Ninety days at a time: telehealth’s stack of temporary permissions

The week

On April 12, 2022, the Secretary of Health and Human Services renewed the COVID-19 public health emergency for another 90 days. The declaration, first made in January 2020 and renewed repeatedly, underpinned many of the flexibilities behind widespread telehealth. These included Medicare waivers of geographic and originating-site limits, so beneficiaries could be seen at home. They also included enforcement discretion from the HHS Office for Civil Rights for common, non-public-facing video tools, and Drug Enforcement Administration flexibility to prescribe certain controlled substances without a prior in-person visit. A month earlier, the Consolidated Appropriations Act, 2022 had extended many Medicare telehealth flexibilities for 151 days after the emergency ended. State licensure waivers that let clinicians treat patients across state lines varied by state, and many had already expired.

Earlier in this series we looked at how Medicare’s 2021 rulemaking made mental health the most durable part of telehealth policy. By spring 2022, the policy question had a practical twin. Patients experienced a video visit as one service. Underneath, it rested on separate permissions with different legal owners and end dates. They included a privacy enforcement policy from HHS, licensure rules set by each state, Medicare payment rules tied partly to the emergency and partly to statute, and DEA prescribing rules. Each could change on its own schedule. When one changed, a patient who had done nothing different might find a visit unavailable, uncovered or unable to produce the prescription they expected. We look at the three layers that most affected what patients experienced: the platform, the clinician’s license, and the payment and prescribing rules.

The platform

Early in the pandemic, OCR’s enforcement discretion let providers use common video tools that did not meet every HIPAA requirement, as long as they were not public-facing. That made rapid adoption possible. It also meant some care ran on tools never meant for it, without business associate agreements and with inconsistent settings. Patients received links by text from one clinician, by email from another, and through the portal from a third.

The platform layer was the one most within a health system’s control, and the one whose end was most certain. The discretion would end with the emergency, and HIPAA would then apply in full. Health systems that moved virtual visits onto platforms covered by business associate agreements, integrated with the record and the patient portal, gave patients one way to join every visit. They also gave clinicians reliable documentation and gave the privacy office a single place to configure recording, retention and access. The cost was migration: retraining clinicians attached to a tool they liked, and retiring departmental accounts. Doing it in 2022, on the health system’s own schedule, was cheaper than doing it under a deadline.

The platform also had to serve patients who could not use video. Audio-only visits mattered for older patients, rural patients with poor broadband and many behavioral health patients. A single platform that offered a dial-in fallback, captured the modality for billing, and sent reminders by text as well as email reached more patients than a video-only service. Interpreter access, captioning and a test link before the first visit belonged in the same design, because each failure at that stage becomes a missed appointment.

The clinician’s license

Clinicians are licensed by states, and the state where the patient is located during the visit usually governs. Emergency waivers allowed cross-state care in many states, but they ended at different times. Interstate compacts for physicians, nurses, psychologists and some other professions offered partial paths, though not every state took part and compact licenses still had to be obtained.

For patients, the rule surfaced as a surprise. A student at college, a retiree wintering in another state or a worker on assignment could find that a familiar clinician could no longer see them by video. The operational answer was to ask for the patient’s location at booking and again at check-in, and compare it with the clinician’s licenses in the scheduling system. When they did not match, the booking stopped with a clear explanation and an alternative. Health systems near state borders, and those with national specialty programs, needed a licensure roster that scheduling could read, not a spreadsheet in the medical staff office.

The payment and prescribing rules

Medicare’s flexibilities determined whether visits from home were covered and whether audio-only visits counted. Commercial insurers and Medicaid programs set their own rules, which varied by plan and state. The DEA flexibility determined whether some medications, including buprenorphine for opioid use disorder and stimulants for attention disorders, could be started after a telehealth visit alone.

Each of these could end separately, and each affected a different group of patients. A health system needed a register showing, for each visit type, which rules it depended on, who set them, and when each was due to expire. Patients needed to know before booking whether a visit would be covered and whether it could lead to the prescription they expected. That information belongs in the booking flow, not in a denial letter afterward.

Commercial coverage made the register harder to keep. Plans changed their telehealth policies on their own schedules, sometimes with short notice, and employer plans varied within a single insurer. Revenue cycle teams were best placed to maintain that part, feeding eligibility rules into scheduling so that front-desk staff did not have to remember them.

Behavioral health showed the stakes most clearly. For many patients in therapy and medication management, telehealth had become the main channel, and some had never met their clinician in person. A change in prescribing rules could interrupt treatment abruptly. Programs that identified those patients early, and scheduled in-person visits or arranged referrals where a rule might require one, avoided gaps in care. The same register let communications teams draft patient notices weeks before each possible end date instead of days after it.

With hindsight

The federal public health emergency ended on May 11, 2023. OCR’s telehealth enforcement discretion ended with it, followed by a 90-day transition. Congress extended Medicare’s telehealth flexibilities in short increments. They lapsed during the fall 2025 shutdown, were restored through January 30, 2026, lapsed again briefly, and were then extended through December 31, 2027 by the Consolidated Appropriations Act, 2026, signed in February 2026. The DEA and HHS extended the prescribing flexibilities repeatedly, most recently through December 31, 2026. By this point in 2026, the layers still end on different dates, as they did in April 2022. Health systems that kept a register of which rule each visit type depends on, and built licensure and coverage checks into booking, have handled each deadline with less disruption to patients.