Can my provider prescribe controlled substances by telehealth?

Sometimes — the rules are evolving. The federal Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (21 USC § 829(e)) generally requires an in-person evaluation before a controlled-substance prescription via telehealth. Public health emergency waivers expanded this; some flexibilities have been extended (most recently through Dec. 31, 2025 by DEA) and some are permanent (buprenorphine for opioid use disorder, per DEA final rule effective March 2024). Schedule II stimulants and most other controlled substances generally still require an in-person evaluation. State law may add further restrictions.

Is telehealth as good as an in-person visit?

For many conditions — yes. Telehealth has been validated for: medication management, follow-up of stable chronic conditions, behavioral health, dermatology consultation with photos, ophthalmology screening, low-acuity acute care (cold symptoms, simple urinary tract infection in low-risk patients). For many other conditions — no. Telehealth cannot substitute for: physical examination of the abdomen, ears, joints, neurologic exam beyond visual; in-office procedures; situations where vital signs are critical (e.g., severe shortness of breath); and many initial visits where the differential diagnosis requires examination. The provider has an affirmative duty to recognize when telehealth is inadequate.

Is the platform secure? Can someone hack the visit?

HIPAA-compliant platforms (Doxy.me, Zoom for Healthcare, Microsoft Teams Business with BAA, Cisco Webex, etc.) implement end-to-end or transit encryption, authentication, and access controls. The risk of a sophisticated actor intercepting an encrypted video stream is low. The much larger privacy risk is the patient's own environment: people in the room, screen visible to others, microphone picking up conversation in the next room, devices on shared accounts. The patient should be in a private space with a secure device. Public WiFi without a VPN is risky.

What if I'm in another state when my visit happens?

Tell the practice BEFORE the visit. The provider must be licensed in the state where you are physically located at the time of the visit. If you have moved or are traveling, the practice may need to: (1) confirm the provider has licensure in that state, (2) reschedule for when you return, or (3) refer you to a provider in that state. Some compact-member-state combinations may permit it; some may not. Cross-state telehealth without proper licensure puts both you and the provider at risk.

Telehealth Informed Consent

Informed consent for virtual / telemedicine encounters — covers technology limitations, emergency procedures, state licensure, privacy/recording.

Customise

Practice / clinic name

Practice address

Patient — full name

Patient — date of birth

Provider — name + credentials

States where provider is licensed

State where patient is physically located during the visit

Telehealth platform / software

Type of telehealth encounter

Purpose of the visit

In-person alternative offered

Recording consent

Consent date

Live preview

TELEHEALTH INFORMED CONSENT

Practice:           Pacific NW Family Medicine
                    925 NW 19th Ave, Portland, OR 97209

═══════════════════════════════════════════════════════════════════════
1. PATIENT AND PROVIDER
═══════════════════════════════════════════════════════════════════════

Patient:            Jordan Alex Taylor
DOB:                June 12, 1985
Provider:           Dr. Lin Chen, MD
Provider licensed in: Oregon, Washington
Patient's state during visit: Oregon
Platform:           Doxy.me (HIPAA-compliant browser-based video)
Visit type:         Live two-way audio + video
Purpose:            Follow-up for migraine management. Review of headache diary and current preventive medication. Discussion of treatment adjustment if indicated.

═══════════════════════════════════════════════════════════════════════
2. NATURE OF TELEHEALTH
═══════════════════════════════════════════════════════════════════════

Telehealth uses electronic communication technology (video, audio,
messages, remote monitoring) to deliver healthcare services without
requiring the patient and provider to be in the same physical
location. Telehealth is recognized as a legitimate mode of healthcare
delivery by federal and state law and by most professional licensing
boards.

═══════════════════════════════════════════════════════════════════════
3. STATE LICENSURE
═══════════════════════════════════════════════════════════════════════

I understand that my provider must be licensed to practice in the
state where I am physically located at the time of the visit (NOT
where I live or where the provider is located). The provider's
licensure is listed above. If I will be physically located in a
different state at the time of a future visit, I will inform the
practice in advance to confirm the provider can lawfully treat me.

═══════════════════════════════════════════════════════════════════════
4. TECHNOLOGY LIMITATIONS AND RISKS
═══════════════════════════════════════════════════════════════════════

I understand that telehealth has limitations that an in-person visit
does not have:

• The provider cannot perform a physical examination beyond what is
  visible on camera or measurable by remote devices. Some conditions
  cannot be safely diagnosed or treated by telehealth.
• Visual quality, audio quality, or connection may be degraded by
  network or device problems. The provider may need to reschedule as
  in-person if technology fails.
• Some signs that an in-person provider would notice (subtle skin
  changes, gait abnormalities, breath odor, etc.) may be missed.
• Vital signs (blood pressure, oxygen saturation, temperature) cannot
  be measured by the provider directly; the patient may be asked to
  use home devices.
• The provider may determine during the visit that an in-person
  evaluation, an emergency department visit, or a referral is needed.

═══════════════════════════════════════════════════════════════════════
5. EMERGENCY PROCEDURES
═══════════════════════════════════════════════════════════════════════

In a medical emergency during a telehealth visit:

• If the patient is unresponsive or appears to be in immediate danger,
  the provider will call 911 or the local equivalent emergency
  service for the patient's stated location, using the address
  provided at the start of the visit.
• I confirm my current physical address: __________________________
  ____________________________________________________________________
  and I will inform the provider immediately if I move during the
  visit.
• A nearby emergency contact who can come to my location quickly:
  ___________________________________ (name) ____________ (phone)
• If I experience a medical emergency between scheduled telehealth
  visits, I will call 911 or go to the nearest emergency department.
  Telehealth is NOT for emergencies.

═══════════════════════════════════════════════════════════════════════
6. PRESCRIPTIONS AND CONTROLLED SUBSTANCES
═══════════════════════════════════════════════════════════════════════

The provider may prescribe medications via telehealth subject to
state and federal law. Controlled-substance prescribing via
telehealth is subject to the federal Ryan Haight Online Pharmacy
Consumer Protection Act (21 USC § 829(e)) and DEA regulations, which
generally require an in-person evaluation before initial controlled-
substance prescription, with limited and changing exceptions for
buprenorphine and certain other situations. The provider will follow
applicable law.

═══════════════════════════════════════════════════════════════════════
7. PRIVACY AND CONFIDENTIALITY
═══════════════════════════════════════════════════════════════════════

The platform listed above is HIPAA-compliant and implements
encryption in transit. However, I understand that:

• I am responsible for using the telehealth visit in a private space
  free from unauthorized listeners.
• Any device used (phone, tablet, computer) should be secured against
  unauthorized access.
• Anyone in the room with me during the visit will hear the
  conversation; I will inform the provider if anyone is present.
• Despite reasonable security measures, electronic communication
  carries some risk of interception.

RECORDING
No recording will be made without separate written consent

The provider will not record the visit without separate written
consent. I will not record the visit (audio, video, screenshots)
without informing the provider. Some states require all parties to
consent to a recording (two-party-consent states); I am responsible
for compliance with state law if I record.

═══════════════════════════════════════════════════════════════════════
8. ALTERNATIVE: IN-PERSON VISIT
═══════════════════════════════════════════════════════════════════════

I have been informed that an in-person visit is available as an alternative to this telehealth visit. I have chosen telehealth for convenience / access. I understand I may switch to an in-person visit at any time without penalty.

═══════════════════════════════════════════════════════════════════════
9. BILLING
═══════════════════════════════════════════════════════════════════════

Telehealth visits are billed similarly to in-person visits. Insurance
coverage of telehealth varies by plan and state; I am responsible
for any portion not covered. Medicare coverage of telehealth has
been extended through legislation periodically; the practice will
verify coverage at the time of visit.

═══════════════════════════════════════════════════════════════════════
10. CONSENT
═══════════════════════════════════════════════════════════════════════

I have read this telehealth informed consent. I have had the
opportunity to ask questions and have my questions answered. I
voluntarily consent to receive healthcare via telehealth as
described above. I understand I may withdraw this consent at any
time and request an in-person visit instead.


_____________________________________     May 11, 2026
Patient signature                          Date

Patient — printed name:    Jordan Alex Taylor


_____________________________________     May 11, 2026
Provider attestation                       Date

═══════════════════════════════════════════════════════════════════════
COPY TO PATIENT — ORIGINAL TO MEDICAL RECORD
═══════════════════════════════════════════════════════════════════════

About this template

Telehealth informed consent is now a routine but legally important part of virtual care. Telehealth (a broader term that encompasses telemedicine, remote patient monitoring, store-and-forward consultation, and remote behavioral health) became a federally recognized mainstream care modality during the COVID-19 public health emergency, when CMS, HHS, and the DEA issued waivers permitting expanded telehealth use. Many of those waivers have been extended permanently or through 2026 by subsequent legislation (Consolidated Appropriations Act provisions). The legal framework includes: (1) State licensure — physicians must be licensed in the state where the patient is physically located at the time of the encounter, regardless of where the patient lives or where the physician is located. The Federation of State Medical Boards Interstate Medical Licensure Compact (IMLC, joined by 39 states + DC + Guam as of late 2025) streamlines licensure across compact states, but is not a replacement for separate state licenses. Multistate practice without proper licensure is unauthorized practice of medicine, a basis for licensure discipline and civil liability. (2) Federal Ryan Haight Online Pharmacy Consumer Protection Act (21 USC § 829(e)) requires an in-person evaluation before initial prescription of controlled substances via telehealth, with public health emergency waivers and a permanent buprenorphine exception (DEA final rule 89 Fed. Reg. 12222, Feb. 16, 2024) for opioid use disorder treatment. The DEA also issued (Nov. 2024) a temporary extended telemedicine flexibility through Dec. 31, 2025; check current status. (3) Standard of care — the standard of care for telehealth is the same as in-person; "I couldn't examine the patient" is not a defense if examination was clinically necessary. The provider has an affirmative duty to recognize when telehealth is inadequate and to refer to in-person care. (4) Informed consent — many states (CA, TX, NY, others) have specific telehealth informed-consent statutes requiring written or oral consent that is documented; check state law. CMS requires informed consent documentation for telehealth services billed to Medicare. (5) HIPAA — the platform must be a HIPAA business associate (or covered entity) with a Business Associate Agreement; consumer-grade platforms (FaceTime, Zoom non-business) carried temporary HHS enforcement discretion during the PHE that has now ended. Practices should use HIPAA-compliant platforms with encryption in transit (TLS 1.2+), authentication, and access controls. (6) Emergency procedures — the provider must know the patient's physical location at the start of every telehealth visit so that emergency services can be dispatched if needed. This is a routine but easily forgotten step that has been the basis for malpractice claims when patients deteriorated during a visit. (7) Privacy in the patient's environment — the patient is responsible for a private location, but the provider should ask whether anyone else is in the room and whether the conversation is private. (8) Recording — recording without consent may violate state wiretapping law (about 12 states are "all-party consent" states: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Vermont, Washington); the provider should not record without written consent and the patient should be told not to record without informing the provider. (9) Billing and insurance — telehealth coverage varies; the Medicare originating-site requirement was waived during the PHE and has been extended; commercial coverage varies by plan and state. (10) Behavioral health telehealth — special considerations for telepsychiatry (suicide risk assessment via video, environmental safety check), substance use disorder (42 CFR Part 2 applies to virtual encounters), and group therapy (privacy of other participants). This template targets a routine outpatient telehealth visit; specialty telehealth (telestroke, tele-ICU, telepsychiatry, remote patient monitoring for chronic disease) often has additional or specialized consent requirements.

When to use it

Before the first telehealth visit with a new or established patient.
When converting an in-person practice to a hybrid telehealth/in-person model.
For a virtual second-opinion consultation.
For remote patient monitoring enrollment.
When required by state telehealth statute or by payer contract.

What to include

Patient and provider identification with state licensure.
Patient's physical location confirmed at start of visit.
Type of telehealth (live video, audio-only, async, RPM).
Platform identification with HIPAA compliance statement.
Limitations of telehealth (no physical exam, technology failures, missed signs).
Emergency procedures (provider will call 911 to patient's location).
Controlled-substance prescribing limitations (Ryan Haight Act).
Privacy and confidentiality (private space, secure device, no unauthorized listeners).
Recording consent (or refusal).
In-person alternative explicitly offered.
Billing disclosure.
Patient signature with date.

Frequently asked

Yes — almost always. The licensing rule for telehealth is that the physician must be licensed in the state where the PATIENT is physically located at the time of the visit. This is true regardless of where the patient lives or where the physician practices. Limited exceptions exist for: (1) emergencies, (2) consultations with a treating physician (peer-to-peer), (3) participation in the Interstate Medical Licensure Compact for compact-member states, (4) certain federal facilities and military programs. Practicing across state lines without proper licensure is unauthorized practice of medicine.

⚠ Legal disclaimer. Telehealth is regulated at federal and state levels. Federal: Ryan Haight Online Pharmacy Consumer Protection Act (21 USC § 829(e)) for controlled substances; DEA telemedicine rules (most recently extended through Dec. 31, 2025); Medicare telehealth coverage rules (42 USC § 1395m(m), as amended by Consolidated Appropriations Acts); HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164). State: each state's medical practice act and telehealth statute. Federation of State Medical Boards (fsmb.org) maintains current state-by-state telehealth requirements. Interstate Medical Licensure Compact for participating states (imlcc.org). Many states are "all-party consent" jurisdictions for recording (about 12 states); check state wiretapping law before recording. SAMHSA 42 CFR Part 2 applies to substance use disorder telehealth. Not legal or medical advice — consult counsel and state board for specific situations.

Jurisdiction: United States — federal Ryan Haight Act 21 U.S.C. §829(e) for controlled substances; DEA telemedicine flexibilities extended through 12/31/2025 (88 Fed. Reg. 30037, 89 Fed. Reg. 90040 extension); 42 USC §1395m(m) Medicare telehealth (PHE/CAA flexibilities); HIPAA Privacy 45 CFR Parts 160/164; state medical practice acts (CA Bus. & Prof. §2290.5; TX Occ. Code Ch. 111; FL Stat. §456.47; NY Educ. Law §6500+, Pub. Health Law Art. 29-G; PA Telemedicine Act 40 P.S. §991.2102+); Interstate Medical Licensure Compact (imlcc.org); state PSYPACT / Counseling Compact / Social Work Compact for behavioral health.

Last reviewed: 2026-05

Reviewed by ScoutMyTool — consult a licensed attorney for binding use.