A defensible telehealth compliance program tracks three things: where every patient sits, what the encounter record proves, and what an internal audit would find before a payer does. The DEA issued its fourth temporary extension of controlled-substance telemedicine prescribing flexibilities on December 30, 2025, keeping the pathway open through December 31, 2026. State licensure law never took the same pause. A physician prescribing across ten states carries ten separate licensure obligations, and a lapsed license in one state can turn every claim billed against that state's patients into a recoupment target. Compliance officers who wait for an audit notice to find the gap are already behind.
Licensure Tracking Across Every State Where Patients Sit
The baseline rule has not changed since the pandemic: a clinician needs an active license in the state where the patient sits at the time of the visit, regardless of where the clinician is. The Interstate Medical Licensure Compact speeds up applications across 42 member states plus Washington, D.C. and Guam, but it issues separate state licenses through one expedited process, not a single license valid everywhere. Michigan's withdrawal from the compact in March 2026 is the kind of change a static roster misses; a practice still routing Michigan patients to a physician whose compact-issued Michigan license lapsed is billing claims out of an unlicensed encounter. Our companion piece on Practicing Across State Lines: Telehealth Licensure Enforcement covers how state boards are pursuing that gap. A compliance program needs a license roster cross-checked against patient-location logs on a recurring cycle, not a one-time check at hire.
Prescribing Controlled Substances Under the DEA's Extended Flexibilities
The DEA and HHS extension keeps Schedule II-V controlled-substance prescribing available by telemedicine without a prior in-person exam through December 31, 2026. Audio-only visits remain permitted only for Schedule III-V narcotic medications prescribed for opioid use disorder treatment. The extension is temporary by design, and the agencies have said they intend to issue final, permanent rules before it runs out. A prescribing policy that hardcodes today's flexibility without a review trigger tied to the expiration date is one regulatory cycle from prescribing outside DEA authority. State controlled-substance telemedicine rules layer on top of the federal flexibility and do not move on the same calendar.
Documentation Standards Specific to the Telehealth Encounter
A telehealth encounter note has to prove things an in-person note does not: the modality (synchronous video or audio-only), the patient's and provider's locations at the time of service, that informed consent covering the terms of remote care was obtained, and any technical interruption that affected the visit. Missing modality documentation is a recurring audit trigger because payers and auditors use it to test originating-site and interstate-practice rules against the claim. Consent language often has to track terms the platform itself sets, not just the practice's own policy, which is why the vendor contract behind the visit matters; our piece on Telehealth Platform Agreements: Terms That Create Liability for Clinicians covers what those agreements typically shift onto the clinician.
Auditing Your Own Encounters Before a Payer or UPIC Does
Self-auditing means pulling a sample of encounters each month and checking each one against the same criteria a UPIC audit would use: modality, location, license status, and consent, each documented and dated. A gap found internally is a corrected policy. The same gap found on audit becomes a recoupment demand across every claim that shares the pattern. Self-audits should also flag any marketing or lead-generation arrangement paying per encounter or per prescription, the pattern our piece on Marketing Arrangements in Telehealth: Where Kickback Risk Concentrates covers, because a referral fee tied to volume can turn a documentation gap into an anti-kickback statute or false claims act problem instead of a billing correction.
A documentation gap found in a self-audit is a corrected policy. The same gap found on a UPIC audit is a recoupment demand.
Why Early Legal Counsel Is Critical
It is critical that telehealth providers promptly retain experienced healthcare defense counsel upon receiving a subpoena, audit notice, or other government inquiry touching licensure, prescribing, or encounter documentation. Early legal intervention can protect the provider's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, and preserve relevant defenses. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance defends telehealth providers through licensure enforcement actions, DEA registration matters, and payer or UPIC audits of remote encounters, and helps compliance officers build the licensure tracking, documentation, and self-audit processes that keep those matters from starting. Our bench includes a former federal prosecutor and attorneys who have represented providers through multi-state licensure and controlled-substance telemedicine matters. If your practice needs a telehealth compliance program built or reviewed, contact us for a free, confidential consultation.
