Setting up telehealth requires a HIPAA-compliant video platform, reliable internet, proper licensing, and a structured patient workflow. Whether you’re a solo practitioner or running a multi-provider clinic, the process involves both technical and legal steps that need to be in place before your first virtual visit. Here’s how to get it right.
Choose a HIPAA-Compliant Platform
Your video platform is the backbone of your telehealth operation, and it needs to meet federal privacy standards. HIPAA’s Security Rule requires you to assess the risks to patient confidentiality when using videoconferencing and then put reasonable safeguards in place to prevent unauthorized access to health information transmitted electronically. In practical terms, this means your platform needs encryption, access controls that limit who can join a session, and audit logs that track when patient data is accessed.
Before you sign up for any platform, get a Business Associate Agreement (BAA) from the vendor. This is a legal contract required under HIPAA whenever a third party handles protected health information on your behalf. The BAA must specify exactly how the vendor can use patient data, require them to report any unauthorized disclosures or breaches, and obligate them to return or destroy all patient information if the contract ends. It also needs to ensure that any subcontractors the vendor uses are held to the same privacy standards. Without a signed BAA, using that platform puts you in violation of federal law, regardless of how secure the software actually is.
Popular telehealth-specific platforms include Doxy.me, Zoom for Healthcare, and Doximity. General-purpose video tools like standard Zoom or FaceTime are not automatically compliant. Always verify that the vendor offers a healthcare-specific product with a BAA before using it for patient visits.
Internet and Equipment Requirements
The FCC recommends minimum download and upload speeds of 25/3 Mbps for video telemedicine. That baseline works for a single video stream with no other devices competing for bandwidth. In a busy office where multiple providers are running simultaneous sessions, or where staff are also using cloud-based EHR systems, you’ll want significantly higher speeds. Broadband categorized as “optimal” for telehealth runs at 100/100 Mbps or above.
For equipment, you need a computer or tablet with a built-in or external webcam capable of HD resolution (1080p), a quality microphone (a USB condenser mic or a good headset beats a built-in laptop mic), and a wired ethernet connection when possible. Wi-Fi introduces latency spikes that can freeze video mid-sentence. A hardwired connection is more stable and worth the effort of running a cable to your desk.
Set Up Your Physical Space
What patients see on screen shapes their trust in the visit. Position your primary light source in front of you, not behind you. A window behind your back turns you into a silhouette. Aim for 300 to 600 lux on your face, which is roughly the brightness of a well-lit office with a desk lamp pointed toward you. A ring light or a simple LED panel placed just behind your monitor at eye level works well.
Your background should be clean and professional. A plain wall, a bookshelf, or a neutral virtual background all work. Avoid clutter, personal photos, or anything that could distract from the clinical interaction. For acoustics, a carpeted room with soft furnishings absorbs sound better than a hard-floored room with bare walls. If your space echoes, even a small area rug and some curtains can make a noticeable difference. Close the door, and if your walls are thin, consider a white noise machine outside the room to protect patient privacy.
Licensing Across State Lines
A telehealth appointment legally takes place in the state where the patient is located at the time of the visit, not where your office is. If your patient is sitting in their living room in another state, you generally need a license in that state to treat them.
Licensing compacts offer a faster path to multi-state practice. The Interstate Medical Licensure Compact (IMLC) lets physicians hold licenses in multiple member states through a streamlined process. The Nurse Licensure Compact (NLC) allows nurses to practice across member states on a single license. Similar compacts exist for psychologists (PSYPACT), physical therapists, occupational therapists, audiologists, and speech-language pathologists. Participation in any compact is voluntary, and not all states are members. Check the relevant compact’s website for a current map of participating states before assuming you’re covered.
Controlled Substance Prescribing Rules
During the pandemic, the DEA relaxed its rules to allow prescribing Schedule II through V controlled substances via telehealth without an in-person evaluation. That flexibility has been extended multiple times and currently runs through December 31, 2026. Under these temporary rules, a DEA-registered practitioner can prescribe controlled substances after a video visit as long as the prescription serves a legitimate medical purpose, is issued during a real-time audio-video interaction, and the practitioner is authorized under their registration to prescribe that class of drug.
This is a temporary authorization, not a permanent rule. If you prescribe controlled substances via telehealth, track when these flexibilities are set to expire and plan for the possibility that an in-person evaluation may eventually be required before or shortly after initiating certain prescriptions.
Medicare and Insurance Billing
Medicare telehealth flexibilities have been extended through December 31, 2027 for most non-behavioral health services. That means Medicare patients can receive telehealth visits from home with no geographic restrictions, all eligible provider types can deliver those services, and audio-only visits remain billable through that date. For behavioral and mental health services, several provisions are now permanent: patients can receive care at home, there are no geographic restrictions, audio-only visits are allowed, and marriage and family therapists along with mental health counselors can serve as providers.
For billing, you report telehealth office visits using the same CPT codes you’d use for in-person visits (99202 through 99205 for new patients, 99211 through 99215 for established patients). The difference is the place of service code and the modifier. The -95 modifier indicates a synchronous telemedicine service delivered via real-time audio and video. The older -GT modifier is no longer used by Medicare for professional services, but many private payers still accept it. Check each payer’s specific requirements, as place-of-service codes and modifier preferences vary.
Build Your Patient Workflow
A smooth telehealth visit starts well before the video call connects. Here’s the sequence that keeps things running efficiently:
Before the visit, send an appointment reminder by text, email, or phone. Include a link to any intake forms the patient needs to complete online, covering the reason for the visit, insurance information, current symptoms, and relevant medical history. If a patient isn’t comfortable entering information electronically, have a staff member collect it by phone beforehand. Send instructions on how to use the technology, whether that’s a written handout or a short video walkthrough. Make sure the patient knows how to test their speakers, camera, and internet connection, and give them a phone number to call if the video fails.
When the visit starts, a staff member should verify the patient’s identity and confirm the reason for the visit. If vitals are relevant (a patient with a home blood pressure cuff, for example), collect those during intake. The provider then joins, confirms they can see and hear the patient clearly, and proceeds with the clinical portion.
Informed Consent for Telehealth
You need a telehealth-specific informed consent form, separate from your general consent. It should cover the nature of telehealth, including its limitations compared to in-person care. Reassure the patient that information shared during the visit is private, and explain the rare circumstances when information might be shared with another party. Let patients know what records you do and do not have access to during the session, such as their electronic medical record or the state prescription drug monitoring program.
For behavioral health visits, additional considerations apply. Discuss with patients the importance of finding a private, quiet space. Suggest headphones if others are in the household. For adolescent patients, clarify what will and won’t be shared with parents or guardians. If a patient has a history of substance use disorder, explain that this information won’t be added to their medical record without additional consent. Have your legal team review all consent forms before putting them into use.
Plan for Technical Failures
Technology will fail at some point. Your workflow needs a backup plan patients know about before it happens. The simplest approach: if the video drops and can’t be restored within two minutes, switch to a phone call using the number already on file. For visits where visual assessment matters, offer to reschedule rather than downgrade to audio only. Document any technology issues in the visit note, including whether the modality changed mid-visit, since this can affect billing. Keep a secondary device charged and ready in case your primary computer has a hardware failure during a session.