluation; technology may fail; the clinician may determine at any point that an in-person visit is required.]

3. Practitioner identity. [Name, credentials, states of licensure, license numbers, and how to verify with the licensing board.]

4. Emergency protocol. [What to do in an emergency; the patient's obligation to provide an accurate location.]

5. Privacy. [How information is protected; who the platform is and its role; whether encounters are recorded; how data is used.]

6. Financial. [Charges, insurance, and what the visit costs if not covered.]

7. Prescribing. [What may and may not be prescribed remotely; that no prescription is guaranteed.]

8. Right to refuse. [The patient may decline telehealth and request in-person care.]

9. Signature and date, with a renewal interval.

State supplement — [ST]

Requirement Text required Where addressed Reviewed
[Written consent required] [ ] [§__] [date]
[Verbal consent documented each visit] [ ] [ ] [ ]
[Disclosure of licensure verification method] [ ] [ ] [ ]

TOOL 4 — PRESCRIBING POLICY TEMPLATE

Remote prescribing policy — effective [date] · Review date [date] · Owner [name]

1. Non-controlled medications. May be prescribed remotely where the clinician has established a practitioner-patient relationship consistent with the patient state's requirements and has an adequate clinical basis. Document the basis.

2. Controlled substances — general rule. No controlled substance is prescribed remotely except where a specific exception or current flexibility applies, and the chart must identify which one. Federal framework: 21 U.S.C. § 829, definitions at 21 U.S.C. § 802, registration at 21 U.S.C. § 823, special registration at 21 U.S.C. § 831, regulations at 21 C.F.R. Part 1306.

3. Authority relied on, by state.

State Schedule II Schedules III–V In-person exam required? PDMP query Initial supply limit Authority relied on Expires
[ST] [No / Yes with X] [ ] [ ] [each Rx / every 90 days] [ ] [exception / flexibility] [date]

4. Prohibited practices. No prescribing from a questionnaire alone. No prescribing without verified patient location. No prescribing where the clinician is not licensed in the patient's state.

5. Documentation required. Clinical basis, examination performed and its limits, the exception relied on, PDMP query result, and the plan for follow-up.

6. Contingency. If [flexibility] expires on [date], the practice will [convert to in-person requirement / partner with in-state providers / suspend the service line]. Owner: [name]. Trigger date: [date minus 60 days].

⚠️ Date this policy and name its authority. A prescribing policy without an expiration review is the most common way a compliant practice becomes non-compliant without noticing.

TOOL 5 — PAYER AND BILLING MATRIX

Payer State Modalities covered Eligible codes Place of service Modifiers Documentation elements Rate Parity statute Notes
[Medicare] [ST] [video; audio-only for __] [ ] [ ] [ ] [time; consent; interactivity] [ ] [n/a] [sunset date __]
[Medicaid] [ST] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]
[Commercial] [ST] [ ] [ ] [ ] [ ] [ ] [ ] [coverage / payment] [ ]

☐ Federal authority: 42 U.S.C. § 1395m, 42 U.S.C. § 1395x, 42 C.F.R. Part 410, 42 C.F.R. Part 414, 42 C.F.R. Part 424; Medicaid frame at 42 U.S.C. § 1396a. ☐ Build claim edits enforcing place of service and modifiers before submission. ☐ Audit a claim sample quarterly against the documentation. ☐ Do not routinely waive cost sharing — 42 U.S.C. § 1320a-7b.

TOOL 6 — PLATFORM AND VENDOR DILIGENCE QUESTIONNAIRE

☐ Where is data stored, and in what jurisdictions? ☐ Is data encrypted in transit and at rest, and who holds the keys? ☐ What access controls and audit logging exist, and can we obtain the logs? ☐ Who are the subcontractors, and are business associate terms flowed down? ☐ What is the breach notification timeline to us, and does it let us meet our own deadlines? ☐ What does the export produce, in what format, and how long does it take? Test it. ☐ Who owns the data, and what happens to it at termination? ☐ What is the uptime commitment and the support escalation path? ☐ Does the platform enforce a location verification hard stop, and can we configure the licensed-state list? ☐ Does the platform support state-specific consent presentation? ☐ Are recordings made, where are they stored, and for how long? ☐ What analytics or advertising technologies run on patient-facing pages? Require a written list. ☐ Has the vendor had a reportable breach, and what changed after it? ☐ Will the vendor accept indemnity for breaches caused by its own systems?

📌 Business associate obligations sit under 45 C.F.R. Part 160 and 45 C.F.R. Part 164, with the statutory frame at 42 U.S.C. § 1320d and penalties at 42 U.S.C. § 1320d-6.

TOOL 7 — ESCALATION AND CRISIS PROTOCOL

Escalation protocol — [Practice], effective [date]

Convert to in-person or emergency care when: [list clinical triggers by service line — chest pain, focal neurological findings, suspected sepsis, acute abdomen, suicidal ideation with plan, and any presentation the clinician cannot adequately assess remotely].

Steps. 1. Tell the patient plainly what is needed and why. 2. Confirm the patient's exact current address. 3. Identify the nearest appropriate facility from the state resource list. 4. Arrange or direct transport. 5. Where risk is imminent, stay connected until help arrives if safe to do so. 6. Document the trigger, the instruction, and the patient's response.

State resource appendix — [ST]: [emergency services; crisis lines; mobile crisis teams; mandatory reporting obligations; duty-to-warn standard].

☐ Rehearse the protocol with clinicians, and update the resource appendix annually.

TOOL 8 — CHART AUDIT WORKSHEET

Element Present? Notes
Patient location verified this visit [Y/N]
Clinician licensed in that state [Y/N]
Identity verification documented [Y/N]
Consent current, with state supplement [Y/N]
Modality documented with justification [Y/N]
Limits of remote assessment noted [Y/N]
Escalation instructions given [Y/N]
Technology issues noted if any [Y/N]
Follow-up plan and acknowledgment [Y/N]
Prescription: basis and exception documented [Y/N]
PDMP queried where required [Y/N]
Billing elements supported [Y/N]

☐ Sample size: [__] charts per clinician per quarter, weighted toward new patients and controlled substance encounters. ☐ Report findings to clinical governance, with corrective actions and a re-audit date.

TOOL 9 — MARKETING AND COMPENSATION REVIEW

Arrangement: [name] · Counterparty: [ ] · Reviewed: [date]

1. What is paid, and on what basis? [Flat / hourly / per encounter / per order / percentage.] 2. Does compensation vary with the number of orders, prescriptions, tests, or products? [Yes = stop and restructure.] 3. Does the counterparty control clinical protocols, scripts, encounter length, or scheduling in a way that affects clinical judgment? [Yes = restructure.] 4. Does the arrangement involve a supplier, laboratory, or pharmacy with a financial relationship to the practice? [Analyze under 42 U.S.C. § 1320a-7b and 42 U.S.C. § 1395nn.] 5. What is the declined-order rate under this arrangement? [A rate near zero is a finding.] 6. Materiality analysis. [Under Universal Health Services, Inc. v. Escobar, would nondisclosure of any noncompliance here be material to payment?] 7. Conclusion. [Approved / approved as restructured / declined.] Reviewer: [name].

TOOL 10 — AUTHORITY TABLE

Provision Subject
21 U.S.C. § 802 Controlled Substances Act definitions, including telemedicine
21 U.S.C. § 823 Registration of practitioners
21 U.S.C. § 829 Prescriptions and internet prescribing
21 U.S.C. § 831 Special registration and online pharmacy provisions
21 U.S.C. § 353 Prescription drug requirements
21 C.F.R. Part 1300 Definitions
21 C.F.R. Part 1301 Registration requirements
21 C.F.R. Part 1306 Prescriptions
42 U.S.C. § 1395m Medicare payment, including telehealth
42 U.S.C. § 1395x Definitions of covered services
42 U.S.C. § 1396a Medicaid state plan requirements
42 U.S.C. § 1320a-7b Anti-kickback statute
42 U.S.C. § 1395nn Physician self-referral
42 U.S.C. § 1320d Administrative simplification and privacy
42 U.S.C. § 1320d-2 Standards for information
42 U.S.C. § 1320d-6 Wrongful disclosure penalties
18 U.S.C. § 1347 Health care fraud
42 C.F.R. Part 410 Medicare Part B benefits
42 C.F.R. Part 411 Exclusions and self-referral
42 C.F.R. Part 414 Payment for Part B services
42 C.F.R. Part 424 Claims and provider enrollment
42 C.F.R. Part 482 Hospital conditions of participation
42 C.F.R. Part 485 Critical access hospital conditions
42 C.F.R. Part 1001 Program exclusions
45 C.F.R. Part 160 Privacy and security general provisions
45 C.F.R. Part 164 Privacy, security, and breach notification
Ruan v. United States Mental state required for unlawful prescribing
Gonzales v. Oregon Federal authority does not define medical practice
Universal Health Services v. Escobar Implied certification and materiality
Rutledge v. PCMA State authority over pharmacy benefit managers
Semler v. Oregon Board of Dental Examiners State authority over professional practice
Bigelow v. Virginia Commercial speech and professional advertising

Closing note

Build Tool 1 first, enforce Tool 2 in software, and date Tool 4. Those three steps prevent the majority of what goes wrong in telehealth compliance. The rest of this toolkit supports them.

TOOL 11 — STATE FILE TEMPLATE

State: [ST] · Prepared: [date] · Owner: [name] · Next review: [date]

Licensure. Licenses held and by whom. Compact participation and conditions. Telemedicine registration available? Consultation exception scope. Continuity-of-care exception and its limits. Emergency exception.

Scope and supervision. Independent practice authority by profession. Collaborative or supervisory agreement required, and its content requirements. Must the supervisor be licensed here? Ratio limits. Chart review obligations.

Relationship and modality. What establishes a practitioner-patient relationship. Is asynchronous review sufficient? Is audio-only recognized? Any required initial in-person encounter.

Consent. Telehealth-specific consent required? Written or verbal? Required disclosures. Renewal interval.

Prescribing. Classes prescribable remotely. In-person examination requirements beyond federal law. PDMP query obligations and frequency. Initial supply limits. Questionnaire prescribing prohibited?

Payment. Medicaid coverage, modalities, and rate. Coverage parity statute. Payment parity statute. Audio-only coverage. Facility fee. Required modifiers or place of service.

Privacy and records. State health data statutes beyond the federal framework. Recording consent rule. Record retention period. Patient notice on closure or transfer.

Structure. Corporate practice enforcement. Fee splitting rules. Professional entity ownership requirements and board registration.

Escalation. Crisis resources. Mandatory reporting. Duty-to-warn standard.

Sources consulted and date. [Practice act citation, board rules, payer manual, statute.]

⚠️ A stale state page is worse than no page, because someone will rely on it. Put the review date at the top and hold to it.

TOOL 12 — CLINICIAN ONBOARDING PACKET

☐ Licensure verification for every state the clinician will treat in, with primary source verification ☐ Compact status confirmed and conditions documented ☐ Collaborative or supervisory agreements executed where required ☐ Malpractice coverage confirmed for telehealth and for each state, certificate on file ☐ Payer enrollment and credentialing completed before the first billable encounter ☐ Prescribing policy reviewed and acknowledged in writing ☐ Escalation protocol reviewed, with the state resource appendices for their footprint ☐ Documentation standards training completed, with a sample chart reviewed ☐ Platform training including the location verification workflow and the hard stop ☐ Privacy and security training, including the remote work environment requirements ☐ Compensation structure documented and confirmed not to vary with orders ☐ Acknowledgment that a board action anywhere is reportable everywhere, with a duty to notify the practice immediately

📌 Do not permit an encounter before every item above is complete. The cost of one unlicensed encounter exceeds the cost of a slow onboarding by orders of magnitude.

A final word on maintenance. Every tool here decays. Licenses expire, flexibilities sunset, payers change modifier requirements, vendors add analytics tags, and clinicians move. Assign each tool an owner and a review interval, put the review dates on one calendar, and treat a missed review as an incident rather than an oversight.

Related Documents