After the emergency, telehealth’s rules landed on clinicians one deadline at a time

The week

The federal COVID-19 public health emergency ended on May 11, 2023, more than three years after it was declared. Its end did not remove every pandemic-era flexibility at once. Congress had already extended most Medicare telehealth flexibilities through the end of 2024 in the Consolidated Appropriations Act, 2023. On May 9 the Drug Enforcement Administration announced a temporary rule extending flexibilities for prescribing controlled substances by telemedicine without a prior in-person visit, after its February proposals drew more than 38,000 public comments. The HHS Office for Civil Rights had announced in April that its enforcement discretion for telehealth on platforms that did not fully comply with HIPAA would end with the emergency, followed by a 90-day transition to August 9. Many Section 1135 waivers that had relaxed hospital and staffing rules ended with the emergency.

Earlier in this series we looked at telehealth from the patient’s side, when flexibilities were renewed every 90 days. The end of the emergency moved the pressure to the workforce. Virtual care had been built by clinicians, schedulers and credentialing staff working under rules that were now expiring on different dates, set by different authorities. A single telehealth transition project, owned by one team, tended to miss whatever fell outside that team’s view. Three questions with three natural owners covered the ground: what clinicians may prescribe remotely, where they may practice from, and which tools they may use.

What clinicians may prescribe remotely

Medicare coverage of most telehealth services had been extended by Congress, so the immediate payment change for Medicare patients was small. Commercial and Medicaid coverage depended on each payer and state. Prescribing was the sharper problem. The Ryan Haight Act of 2008 generally requires an in-person medical evaluation before a practitioner prescribes controlled substances over the internet. The emergency had suspended that requirement. The DEA’s February proposals would have reinstated limits, with exceptions, before an in-person visit. The volume of objections led the agency to extend the flexibilities instead, first to November 2023.

An extension is still a deadline. Behavioral health, addiction treatment and ADHD programs had enrolled patients who had never met their prescriber in person. If the rules tightened, those patients would need visits that clinics might not have the capacity to provide. The workforce question was concrete: how many in-person appointments would be needed, in which locations, within what period, and which clinicians would provide them.

Answering it required data most organizations had not assembled. Pharmacy and clinical informatics teams could identify patients receiving controlled substances through telehealth-only relationships, by prescriber, drug schedule and patient location. From there, leaders could model several possible final rules and the visit capacity each would require. The work belonged to the chief medical officer and pharmacy leadership, with compliance advising. It needed refreshing at every extension, because panels grew in the meantime.

Where clinicians may practice from

Licensure is governed by states. In general a clinician must be licensed where the patient is located at the time of care. During the pandemic many states waived or relaxed that rule for out-of-state clinicians. Most of those waivers had ended before May 2023, each on its own timeline, but habits formed under them persisted.

The exposure sat in scheduling. A health system near a state border, a virtual program serving students away at college, or a patient visiting family can easily produce a visit with a clinician not licensed where the patient is that day. Controls are specific. Capture the patient’s location at check-in for each virtual visit, not the address on file. Match it automatically to the clinician’s active licenses in the scheduling system and stop the booking when they do not match. Track license expiry dates centrally. Malpractice coverage also needs to match the states where clinicians actually see patients.

Medicare added a related wrinkle. It had let clinicians providing telehealth from home list their enrolled practice location instead of their home address, and CMS extended that flexibility past the emergency for a limited period. Organizations with clinicians working from home needed to track that date as well.

Interstate compacts for physicians, nurses, psychologists and other professions make additional licenses easier to obtain, but only where both states participate. Deciding which clinicians should hold which extra licenses is a workforce planning choice with a budget attached. Licensing fees, application time and renewal tracking add up across a large group. The credentialing and medical staff offices own this question, but the scheduling system enforces it.

Which tools clinicians may use

In March 2020 OCR said it would not penalize good-faith use of non-public-facing communication tools for telehealth. That covered consumer video and messaging apps that did not meet HIPAA requirements or come with business associate agreements. Most large health systems moved to enterprise platforms within months. Some clinicians, affiliated practices and community clinics kept using whatever had worked in the first weeks of the pandemic.

After August 9, every telehealth encounter needed a platform that met HIPAA Security Rule requirements, with a business associate agreement where the vendor handled protected health information. The hard part was finding the exceptions. Useful sources include expense reports showing app subscriptions, mobile device management inventories, call logs from personal phones used for audio-only visits, and short surveys of clinicians. Each exception then needs an approved alternative that works as easily, or the habit returns.

This question belongs to IT and the privacy officer, but it shapes clinicians’ working day. A platform that adds steps to every visit will be bypassed. Training, support for clinicians working from home, and a clear rule for audio-only visits matter as much as the contract. The common thread across all three questions is ownership. A shared tracker of deadlines from Congress, the DEA, CMS, OCR and the states, with a named owner for each line, kept organizations from discovering a lapse after it had happened.

With hindsight

The temporary extensions became a pattern. The DEA extended its telemedicine prescribing flexibilities again in late 2023 and late 2024. In January 2025 it proposed a special registration for telemedicine and finalized a separate rule on buprenorphine. At the end of 2025 it extended the flexibilities through December 31, 2026, with the special registration still not final. Congress extended Medicare telehealth flexibilities in short increments. They lapsed during the government shutdown in October and November 2025, were restored, and in February 2026 were extended through the end of 2027. Interstate licensure compacts added member states, though coverage remains incomplete. OCR’s requirement that telehealth platforms comply with HIPAA has been stable and is now unremarkable. In 2026 the hardest questions are still where clinicians are licensed and what they may prescribe remotely. Both are governed outside the health system and keep moving.