Telehealth Therapy Consent FAQ

This FAQ collects the questions telehealth therapy practices ask about state-specific telehealth consent: the APA Guidelines for the Practice of Telepsychology, PSYPACT cross-state licensure for psychologists, the Counseling Compact for LPCs, the Social Work Licensure Compact for LCSWs, the state-of-patient-location rule, the emergency- contact requirement, the technology-limitation disclosure, the HIPAA Business Associate Agreement requirement under 45 CFR 164.314 for video platforms, and the Ryan Haight controlled-substance framework. Each answer is self-contained and citation-backed. If you need a workflow that drafts the telehealth consent, captures the patient-state acknowledgment, and stores the audit trail behind a HIPAA Business Associate Agreement, Formfy is the AI form builder telehealth therapy practices use; see /guides/how-to-create-telehealth-consent-telehealth-therapy-practices for the step-by- step build guide.

Statistics referenced: APA Guidelines for the Practice of Telepsychology (originally 2013, with continuing revisions); HIPAA Privacy Rule under 45 CFR Part 164 Subpart E and Security Rule under 45 CFR Part 164 Subpart C; the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 at 21 U.S.C. 829(e); the DEA 2023 controlled-substance telehealth final rule (with extensions and additional rulemaking through 2024 and 2025); the federal Electronic Signatures in Global and National Commerce Act at 15 U.S.C. 7001; the Uniform Electronic Transactions Act adopted in 49 states; PSYPACT (Psychology Interjurisdictional Compact); the Counseling Compact (operational 2024); and the Social Work Licensure Compact (implementation 2024).

Frequently Asked Questions

Telehealth therapy consent FAQ

What is the difference between a telehealth consent and a general therapy informed consent?

A general therapy informed consent under APA Ethics Code 10.01 and ACA Code A.2.b discloses the modality, foreseeable risks, alternatives, and limits of confidentiality for therapy itself. A telehealth consent is a separate (or addendum) document that adds disclosures specific to telehealth delivery: the technology used, the security posture, the patient state at the time of the encounter, the home-state and patient-state licensure framework, the emergency-contact requirement, the in-person fallback option, and the technology-limitation disclosure (what to do if the connection drops). Most state-specific telehealth statutes require some form of telehealth-specific consent. Practices serving multiple states typically maintain both documents and capture both signatures at intake.

What does the APA Guidelines for the Practice of Telepsychology require?

The APA Guidelines for the Practice of Telepsychology (originally published 2013, with continuing revisions) cover eight areas: competence of the psychologist, professional standards of care, informed consent, confidentiality of data and information, security and transmission, disposal of data and technologies, testing and assessment, and interjurisdictional practice. The informed consent guideline (Guideline 3) specifies disclosure of the technology used, the security and confidentiality limits of the technology, the emergency-contact protocol, and the licensure framework. The consent form should affirmatively address each area. APA Guidelines do not displace state law; they complement it.

What is PSYPACT and which states participate?

PSYPACT (the Psychology Interjurisdictional Compact) is the multistate practice mechanism for licensed psychologists, allowing PSYPACT-credentialed psychologists to practice telepsychology across PSYPACT member states under specified conditions, primarily through the E.Passport credential issued by the Association of State and Provincial Psychology Boards (ASPPB). As of 2026, PSYPACT membership has grown to include the majority of U.S. states, with additional states enacting legislation each year. Active state participation is published on the PSYPACT website (psypact.org). Practitioners must hold an active home-state license, an E.Passport in good standing, and confirm patient-state membership at the time of each encounter. PSYPACT applies to licensed psychologists only, not LCSWs, LPCs, or LMFTs.

What is the Counseling Compact?

The Counseling Compact is the multistate practice mechanism for Licensed Professional Counselors (LPCs and equivalent license titles, including LPCCs, LMHCs depending on state). It became fully operational in 2024 after the threshold number of states enacted the compact. The compact allows a counselor with a Privilege to Practice issued by the Counseling Compact Commission to provide counseling services (including telehealth) in any other compact member state without obtaining a separate state license. Practitioners must hold an active home-state license, qualifying education, supervised hours, and an active Privilege to Practice. Active member states are published on counselingcompact.org. Like PSYPACT, the compact does not displace state-specific scope of practice rules; it provides a licensure pathway only.

What is the Social Work Licensure Compact?

The Social Work Licensure Compact is the multistate practice mechanism for Licensed Clinical Social Workers (LCSWs and equivalent titles such as LICSW or LISW depending on state). The compact entered the implementation phase in 2024 after the threshold number of states enacted the compact, and the compact commission has been issuing initial guidance and credentialing infrastructure. Once fully operational, the compact will allow LCSWs holding a Privilege to Practice to deliver clinical social work services (including telehealth) across compact member states. Active state participation is published on swcompact.org. Practitioners should track the compact going-live date and any phased implementation in their states of interest.

How does state telehealth parity work?

Telehealth parity statutes require commercial health plans to cover telehealth-delivered behavioral health services on the same basis as in-person services. As of 2026, most states have some form of telehealth parity statute, but the scope varies. Coverage parity requires the plan to cover the service via telehealth but may pay differently. Payment parity requires the plan to pay the same rate for telehealth as for in-person. A growing number of states require both. Federal law under the Bipartisan Budget Act of 2018 and subsequent appropriations bills expanded Medicare telehealth flexibility for behavioral health, with provisions extended through additional appropriations bills. The consent form does not need to disclose parity rules but the practice should verify reimbursement before scheduling.

Whose state controls the licensure question, the patient or the clinician?

The state where the patient is physically located at the time of the encounter controls. The state of the patient permanent residence is irrelevant; if a New York patient is traveling and physically located in Florida at the time of the encounter, the clinician must be licensed in Florida (or rely on a compact mechanism with Florida participation) to provide that session. A patient who relocates mid-treatment requires the clinician to either obtain a state license in the new state, rely on a compact, or terminate care with appropriate referral. The consent form should require the patient to confirm physical location each session and disclose the cross-state-licensing protocol.

What technology requirements apply to HIPAA-aligned telehealth video?

HIPAA Privacy Rule and Security Rule under 45 CFR Part 164 apply to telehealth-delivered protected health information. The video platform must be configured for HIPAA-aligned operation, and the vendor must execute a Business Associate Agreement (BAA) under 45 CFR 164.314(a) and 45 CFR 164.504(e). Common HIPAA-aligned video options: Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, TheraNest Telehealth, Microsoft Teams (with HIPAA configuration), Google Meet (with Google Workspace BAA). The free consumer versions of these platforms typically do not include a BAA. End-to-end encryption is best practice but not strictly required by HIPAA Security Rule (the rule requires reasonable and appropriate safeguards). Document the platform name and BAA status in the intake.

What must a telehealth consent form include for emergency situations?

Emergency-contact requirement is a baseline element of every state-specific telehealth consent. The patient must designate at least one local emergency contact (name, relationship, phone number) at intake. The consent should disclose the practitioner protocol for crisis events: contact 911, contact the local crisis hotline, contact the local mobile crisis team, contact the local emergency department. The consent should disclose the patient nearest emergency department address (often captured at intake). The protocol should address connection-loss events: how the practitioner will attempt to re-establish contact, when the practitioner will contact the emergency contact, when the practitioner will notify local emergency services. Document the emergency protocol in the chart record.

Are e-signed telehealth consent forms enforceable?

Yes. The federal Electronic Signatures in Global and National Commerce Act (ESIGN Act) at 15 U.S.C. 7001 and the Uniform Electronic Transactions Act (UETA), adopted in 49 states, give electronic signatures the same legal effect as wet-ink signatures for nearly all consumer and professional services contracts. Telehealth informed consent is squarely covered. Tools that capture a tamper-evident audit trail with timestamps, IP addresses, and consent-to-electronic-records produce the strongest record. The e-signature platform must be HIPAA-compliant and operate under a Business Associate Agreement under 45 CFR 164.314 because the consent contains protected health information. Formfy, SimplePractice, TherapyNotes, DocuSign, and Adobe Acrobat Sign all sign HIPAA BAAs. ESIGN-compliant audit trails are routinely accepted by federal courts and state licensing boards.

Do I need to re-sign the telehealth consent every session?

No re-signature each session, but the patient must affirm physical location at the time of each encounter. Most practices capture the initial telehealth consent once and add a brief check-in at the start of each session: confirmation of patient state, confirmation of private location, confirmation of emergency contact still current. The consent itself should specify a renewal cadence (commonly annual or per significant change in licensure or platform). Some state-specific telehealth statutes require an updated consent if the modality changes (in-person to telehealth or vice versa) or if the practitioner state of licensure changes. Document each affirmation in the chart record.

How does mandatory reporting work in telehealth?

Mandatory reporting follows the state where the patient is physically located at the time of the disclosure. If a clinician licensed in California provides telehealth to a patient physically in Texas and the patient discloses suspected child abuse during the session, the clinician follows Texas Family Code 261.101 mandatory reporting timelines and reporting agencies, not California. Most states extend mandatory reporting to suspected abuse of children and vulnerable adults. The Tarasoff duty to warn or protect identified third parties applies similarly under the law of the state of patient location. The consent form should disclose this multi-state framework. Practitioners providing telehealth across state lines must maintain working knowledge of mandatory-reporting rules in each patient state.

What does the patient-state acknowledgment block look like?

A patient-state acknowledgment block is a discrete affirmative statement on the consent form. It typically includes: the patient confirms physical location at the time of each encounter; the patient confirms understanding that the practitioner is licensed in (or holds a compact privilege to practice in) the patient state; the patient agrees to notify the practitioner before any change in state of physical location; the patient acknowledges that if the practitioner is not licensed (or compact-credentialed) in a new state, services may need to be terminated with referral. Best practice is a checkbox plus a free-text confirmation of current state of physical location, captured each session via the intake form or scheduling tool. Document each affirmation in the audit trail.

What are the limits of liability for technology failures?

Telehealth consent forms commonly include a technology-limitation disclosure noting that the patient understands the limits of remote care: video and audio quality may vary, connection may drop, certain assessments (e.g., suicide risk in acute crisis, formal cognitive testing, and medication management requiring physical observation) may be more limited via telehealth, and the practitioner may recommend an in-person visit or emergency referral if telehealth is clinically inadequate. The clause should not waive any liability for clinician negligence (waivers of clinician negligence are generally unenforceable in malpractice contexts). The clause documents the patient understanding that the modality has inherent limits and the practitioner protocol for converting to in-person or emergency referral.

Can I prescribe controlled substances via telehealth?

Generally no without prior in-person evaluation, except under temporary post-public-health-emergency flexibility framework. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (21 U.S.C. 829(e)) requires an in-person medical evaluation before controlled-substance prescribing via telehealth, with limited exceptions. During the COVID-19 public health emergency, the DEA waived the in-person requirement. The DEA published a final rule in 2023 (with extensions and additional rulemaking through 2024 and 2025) governing the post-PHE framework. The current framework continues a temporary flexibility for certain controlled-substance prescribing via telehealth without an in-person visit, with requirements that vary by schedule and category. Therapists who do not prescribe (LCSW, LMFT, LPC, PsyD without prescriptive authority) are not affected. Psychiatric prescribers should reference the current DEA rule.

How does Formfy specifically help with telehealth therapy consent?

Formfy lets a telehealth practice describe the practice in plain English to the AI form builder, which returns a delivery-ready telehealth consent including the technology-limitation disclosure, patient-state acknowledgment block, emergency-contact requirement, in-person fallback option, mandatory-reporting language for the relevant state, and supervision disclosure for pre-licensure clinicians. Compact participation status (PSYPACT, Counseling Compact, Social Work Licensure Compact) can be added as a paragraph the patient acknowledges. Formfy operates under a Business Associate Agreement under 45 CFR 164.314 covering the data plane. Submission-based pricing at $19 to $199 per month covers multi-state telehealth volume without per-envelope penalties. Audit trails meet ESIGN evidentiary requirements. Free 15-day trial; no credit card. See /guides/how-to-create-telehealth-consent-telehealth-therapy-practices for the step-by-step.

What clauses protect against common telehealth malpractice exposure?

Five clauses provide the bulk of protection. First, technology-limitation disclosure noting the inherent limits of remote care and the practitioner conversion-to-in-person protocol. Second, patient-state acknowledgment with affirmation each session. Third, emergency protocol with patient nearest emergency department, designated emergency contact, and connection-loss procedure. Fourth, mandatory reporting and Tarasoff disclosure under the law of the state of patient physical location. Fifth, licensure framework including home-state license, compact participation if any, and the protocol when a patient relocates mid-treatment. Add the BAA disclosure for the video platform under 45 CFR 164.314 and a clear no-recording, no-screen-recording provision. State variations and high-acuity cases warrant counsel review. Carry malpractice insurance with telehealth-specific coverage.

Related resources

Build a HIPAA-aware telehealth consent in 30 seconds

Free 15-day Formfy trial. No credit card. Submission-based pricing. BAA on request.

Start your free trial

Last verified: 2026-04-25. This page is informational; it is not legal or clinical advice. Telehealth therapy practices should review state-specific telehealth statutes, compact participation, and patient-state acknowledgment rules with counsel and the relevant licensing board.