However, telehealth providers will invariably encounter certain legal and regulatory complexities as lawmakers work toward establishing a more permanent regulatory framework. At the same time, states are moving from broad expansion to refinement, focusing on reimbursement precision and licensure compacts.

We are pleased to once again release our latest update to our Telemental Health Laws app, an extensive compilation of laws, policies, and other state guidance for practitioners supporting the mental/behavioral health practice disciplines.

The survey’s complete findings are available to download for free as an app for iPhone, iPad, and Android devices.

The United States just made its latest move regarding Medicare telehealth flexibilities, which expired on September 30, 2025.

On November 9, the Senate voted 60-40 to end the then-nearly 40-day U.S. government shutdown, hammering out a continuing resolution (CR) that would extend the telehealth flexibilities extended in the Consolidated Appropriations Act of 2023 through January 30, 2026. The House vote on November 12, 222-209, clinched the deal.

It’s a welcome development. A research brief updated on November 10, 2025, by the Center for Advancing Health Policy Through Research (CAHPR) and the Brown University School of Public Health reports that telemedicine visits declined by 24 percent in the first 17 days of October for Medicare fee-for-service beneficiaries, and by 13 percent for Medicare Advantage beneficiaries. This is compared to visits from the start of July to the end of September, when the U.S. government’s failure to extend Medicare telehealth coverage sent practitioners and patients alike over what is now commonly termed a telehealth policy “cliff.”

Current Medicare telehealth flexibilities expired on September 30, 2025. This expiration has come to be called a “cliff,” since millions of beneficiaries who have used telehealth as a means for receiving health care services since the COVID-19 pandemic could lose coverage for this benefit. Now, they may have to travel to a health care provider’s office or a health care facility to receive most telehealth services, as opposed to simply logging on at home.

Without question, this is a move backward. Since restrictions for Medicare beneficiaries were eased at the start of the global pandemic in March 2020, many Americans—including seniors, those in rural areas, and those with mobility problems—have learned not only to use telehealth but to embrace it and in fact rely upon it.

Two complaints, filed April 23 in the U.S. District Court for the Northern District of California, contend that the founders and chief executive officers of Mochi Health Corp. (“Mochi Health”) and Fella Health exerted control over multiple affiliated entities, including medical groups, in violation of California law prohibiting unlicensed individuals and corporations from practicing medicine (generally known as the “Corporate Practice of Medicine” or “CPOM” laws). The plaintiffs allege unfair competition and false advertising under state law and the Lanham Act; and assert state CPOM claims through supplemental and/or diversity jurisdiction.

This latest development on the drug compounding front comes at a time when states are keeping a sharp eye on private investment in the health care space—increasingly proposing legislation to strengthen CPOM laws and also increase oversight on corporate transactions involving health care entities. The majority of U.S. states have some form of CPOM restriction, and some, including Oregon, Texas, and Washington, are considering taking steps advocates say will strengthen theirs—with proposals, for example, to prevent private equity groups or hedge funds from interfering with health care decisions and limiting or eliminating common forms of affiliation with professional medical practices.

With the passage of the Continuing Resolution (CR) by the House and Senate, and the subsequent signing by the president, current telehealth flexibilities and Medicare coverage for the benefit will not expire on March 31. With funding established through the end of the fiscal year—September 30, 2025—the CR provides at least a brief extension of telehealth flexibilities for those, particularly in rural areas or with mobility problems, who have come to rely on telehealth for access to critical health care services since March 2020.

As we noted on March 3, COVID-19 shifted perceptions of telehealth in a way that is not likely to ever return to pre-2020 notions, despite the wrangling over extensions. Between April and June of 2020, nearly half of all Medicare beneficiaries had at least one virtual medical visit. The COVID-19 public health emergency officially ended in May 2023, but the Medicare telehealth flexibilities have been extended several times.

Practitioners will, however, be allowed to continue prescribing via telemedicine without first having an in-person visit with the patient, owing to COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, in effect through the same end-of-year date.

A seven-page document released by the Department of Justice’s Drug Enforcement Administration (DOJ, DEA) and Department of Health and Human Services (HHS)—scheduled to be published in the Federal Register on March 24—further delays the effective dates of the “Expansion of Buprenorphine Treatment via Telemedicine Encounter” Final Rule and the “Continuity of Care for Veterans Affairs Patients” Final Rule, both dated January 17, 2025 .

The final rule delaying the effective dates of these final rules is scheduled for publication to the Federal Register on Wednesday, February 19, 2025.

The delays stem from the Presidential Memorandum titled “Regulatory Freeze Pending Review,” (the “Freeze Memo”) issued on January 20, 2025. The Freeze Memo orders all executive departments and agencies to “consider postponing” the effective dates of all rules published to the Federal Register that have not yet taken effect, such as the Buprenorphine and VA Telemedicine Prescribing Rules, until at least March 21, 2025 (sixty days from the issuance of the Freeze Memo), to allow review of any questions of fact, law, and/or policy raised by the rule, and to “consider opening” a comment period for stakeholders to comment on those questions. Accordingly, the DEA is also soliciting comments on: 1) the extension of the effective dates, 2) whether the effective dates should be further extended, and 3) questions of fact, law, and policy raised by these rules, for consideration by officials of the two agencies. Comments are due by February 28, 2025.

After publishing a Notice of Proposed Rulemaking (“NPRM”) in March 2023 on the prescribing of controlled substances via telemedicine that was widely criticized for being far more restrictive than temporary waivers then in place under the COVID-19 public health emergency, the Drug Enforcement Administration (“DEA”) went back to the drawing board.

Additional time and a new year has brought renewed focus. Published January 17 in the Federal Register as one NPRM and two final rules (collectively referred to herein as the “DEA’s 2025 Rules”), the DEA’s 2025 Rules seek, as DEA indicates in its press release, to “focus[] on the patient to ensure telemedicine is accessible for medical care.”

This means the DEA will continue to allow DEA registered practitioners (“Practitioners”) to prescribe controlled substances via telemedicine without having previously conducted an in-person patient examination. Likewise, and of particular interest to telemedicine providers that practice in multiple states, Practitioners may continue prescribing via telemedicine to patients physically located in any state in which the Practitioners are licensed to practice medicine, without needing to have a separate DEA registration in each such state, subject to compliance with state prescribing requirements.

These providers will inevitably face certain legal and regulatory complexities as federal and state lawmakers and regulators consider adopting further temporary or permanent policy changes impacting telehealth. Federal-level changes—particularly the Drug Enforcement Administration’s (DEA’s) remote prescribing rulemaking—may further compound these complexities and trigger a wave of changes in laws, regulations, and policies at the state and board levels.

Telehealth providers should continue to monitor these developments, capitalize on current and upcoming telehealth opportunities, and make investments in compliance infrastructures to operate in accordance with applicable federal and state laws, regulations, and policies.

Since 2016, Epstein Becker Green has researched, compiled, and analyzed state-specific content relating to the regulatory requirements for professional mental/behavioral health practitioners and stakeholders seeking to provide telehealth-focused services. 

We are pleased to once again release our latest update to our Telemental Health Laws app, an extensive compilation of laws, policies, and other state guidance for practitioners supporting the mental/behavioral health practice disciplines.

As background, during a PHE, the Secretary of the U.S. Department of Health and Human Services (HHS) may temporarily waive certain HIPAA Privacy Rule requirements for hospitals.

During the recent PHE, HHS issued HIPAA-related waivers lasting up to seventy-two (72) hours to hospitals located in the declared emergency that had activated their disaster protocol, including waivers for: the distribution of HIPAA privacy notices; patient rights to request privacy restrictions and confidential communications; communications with family or friends involved in care; and, opting out of facility directories. Health Information Privacy PHE responses can be found here.

At the federal level, many telehealth-related flexibilities have been extended through December 31, 2024, whereas, at the state level, there are wide variations in approach. Many states have continued to push the boundaries of existing telehealth policies, yet no two states are exactly alike in their approach to defining and regulating telehealth.

On this episode ...

However, modifications to telehealth services also increases the potential for fraudulent behavior and enforcement activity. Providers should continue to monitor developments in federal and state laws, regulations, and policies to capitalize on ...

The listening sessions will be open to the public, and those who anticipate attending must register through DEA’s Diversion Control website. The registration process opens today (August 7, 2023). DEA also plans to make the listening sessions available via livestream and copies of transcripts from the sessions also will be made available at a later date on the DEA Diversion Control Program website.

How do these factors combine to create a roadmap for companies navigating the direct access testing industry?