Virtual care still carries real liability.

California telehealth consent, documented first

California's telehealth statute is Business and Professions Code 2290.5. Subdivision (b) sets the order of steps. Before the delivery of health care via telehealth, the health care provider initiating the use of telehealth must inform the patient about the use of telehealth and obtain verbal or written consent from the patient. The statute then says, "The consent shall be documented."

Subdivision (d) makes a provider's failure to comply with the section unprofessional conduct. Subdivision (g) applies the same laws and regulations on professional responsibility, unprofessional conduct and standards of practice that apply under the provider's license to the provider while delivering telehealth. The Medical Board of California says the standard of care is the same whether the patient is seen in person or through telehealth.

When a telehealth visit becomes a malpractice claim, the defense works from the chart. Here is what I like to see in a telehealth chart:

• A consent entry dated before the first telehealth service. Note whether consent was verbal or written and who obtained it.
• The mode of the visit. The statute defines synchronous (real-time) interaction and asynchronous store and forward separately.
• The patient's location at the visit. The next section explains why.
• An in-person path. Subdivision (c) says the section does not preclude a patient who agreed to telehealth from receiving in-person care. Show where patients go when video is not enough.

Consent rules vary by state. If you see patients outside California, build intake around each state's own rule. When you apply for medical malpractice insurance or counselor and therapist coverage, describe your telehealth work on the application so the underwriter sees how you actually practice.

Controlled substances by video: Ryan Haight and the DEA extension

The baseline federal rule is 21 U.S.C. 829(e), from the Ryan Haight Act. A controlled substance that is a prescription drug may not be delivered, distributed or dispensed by means of the Internet without a valid prescription. A valid prescription is issued for a legitimate medical purpose in the usual course of professional practice by a practitioner who has conducted at least 1 in-person medical evaluation of the patient, or by a covering practitioner. In-person means the patient is in the physical presence of the practitioner. Paragraph (3) says the subsection does not apply to a practitioner engaged in the practice of telemedicine.

DEA and HHS have extended the COVID-19 telemedicine flexibilities through a series of temporary rules. The fourth temporary extension was published December 31, 2025 and is effective January 1, 2026 through December 31, 2026. Under it, a DEA-registered practitioner may prescribe Schedule II through V controlled substances by telemedicine without a prior in-person medical evaluation, if every prescription:

• Is issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.
• Is issued through an interactive telecommunications system referred to in 42 CFR 410.78(a)(3).
• Comes from a practitioner whose DEA registration authorizes the basic class of controlled substance prescribed, or who is exempt from registration under 21 U.S.C. 822(d).
• Is consistent with all other requirements of 21 CFR part 1306.

In that rule, DEA said the special registration for telemedicine, proposed January 17, 2025, had not been finalized. If your model depends on prescribing controlled substances by video, watch the Federal Register before January 1, 2027 and have a plan for in-person evaluations. Tell your malpractice carrier whether your clinicians prescribe controlled substances by telemedicine. Behavioral health programs, see our behavioral health insurance page.

HIPAA platforms after the enforcement grace period

During the pandemic, HHS's Office for Civil Rights used a Notification of Enforcement Discretion to let covered providers use everyday video apps for telehealth. A notice published April 13, 2023 explained how it ended. The notification, in effect since March 17, 2020, expired at 11:59 p.m. on May 11, 2023. A 90-calendar-day transition period for telehealth expired at 11:59 p.m. on August 9, 2023.

OCR said the regulatory requirements remain the same as they were before the COVID-19 public health emergency. As an example of using the transition to come into compliance, it pointed to choosing a telehealth technology vendor that will enter into a business associate agreement. The grace period is long over, so telehealth tools are held to the same HIPAA Rules as the rest of the practice. In practice:

• A signed business associate agreement with each telehealth vendor that handles patient information. That includes the video platform and the scheduling and messaging tools.
• A written list of every telehealth tool and what patient information each one touches.
• No consumer chat or video apps unless the vendor will sign a business associate agreement.

These records also help when you apply for cyber liability insurance, because the underwriter will want to know which vendors hold your patient data.

Official sources

• California Business and Professions Code 2290.5 (telehealth)
• Medical Board of California: Telehealth
• 21 U.S.C. 829, Cornell LII
• DEA/HHS: Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications (Federal Register, Dec. 31, 2025, Doc. 2025-24123)
• CMS: CY 2027 Physician Fee Schedule proposed rule, CMS-1848-P (Federal Register, July 16, 2026, Doc. 2026-14327)
• HHS OCR: Notice of Expiration of Certain Notifications of Enforcement Discretion (Federal Register, Apr. 13, 2023, Doc. 2023-07824)