Role of Telehealth in 2026: Guide for Providers & Policymakers

TL;DR:

• Telehealth has become a permanent core of U.S. healthcare, with ongoing policy changes and compliance challenges. Providers must manage licensure, reimbursement, and enforcement risks while integrating telehealth into long-term clinical workflows. Ensuring legal, financial, and technological readiness is crucial for sustainable and equitable virtual care in 2026 and beyond.

Telehealth is now an integrated, hybrid core of U.S. healthcare delivery, with CMS, HHS, Medicare, and the DEA each managing active policy transitions that providers and policymakers must track and act on today. The pandemic-era emergency flexibilities are largely behind us, and what remains is a more deliberate, permanent-looking infrastructure, though several critical coverage and prescribing rules are still in flux through 2028.

Three implications stand out for anyone running or regulating telehealth programs right now:

• Reimbursement continuity is not guaranteed. CMS telehealth flexibilities were scheduled to expire January 30, 2026, and providers who did not confirm extension status before that date face retroactive billing risk.
• State licensure compliance is the dominant operational burden. Even with federal Medicare flexibilities, clinicians must hold an active license in the state where the patient is located during a virtual visit.
• Enforcement is rising. The Office of Inspector General (OIG) has flagged telehealth as a high-risk area, and False Claims Act exposure is real for programs with documentation gaps.

Table of Contents

• How federal policy shapes the role of telehealth in 2026
• What the 2026–2028 policy timeline means for your planning
• How state licensure and parity laws affect your telehealth program
• What you need to know about reimbursement and billing in 2026
• What HIPAA, cybersecurity, and remote prescribing require from you now
• How to recognize and reduce fraud and enforcement risk
• What clinical adoption and outcomes data tell us about telehealth today
• Practical steps providers and policymakers should take this quarter
• Key Takeaways
• Why the 2026 telehealth moment matters more than most providers realize
• Gardenstatemedicalgroup brings telehealth and specialty care together in one place
• Useful sources
• FAQ

How federal policy shapes the role of telehealth in 2026

The federal policy picture in 2026 is best understood as a transition, not a conclusion. CMS published its CY 2026 Physician Fee Schedule final rule in late 2025, locking in a set of telehealth coverage decisions that providers need to know before submitting claims. The CMS Telehealth FAQ, last updated November 26, 2025, remains the clearest single reference for which services are covered, which geographic and originating-site restrictions apply, and which COVID-era waivers have been formally retired versus extended.

HHS has continued to issue guidance through its telehealth policy updates portal, which tracks changes across Medicare, Medicaid, and federally qualified health centers. For providers billing Medicare, the most consequential near-term question is whether the January 30, 2026 flexibility expiration was extended by Congress or CMS rulemaking. HHS and the DEA also jointly extended telemedicine flexibilities for controlled-substance prescribing, though those extensions carry conditions and expiration windows of their own.

"Telehealth in 2026 is no longer a temporary channel — it is a core pillar of healthcare infrastructure, and the policy conversation has shifted from 'should we allow it' to 'how do we integrate it permanently.'" — Healthcare IT News, reporting on physician commentary on permanent telemedicine policy

On the DEA side, remote prescribing of controlled substances remains the most legally sensitive area. The DEA's special registration framework for telemedicine prescribing of Schedule III–V substances has been under rulemaking, and providers should verify current DEA guidance before prescribing any controlled substance via telehealth. Prescribing a Schedule II substance remotely without an in-person evaluation still requires a narrow exception. Medicare Advantage plans have their own telehealth benefit structures, and Medicaid programs vary significantly by state, so billing teams need payer-specific verification for every claim type.

OIG enforcement signals are worth noting here. The OIG has consistently listed telehealth among its high-priority audit areas, and its work plan targets upcoded visits, services billed without documented clinical necessity, and patterns suggesting that patients were never meaningfully seen. Providers who expanded telehealth rapidly during the pandemic and have not since audited their documentation practices are the most exposed.

What the 2026–2028 policy timeline means for your planning

Knowing the specific dates that govern telehealth coverage is the difference between confident billing and retroactive denials. Here are the key milestones every provider and policymaker should have on their radar:

1. January 30, 2026 — CMS flexibility expiration window. Many Medicare telehealth flexibilities tied to the COVID-19 public health emergency were set to expire on or around this date. Providers should confirm with CMS guidance or legal counsel whether specific flexibilities were extended by legislation or rulemaking before this deadline passed.

2. CY 2026 Physician Fee Schedule (effective January 1, 2026). The CMS final rule governs place-of-service codes, eligible provider types, and the list of covered telehealth services for the calendar year. Billing teams should have reviewed this rule before January 1.

3. DEA telemedicine special registration rulemaking — ongoing through 2026. The DEA's proposed framework for a telemedicine prescribing registry has been in process; providers should monitor the Federal Register for a final rule and adjust prescribing workflows accordingly.

4. CY 2027 Proposed Rule — expected summer/fall 2026. CMS typically releases proposed physician fee schedule rules in July. This will be the next opportunity for the agency to make permanent or sunset additional telehealth services. Submit comments during the public comment window.

5. 2028 — Potential permanent Medicare telehealth authorization. Congressional proposals to make certain Medicare telehealth flexibilities permanent have circulated. Providers and health systems should track legislative activity and engage advocacy channels, since a 2028 statutory change would reshape long-term program planning.

Practical steps keyed to these dates: Verify your current multi-state licenses before any flexibility expiration. Run a claims audit for telehealth visits billed in the prior quarter. Update patient consent forms to reflect any changes in covered services. Assign a staff member or compliance officer to monitor the Federal Register for DEA and CMS rulemaking updates at least monthly.

How state licensure and parity laws affect your telehealth program

State law governs where a clinician can practice, and for telehealth that means the patient's location at the time of the visit, not the provider's office. This single rule creates the most persistent compliance burden in telehealth operations. A physician licensed only in New Jersey cannot legally conduct a telehealth visit with a patient who is physically in Pennsylvania, even if that patient is a regular in-person patient of the practice.

Legal analyses confirm that the state-by-state licensure patchwork remains the dominant operational compliance challenge, even as federal policy evolves. Two interstate compact mechanisms reduce, but do not eliminate, this burden.

The Interstate Medical Licensure Compact (IMLC) allows eligible physicians to obtain licenses in multiple member states through a streamlined process. As of 2026, the compact includes the majority of U.S. states, but membership and eligibility criteria vary. The IMLC does not waive the requirement to hold a license in each state; it simply makes obtaining those licenses faster and less expensive.

PSYPACT serves a similar function for psychologists, enabling licensed psychologists in member states to practice across state lines under a single authority to practice interjurisdictional telepsychology (APIT). Behavioral health providers should confirm their state's PSYPACT membership and their own eligibility before seeing out-of-state patients virtually.

Payment parity laws, which require insurers to reimburse telehealth visits at the same rate as equivalent in-person visits, now exist in most states, but enforcement and scope vary. Some state parity laws cover only audio-visual visits; others extend to audio-only. Private payers often interpret parity obligations narrowly, so revenue cycle teams should verify parity status for each payer contract.

Pro Tip: Build a simple tracking spreadsheet with one row per state where your providers see patients. Columns should include: license held (Y/N), license expiration date, compact membership status, and parity law scope. Review it quarterly and flag any license expiring within 90 days.

What you need to know about reimbursement and billing in 2026

Telehealth billing in 2026 operates under a layered set of rules: Medicare sets the federal floor, Medicaid programs add state-specific layers, and private payers negotiate their own terms. Getting this right protects revenue; getting it wrong creates audit exposure.

Medicare key rules for 2026:

• Place-of-service code 02 (telehealth, patient not at home) or 10 (telehealth, patient at home) must match the patient's actual location during the visit.
• The GT modifier is required for Medicare telehealth claims billed under the fee schedule.
• Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs) bill telehealth under distinct FQHC-specific rules, including the all-inclusive encounter rate structure.
• Audio-only visits remain covered for certain services and patient populations, but documentation must clearly support why audio-visual was not available or appropriate.

Common billing scenarios and documentation requirements:

Revenue risks concentrate around three areas: incorrect place-of-service codes, missing or mismatched modifiers, and insufficient documentation of medical necessity. Retroactive denials from Medicare Administrative Contractors (MACs) are the most common consequence. Conduct a monthly sample audit of telehealth claims before submission, and flag any visit where the documentation does not clearly support the billed level of service.

For RPM reimbursement, billing requires at least 16 days of data collection per 30-day period for CPT 99454, and clinical staff time for 99457 must be documented in minutes. These are frequent audit targets.

What HIPAA, cybersecurity, and remote prescribing require from you now

HIPAA obligations for telehealth platforms have not changed in structure, but enforcement expectations have tightened. Any platform used for patient visits must qualify as a HIPAA-compliant Business Associate, meaning your vendor must sign a Business Associate Agreement (BAA) and demonstrate that the platform encrypts data in transit and at rest. Consumer-grade video tools without a BAA are not compliant, regardless of how widely they were tolerated during the pandemic.

Cybersecurity controls that providers should require from telehealth vendors in 2026 include end-to-end encryption, multi-factor authentication (MFA) for all clinical users, session logging with audit trails, and documented incident response procedures. Boards are treating cybersecurity as a budget line item: digital health and cybersecurity each represent roughly 14–15% of health system technology budgets, according to healthcare industry analysis. That investment reflects real risk, not just regulatory optics.

For telehealth patient communications, including appointment reminders and marketing emails, HIPAA's minimum necessary standard applies. Avoid including protected health information in unencrypted email, and confirm that your email platform has a BAA in place.

Remote prescribing of controlled substances is the highest-risk area in telehealth compliance. The DEA and HHS have extended telemedicine flexibilities for prescribing Schedule III–V controlled substances under specific conditions, but those conditions include documentation requirements and, in some cases, registration obligations. Schedule II substances generally still require an in-person evaluation before a remote prescription is issued. Before prescribing any controlled substance via telehealth, verify the current DEA guidance, confirm the patient's state law, and document the clinical rationale thoroughly.

Pro Tip: Create a one-page informed consent document specific to telehealth that covers: the nature of the virtual visit, limitations of remote assessment, privacy protections in place, and the patient's right to request an in-person alternative. Have patients sign it before every new telehealth relationship, and store it in the EHR.

How to recognize and reduce fraud and enforcement risk

OIG enforcement in telehealth has accelerated, and the patterns that draw scrutiny are well-documented. Providers who understand these red flags can reduce their exposure significantly.

Red flags that commonly trigger audits or investigations:

• High volume of telehealth visits billed without corresponding documentation of clinical interaction
• Billing for services that are not covered under telehealth (e.g., certain surgical follow-ups billed as telehealth without a covered exception)
• Prescribing controlled substances to patients the provider has never evaluated in person or via a compliant telehealth encounter
• Upcoding: billing a level 4 or 5 E&M visit when documentation supports only a level 2 or 3
• Billing for RPM services without evidence that devices were actually used or data was reviewed

"Telehealth fraud enforcement in 2026 focuses on three patterns: prescribing without a valid patient relationship, billing for services not rendered, and systematic upcoding. Any one of these, at scale, creates False Claims Act exposure that can reach into the millions." — Health law practitioners, consistent with OIG work plan priorities

A practical internal audit cadence looks like this: monthly sample review of 10–15 telehealth claims per provider, quarterly review of prescribing patterns for any controlled substances, and an annual full-scope telehealth compliance review by an independent auditor or legal counsel. If an audit uncovers a systematic billing error, consult health law counsel immediately to evaluate whether voluntary self-disclosure to CMS or OIG is appropriate. Self-disclosure, done correctly, typically results in lower penalties than a government-initiated investigation.

Epstein Becker Green, a health law firm with deep telemental health practice expertise, has published analyses noting that behavioral health telehealth carries particular enforcement risk given the volume of claims and the difficulty of documenting clinical necessity for mental health visits. Providers in this space should pay close attention to session documentation standards.

What clinical adoption and outcomes data tell us about telehealth today

The adoption numbers are clear. More than 80% of health systems now offer telehealth services, and patient satisfaction rates remain above 90%. These figures reflect a modality that patients have accepted and, in many cases, prefer for certain visit types. The question for health system leaders is no longer whether to offer telehealth, but how to make it clinically productive.

Behavioral health has moved furthest. Many psychiatrists now conduct over 80% of appointments virtually, a shift that has substantially reduced access barriers for patients who previously faced long wait times or geographic distance from mental health providers. This concentration of virtual visits in behavioral health also means that compliance and documentation standards for that specialty are under particular scrutiny.

Remote patient monitoring (RPM) is where the clinical outcome data is most compelling. Published studies show that RPM reduces hospital readmissions by up to 25% for patients with heart failure and diabetes. For a practice managing a chronic disease population, that figure translates directly into better patient outcomes and lower total cost of care. The operational key is integrating RPM into chronic disease workflows rather than treating it as a standalone add-on.

Rural broadband access remains the most significant barrier to equitable telehealth use. Patients in underserved rural areas often lack the connection quality needed for reliable video visits, and audio-only alternatives, while covered for some services, are clinically inferior for many assessments. Policymakers investing in telehealth equity need to pair virtual care funding with broadband infrastructure investment.

Interoperability is the operational friction point most health systems underestimate. Meaningful telehealth productivity requires two-way EHR integration; without it, providers spend significant time on manual documentation that negates efficiency gains. AI-assisted triage and pre-visit assessments are increasingly standard features in 2026 virtual care platforms, but those tools only deliver value when they feed directly into the clinical record.

Pro Tip: For chronic disease management, structure telehealth as a longitudinal relationship rather than a series of episodic visits. Schedule RPM review touchpoints at fixed intervals (every 2–4 weeks for high-risk patients), and use the EHR to flag patients whose device data shows deterioration before they call in. This approach is what improves patient outcomes at a population level.

Practical steps providers and policymakers should take this quarter

Turning policy awareness into operational action requires a prioritized list. Here is a sequenced checklist organized by time horizon.

1. Immediate (this quarter): Confirm billing compliance. Pull a sample of telehealth claims from the past 90 days. Verify place-of-service codes, modifiers, and documentation against current CMS guidance. Correct any systematic errors before your next MAC audit cycle.

2. Immediate: Update informed consent forms. Telehealth-specific consent should reflect current covered services, privacy protections, and any limitations on remote prescribing. Patients should sign before the first telehealth visit in a new calendar year.

3. Immediate: Verify multi-state licenses. For every provider seeing patients across state lines, confirm active licensure in each patient's state. Check IMLC and PSYPACT eligibility for any provider not yet enrolled.

4. Midterm (6–12 months): Invest in RPM infrastructure. For practices managing heart failure, diabetes, or hypertension populations, RPM devices and the workflow to review their data represent the highest-ROI telehealth investment available. Budget for device procurement, staff training, and EHR integration.

5. Midterm: Negotiate payer contracts for telehealth parity. Review each private payer contract for telehealth reimbursement rates. Where parity is not contractually guaranteed, initiate renegotiation or flag the gap for your revenue cycle team.

6. Midterm: Conduct a full telehealth compliance review. Engage health law counsel or an independent compliance auditor to assess documentation, prescribing patterns, and billing accuracy across your telehealth program.

7. KPIs to track: Telehealth utilization rate (visits per month by modality), claim denial rate for telehealth codes, patient satisfaction scores for virtual visits, 30-day readmission rate for RPM-enrolled patients, and revenue per telehealth visit compared to equivalent in-person visit.

Health system boards are prioritizing efficiency and digital health investments in 2026, with digital health and AI each representing roughly 14–15% of technology budgets. When making the case internally for telehealth investment, frame it around readmission reduction, patient retention, and claim revenue per visit rather than technology adoption for its own sake.

Questions to ask your telehealth vendor: Does the platform have a signed BAA? Does it support two-way EHR integration with your specific system? What is the audit log retention period? How does it handle audio-only visits for patients without reliable broadband? What is the incident response time for a security breach?

You can also review how to access telehealth services from a patient-facing perspective, which helps practices anticipate the questions patients will ask when onboarding to virtual care.

Key Takeaways

Telehealth in 2026 is a permanent, policy-governed modality requiring active compliance management, not a temporary convenience that providers can administer informally.

Why the 2026 telehealth moment matters more than most providers realize

The conventional wisdom in healthcare administration right now is that telehealth "has arrived" and the hard work is done. That framing is too comfortable. What has arrived is the infrastructure and the patient acceptance. What has not arrived, for most practices, is the operational discipline to make telehealth financially sustainable and legally defensible over the long term.

The providers who will benefit most from telehealth in the next three years are not the ones who adopted it fastest during the pandemic. They are the ones who are now doing the unglamorous work: auditing claims, verifying licenses, integrating RPM data into EHRs, and building consent workflows that hold up under scrutiny. The telehealth access guide matters as much as the technology itself, because a patient who does not know how to connect reliably is a missed visit and a missed revenue opportunity.

For policymakers, the most underappreciated issue is the broadband gap. Funding telehealth programs without funding rural internet access is like building a highway that ends at the county line. The equity promise of telehealth is real, but it will not be realized through clinical investment alone.

Gardenstatemedicalgroup brings telehealth and specialty care together in one place

Gardenstatemedicalgroup offers telemedicine visits that connect directly to its on-site specialties in North Bergen and Secaucus, New Jersey. When a virtual visit reveals the need for a cardiopulmonary evaluation, an on-site radiology study, or enrollment in a chronic care management program, the transition happens within the same practice, without referral delays or fragmented records.

For patients managing diabetes, heart disease, or other chronic conditions, that integration is what makes telehealth clinically meaningful rather than just convenient. The practice accepts Medicare and Medicaid and works with most major insurers. To learn about available telehealth services or to schedule a visit, contact Gardenstatemedicalgroup's primary care team directly.

Useful sources

• CMS Telehealth FAQ, updated November 26, 2025 — The primary CMS reference for covered telehealth services, eligible providers, and place-of-service rules under Medicare for CY 2026.
• HHS Telehealth Policy Updates — HHS's ongoing tracker for telehealth policy changes across Medicare, Medicaid, and FQHCs; updated as rules change.
• HHS & DEA Telemedicine Flexibility Extension — Official announcement of the joint HHS/DEA extension of telemedicine flexibilities for controlled-substance prescribing, including conditions and expiration terms.
• CMS CY 2026 Physician Fee Schedule Final Rule — The Federal Register final rule governing Medicare payment, telehealth coverage, and place-of-service codes effective January 1, 2026.
• CMS FQHC Center — CMS resource hub for FQHC billing rules, including telehealth encounter rate guidance.
• Healthcare IT News — Permanent Telemedicine Policy Analysis — Physician commentary and legal analysis on the trajectory toward permanent Medicare telehealth authorization.
• Telehealth 2026: Virtual Care Changing Healthcare (health.ai) — Covers RPM outcome data, broadband equity gaps, and AI integration trends in 2026 virtual care.
• Telehealth in 2026: Everything You Need to Know (National Healthcare Connect) — Behavioral health adoption data and specialty-specific telehealth use case analysis.
• Telehealth Is Booming — What Comes Next (Healthcare 150) — Board-level budget priorities and investment sequencing for digital health, AI, and cybersecurity in 2026.

FAQ

What Medicare telehealth flexibilities were at risk in January 2026?

Many Medicare telehealth flexibilities tied to the COVID-19 public health emergency were scheduled to expire around January 30, 2026. Providers should confirm with current CMS guidance or legal counsel whether specific flexibilities were extended by legislation or rulemaking before that date.

Can a clinician prescribe controlled substances via telehealth in 2026?

HHS and the DEA extended telemedicine flexibilities for prescribing Schedule III–V controlled substances under specific conditions, but Schedule II substances generally still require a prior in-person evaluation. Providers must verify current DEA guidance and document the clinical rationale thoroughly before prescribing remotely.

Does a provider need a license in every state where telehealth patients are located?

Yes. State law requires clinicians to hold an active license in the state where the patient is physically located during a virtual visit. The Interstate Medical Licensure Compact and PSYPACT streamline multi-state licensing for eligible physicians and psychologists, but they do not eliminate the requirement.

How does Gardenstatemedicalgroup deliver telehealth services?

Gardenstatemedicalgroup offers telemedicine visits integrated with on-site primary care, cardiopulmonary services, and chronic disease management programs at its North Bergen and Secaucus, New Jersey locations, accepting Medicare, Medicaid, and most major insurers.

What is the biggest equity barrier to telehealth access in 2026?

Rural broadband gaps remain the most significant barrier. Patients in underserved areas often lack the connection quality needed for reliable video visits, and addressing this requires pairing telehealth investment with broadband infrastructure funding.

Recommended

• How to Access Telehealth Services: 2026 Guide
• How to Prepare for a Telehealth Visit: 2026 Guide
• Staying Connected: Telemedicine Amidst the Time of COVID-19 | Garden State Medical Group | Garden State Medical Group
• Proven Ways to Improve Patient Outcomes in 2026 | Garden State Medical Group