Skip to content
Vivo logo
← All articles

U.S. Telehealth Informed Consent: State Rules, HIPAA, and Scripts

U.S. Telehealth Informed Consent: State Rules, HIPAA, and Scripts

Isometric planes linked by a clear path

Telehealth informed consent is commonly required across the United States, whether through state statute, Medicaid policy, or standard medical practice. Clinicians must disclose the mode of care, risks and limitations of virtual visits, privacy safeguards, available alternatives including in-person care, who will be present, and cost or coverage details, then document that the conversation happened, Telehealth.

TL;DR:

  • Clinicians should verify rules where the patient is physically located: states differ on consent language, documentation, timing, and annual renewal.
  • Verbal consent is accepted in many states, but clinicians should record the modality, topics discussed, patient location, identity, attestation, and timestamp.
  • Use teach back after each disclosure, asking patients to explain risks, connection failures, privacy, or switching to in person care in their own words.
  • Covered providers generally need a business associate agreement with telehealth vendors handling protected health information, including vendors used for audio only visits.
  • For compounded therapies, disclose that products are not FDA approved drugs, explain route, storage, and delivery risks, and renew consent after dose or formulation changes.
Vivo ClinicUnderstand Privacy in Telehealth CareVivo Clinic provides provider-supervised treatments and handles client data using HIPAA-compliant practices.Explore Vivo Clinic

Table of Contents

A telehealth consent conversation is not a formality tacked onto scheduling. It sets expectations for the visit and protects both the patient and the clinician when something does not go as planned. We recommend clinicians walk through each consent element out loud, even when a form has already been signed electronically.

Start by naming the telehealth mode: live video, audio-only, or store-and-forward image review each carry different limitations, and patients should know which one applies to their visit. Telehealth.HHS.gov notes that providers should explain risks such as technology failure and the limits of diagnosis without a physical exam, then confirm the patient understands those boundaries before proceeding.

A practical checklist for the intake conversation:

  • Confirm the mode of care (video, audio-only, or asynchronous) and what it does and does not allow.
  • Explain realistic benefits and outcomes alongside the option of switching to in-person care.
  • Identify everyone present on both ends of the call, including trainees or family members, and note their consent.
  • Clarify whether the session will be recorded and how that recording will be stored.
  • State any known cost-sharing, insurance coverage, or out-of-pocket responsibility before the visit proceeds.

Patients benefit from asking these same questions if a clinician does not raise them first.

State and federal rules overview

Consent requirements for telehealth are not uniform. Most states embed telehealth-specific consent language in statute, administrative code, or Medicaid provider manuals, and the details vary by modality, timing, and payer, per CCHP’s consent requirements summary.

Clinicians working across state lines should check requirements for each state where a patient is physically located, not just where the practice is based. Common patterns include:

  • Many states accept either verbal or written consent as long as it is documented in the medical record.
  • Consent is frequently required once at the initial telehealth visit, with some states or Medicaid programs requiring renewal annually.
  • Medicaid policies sometimes specify exact language or disclosure topics that must be covered, separate from general state medical board rules.
  • Medicare does not uniformly require written consent for all telehealth services, but cost-sharing disclosures still apply where coinsurance exists for covered telehealth benefits.

Clinicians licensed in multiple states should also confirm licensure portability rules before a session begins. Guidance on cross-state teletherapy licensure offers a useful framework for verifying where a patient is located and which state’s rules govern that specific encounter.

Written or electronic consent works well for routine, scheduled telehealth visits, particularly when a patient portal allows forms to be reviewed in advance. Verbal consent is also acceptable in many states and specialties, including behavioral health, as long as the clinician documents it clearly at the start of the session, as outlined in HHS telebehavioral health guidance.

A consent record, whether in an EMR template or a signed form, should capture:

  1. Patient identity and confirmed location at the time of the visit.
  2. The specific elements discussed (mode, risks, alternatives, privacy, cost).
  3. Who obtained consent, with a signature or staff attestation.
  4. Date and time of the consent conversation.
  5. The telehealth modality used, noted directly in the visit note.

A typical workflow sends the consent form through the patient portal before the appointment, front-desk staff confirm receipt at check-in, and the clinician documents verbal consent again at the start of the session if anything changed. This layered approach creates a record that holds up during an audit or a payer review.

Pro Tip: Keep a single line in every visit note stating the telehealth modality and that consent was obtained; this small habit makes audits far faster.

Teach-back and sample clinician scripts

Reading a consent form aloud does not guarantee a patient understood it. The teach-back method, a strategy where clinicians ask patients to restate information in their own words, is recommended by AHRQ as a way to confirm genuine comprehension rather than passive agreement.

A chunk-and-check approach works well in telehealth: cover one consent element, pause, and ask the patient to explain it back before moving to the next. For telehealth specifically, useful prompts include:

  • “Can you tell me what you would do if the video connection drops during our visit?”
  • “What would you do if you wanted to switch to an in-person appointment instead?”
  • “Can you describe who else might be able to see or hear this visit from your end?”

Two short scripts illustrate this in practice. A portal pre-visit summary might read: “Before your visit, please confirm you understand this appointment will be conducted by video, that we cannot perform a physical exam, and that you can request an in-person visit at any time.” A verbal opening script for a live session might say: “Before we begin, I want to confirm you’re in a private location, that this call may be affected by technology issues, and that you’re comfortable proceeding this way.”

Pro Tip: Document the teach-back itself, not just the form signature, with a brief note like “patient restated risk of connectivity loss in own words.”

HIPAA requires covered providers to apply reasonable safeguards to telehealth technology and to enter into a business associate agreement with any vendor that creates, receives, or maintains protected health information, according to HHS OCR guidance on HIPAA and audio-only telehealth. This applies even when a visit is audio-only rather than video-based.

Consent conversations should plainly cover:

  • How the platform protects data in transit and at rest, in terms a non-technical patient can follow.
  • Whether a business associate agreement is in place with the telehealth vendor.
  • Confirming the patient’s identity and physical location at the start of the call.
  • Offering interpreter services or accessibility accommodations when needed.
  • A brief explanation of what happens if a data breach occurs, without legal jargon.

Clinics evaluating secure messaging tools for sending consent forms or visit summaries should weigh the same BAA and safeguard questions discussed above; guidance on secure texting and HIPAA offers a useful framework for that evaluation, even though it was written for a different care setting.

Anti-aging and longevity therapies delivered through telehealth, including NAD+ and Glutathione formulations, carry consent considerations beyond a standard virtual visit. Because these are prescription compounded products rather than over-the-counter supplements, consent should clearly state that the treatment is prescribed following provider review, not self-selected.

Patients should understand the route of administration they are consenting to, whether nasal spray, injection, or topical cream, since each carries different handling instructions and onset expectations. Consent should also cover that outcomes vary by individual, that these are not FDA-approved drugs in the same sense as a standardized pharmaceutical, and that ongoing provider supervision is part of the treatment plan rather than a one-time transaction.

Because compounded anti-aging therapies are often sold as subscriptions, consent should address renewal terms: whether continuing treatment requires a new provider check-in, how dose adjustments are communicated, and how a patient can pause or stop treatment. Privacy also deserves specific attention here, since wellness and anti-aging treatment history can feel more sensitive to some patients than routine primary care records, reinforcing the need for the same HIPAA safeguards discussed earlier in this guide.

Specific considerations for informed consent in anti-aging and NAD+/Glutathione therapies via telehealth — overview diagram

Compounded medications shipped directly to a patient’s home introduce consent considerations that a traditional pharmacy pickup does not. Patients should be informed about expected delivery timelines, storage requirements such as refrigeration for certain injectables, and what to do if a package arrives damaged or a formulation looks different than expected.

Consent documentation for home delivery should confirm that the patient understands the product was compounded by a licensed U.S. pharmacy for their specific prescription, rather than mass-manufactured, and that compounded products are not independently tested by the FDA the way approved drugs are. Patients should also be told how to reach a provider or pharmacy if they have questions after the product arrives, since there is no in-person pharmacist consultation at the point of delivery.

Clinicians should document that shipping address and identity were verified before dispatch, particularly for controlled or sensitive formulations. A brief line in the consent record noting that home delivery logistics were explained, alongside storage and handling instructions, closes a gap that purely clinical consent forms often miss.

Informed consent is not a one-time event when a treatment plan evolves. A new formulation, a dose change, or a switch in administration route, such as moving from injection to nasal spray, warrants a fresh consent conversation rather than relying on the original intake form.

We recommend clinicians treat any material change to a prescribed therapy as a trigger for updated consent, documented with the same rigor as the initial visit: what changed, why, and what new risks or expectations apply. CCHP’s state-level consent summaries note that many states already require renewed consent annually even without a treatment change, so a formulation switch should meet at least that same bar.

In practice, this means the portal-based consent workflow described earlier in this guide should trigger again whenever a provider updates a prescription, not only at the start of a new patient relationship. A short teach-back check, confirming the patient understands what is different about the new formulation, closes the loop and keeps the record current.

Consent practices exist to protect patients, not just to satisfy an audit. When a clinic treats consent as a genuine conversation rather than a checkbox, patients tend to ask better questions and follow treatment plans more closely, which matters more than any signature on a form.

Three changes are realistic within thirty days. First, move consent forms into the patient portal so they arrive before the visit instead of during it. Second, train staff on a short teach-back script rather than a lecture. Third, build a simple EMR template with the five fields a consent record actually needs: identity, location, elements discussed, attestation, and timestamp.

None of this requires new software or a compliance overhaul, just a decision to treat consent as part of care rather than paperwork around it.

— Jack

We built our intake process around the same principles outlined throughout this guide: clear disclosure, documented consent, and teach-back-style confirmation before any prescription moves forward. Every patient working with us completes a HIPAA-compliant telehealth intake, reviews treatment-specific consent information, and has the chance to ask questions directly to a licensed provider before a formulation such as NAD+ or Glutathione is prescribed.

Our telehealth consent process walks through what each therapy involves, how compounded formulations are prepared by licensed U.S. pharmacies, and what to expect once a prescription ships to your door. Details on how we handle patient data are available in our privacy notice.

If you are considering a provider-supervised therapy such as NAD+ Nasal Spray or Glutathione Nasal Spray, you can review how our intake and treatment model works and start a consultation whenever you are ready.

This article is general information, not a substitute for advice from a licensed provider. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

Most states require telehealth-specific informed consent through statute, administrative code, or Medicaid policy, though exact requirements vary by state, according to CCHP. Clinicians should check the rules for the state where the patient is physically located during the visit.

Yes, verbal consent is accepted in many states and specialties as long as it is clearly documented in the medical record at the time it is given. Telehealth.HHS.gov notes this is common practice in telebehavioral health specifically.

Teach-back asks patients to restate information in their own words to confirm they actually understood it, rather than just agreeing to a form. AHRQ recommends it as a practical way to verify comprehension during telehealth consent conversations.

Does HIPAA require a business associate agreement for telehealth platforms?

Covered providers generally must enter into a business associate agreement with any telehealth vendor that creates, receives, or maintains protected health information, per HHS OCR guidance. This requirement applies to audio-only visits as well as video visits.

Yes, we treat any change to a prescribed formulation or dose as a reason to walk through updated consent with your provider before the new prescription ships. This keeps your records current and ensures you understand what is different about the revised treatment plan.

Sources