The Visit Is the Easy Part

A physician deciding to offer telehealth tends to fear the things that look like medicine. Can I prescribe without seeing the patient in person? Am I licensed where the patient sits? Will the DEA flexibility survive the next budget fight? These are real questions, and we will answer them. But they are the legible part, the part that announces itself, and a practice that gets all of them right can still walk straight into trouble — because the trouble has migrated. The enforcement that actually lands on telehealth in 2026 is landing less on the prescription and more on the landing page, the testimonial, and the cancellation flow. The clinical encounter is the easy part. What surrounds it is where the exposure has moved.

This piece takes the two halves in order: how to stand the thing up without a compliance defect, and how to market it without handing a regulator a case.

Part One: Standing It Up

Licensure follows the patient, not the doctor. The governing rule is unglamorous and absolute: you must be licensed in the state where the patient is physically located at the time of the visit. A California-licensed physician treating a patient who has driven to Nevada for the weekend is, in that moment, practicing in Nevada. California’s Medical Board says the quiet part plainly — telehealth is a tool, not a separate kind of medicine, and a physician need not reside in California so long as the license is valid and current. The corollary bites in the other direction. California has not joined the Interstate Medical Licensure Compact, so the expedited multi-state pathway that 40-some states share is not available for reaching California patients. To treat someone sitting in California, you hold a California license or you do not treat them. There is no telehealth exception that dissolves this.

The standard of care does not bend to the medium. Under Business and Professions Code § 2290.5, telehealth is held to the same standard as an in-person visit, and the same duties — privacy, recordkeeping, informed consent — travel with it. Section 2290.5 also imposes the one telehealth-specific step practices most often skip: before the first telehealth service, the provider must inform the patient that telehealth is being used and obtain consent, verbal or written, and document it. The statute makes the failure to do so unprofessional conduct in its own right. Read that carefully, because it is a gift to a board investigator. It converts a missing checkbox into a freestanding disciplinary charge that requires no proof the care was bad — only proof the consent note is absent. The patient also keeps the right to switch to in-person care during the same course of treatment, and a practice that makes telehealth feel mandatory is creating a problem it does not need.

Modality is a clinical decision you have to be able to defend. Audio-only is permitted, but conditionally: the patient consents to the audio-only format, the service is one for which audio-only is clinically appropriate, and the rationale is documented in the record (billing carries its own marker, modifier 93). “The patient’s video wouldn’t connect” is a fine reason. It is only a fine reason if it is written down.

Controlled substances are the part on a clock. The Ryan Haight Act’s baseline still requires an in-person evaluation before a controlled substance is prescribed online. What suspends that baseline is a temporary flexibility, extended — for the fourth time — only through December 31, 2026. Two narrower final rules (a buprenorphine pathway for opioid use disorder, and a VA continuity-of-care rule) took effect at the end of 2025 and are permanent, but the broad “prescribe Schedule II–V without a prior in-person exam” authority everyone relies on is the temporary one, and it expires on a date certain. The long-promised special-registration framework has been proposed but not finalized. Practical translation: you may build on the flexibility, but you may not assume it. Any telehealth line that depends on remote controlled-substance prescribing needs a written answer to the question “what do we do with these patients if the flexibility lapses” — an in-person touchpoint plan, a referral network, something — drafted before the cliff, not during it.

Reimbursement is also temporary, on a different clock. Medicare’s pandemic-era flexibilities — home as an originating site, no geographic restriction, the expanded list of distant-site practitioners, audio-only for non-behavioral services — were extended through December 31, 2027 by the Consolidated Appropriations Act signed in February 2026. The behavioral-health in-person requirement is likewise pushed out. This is more runway than the DEA gives you, but it is the same kind of runway: a sunset, not a settlement. A handful of items are permanent (behavioral-health telehealth without geographic limits; certain audio-only E/M codes), and the difference between the permanent and the temporary is exactly what a prudent practice maps before it builds a service line on top of a billing code. On the commercial side, California requires payment parity from health plans and insurers (Health & Safety Code § 1374.14; Insurance Code § 10123.855), and Medi-Cal pays telehealth at parity — but parity is a coverage rule, not a licensure or prescribing rule, and it rescues none of the problems above.

Privacy stopped being forgiving in 2023. During the public health emergency, the Office for Civil Rights exercised enforcement discretion and let practices use ordinary consumer tools — FaceTime, Skype, the non-healthcare version of Zoom. That discretion ended; the transition period closed in August 2023. Telehealth today runs on a platform that will sign a business associate agreement, full stop. The newer and sharper exposure is on the website rather than the video call: tracking pixels and analytics tags that quietly transmit patient information to advertising platforms. We will come back to this, because it is where the compliance half of telehealth and the marketing half collide.

One structural note for the people building platforms rather than joining them. California’s corporate-practice-of-medicine doctrine bars lay-owned entities from employing physicians or controlling clinical decisions, and the management-services-organization structures that telehealth ventures reach for can cross that line without anyone intending to. If a non-physician entity is setting clinical protocols, owning the patient relationship, or steering prescribing, that is not a marketing problem. That is a licensure problem wearing a business-model costume.

Part Two: Promoting It

Here is where the fear and the exposure come apart. Most of the compliance anxiety in telehealth points at the prescription pad. Most of the enforcement points at the advertisement and the bill. A clinician who would never falsify a chart will sign off on a landing page that promises outcomes the evidence cannot support, or a subscription flow built to be hard to leave, because those feel like marketing, and marketing feels like someone else’s department. The board and the FTC do not see a separate department. They see the licensee’s name on the claim.

The disciplinary hook is already in the code you practice under. California Business and Professions Code § 651 makes it unlawful for a licensee to disseminate any public communication — and it names the internet explicitly — that is false, fraudulent, misleading, or deceptive. A violation is a misdemeanor, and, more to the point for this audience, it is independently “good cause for revocation or suspension.” It sits in the Medical Board’s own disciplinary guidelines as a named offense: Advertising — Fraudulent, Misleading, Deceptive. Section 651 is not vague about what it reaches. A claim is deceptive if it misrepresents a fact or omits a material one. It is deceptive if it is likely to create false or unjustified expectations of favorable results — which is where before-and-after images and outcome promises live. Testimonials and endorsements that fail to disclose material facts are covered. Using a model’s image without saying it is a model is a violation on its face. Price advertising may not use “as low as,” “and up,” or similar hedges, and any comparative claim must rest on verifiable, substantiated data. Almost every aggressive telehealth marketing technique that has gotten a company in trouble nationally is a technique § 651 already independently prohibits for a California licensee.

The federal layer is converging on the same conduct. The FTC reaches the same advertising under Section 5, and its recent telehealth enforcement reads like a list of the temptations the model invites. It took an order against the telehealth weight-loss operator NextMed for deceptive cost and outcome claims, fake reviews, and fake testimonials, and the order’s remedy is instructive: substantiate your outcome claims, disclose your costs and cancellation terms clearly, and stop misrepresenting reviews. That last item is now backed by a dedicated FTC rule on fake and AI-generated reviews (16 C.F.R. Part 465), in effect since October 2024, which reaches buying positive reviews, posting insider reviews without disclosing the connection, and fabricating testimonials. If your marketing team is generating reviews, suppressing negative ones, or running endorsements without disclosing what the endorser was paid, you are not in a gray area.

The subscription mechanics are their own exposure, and the rulebook just got more confusing — not more permissive. Telehealth runs on recurring billing, and recurring billing runs into the law of negative-option marketing. The FTC’s “click-to-cancel” rule, which would have standardized easy cancellation nationally, was vacated by the Eighth Circuit in July 2025 on procedural grounds. Do not mistake that for relief. The underlying obligations survive the rule that died: the Restore Online Shoppers’ Confidence Act still requires clear disclosure, informed consent to the recurring charge, and a simple way out, and California’s automatic-renewal law (Bus. & Prof. Code § 17600 et seq., amended effective July 2025) imposes requirements at least as strict, including constraints on “save” attempts when a customer tries to cancel. The FTC’s action against Cerebral was, in part, exactly this: a “cancel anytime” promise paired with a cancellation process engineered to be difficult, charged as a ROSCA violation. The cancellation flow is not a growth-team optimization. It is a regulated artifact.

The privacy-marketing collision. Cerebral’s larger lesson was about data, and it is the place where the two halves of this piece meet. The company promised confidentiality and then let advertising pixels carry patients’ health information to social platforms, and the resulting order included a first-of-its-kind ban on using that health information for most advertising. For a HIPAA-covered practice the rule is older and clearer: most marketing uses of protected health information require patient authorization (45 C.F.R. § 164.508), and a tracking tag that ships diagnosis or medication data to an ad network is a disclosure you almost certainly did not get authorization for. Align the privacy promises on your website with what your website actually transmits. The gap between the two is precisely what the FTC charged.

And the line you cannot let marketing cross. The criminal end of this spectrum is the telehealth platform Done, whose founder and clinical president were convicted in a scheme built on volume: advertising that drove demand, auto-refills issued without clinical interaction, business rules that constrained the time a clinician could spend deciding whether a controlled substance was warranted. The through-line of the federal takedowns is that marketing may not drive the clinical decision. Paying for patient volume, incentivizing prescriptions, or letting a growth metric set the length of a visit implicates the Anti-Kickback Statute on the federal side and California’s own prohibitions on referral remuneration and fee-splitting (Bus. & Prof. Code § 650). Vet the lead-generation partners, too: the FTC has pursued operators who impersonated other providers in search ads, and the licensee whose patients arrive through a deceptive funnel does not get to disclaim the funnel.

The Same Ethic as Before

The pattern in this series keeps reasserting itself. The exposure that frightens people and the exposure that materializes are aimed at different objects. The telehealth physician’s vigilance points at the prescription and the license, which are real but largely solvable with a checklist. The enforcement points at the advertisement, the subscription, and the data — the front of the house, the part that feels like commerce rather than care, the part a busy clinician is most likely to delegate and least likely to read.

So the work that actually reduces telehealth exposure is not exotic. It is a documented consent note. A modality decision written into the record. A controlled-substance contingency plan drafted before the cliff. A platform under a business associate agreement. And then, on the marketing side: outcome claims you can substantiate, reviews that are real, a cancellation path as easy as the sign-up, and a website whose privacy promises match its actual data flows. None of that is in the pitch deck the platform vendor showed you. All of it is on the practice.

This is general commentary, not legal advice, and the telehealth landscape is moving underneath it — the DEA flexibility expires at the end of 2026, the Medicare flexibilities at the end of 2027, and both could change again before then. The statutes named here (Ryan Haight Act; Bus. & Prof. Code §§ 651, 650, 2290.5, 17600 et seq.; the FTC Act; ROSCA; HIPAA) interact in ways that turn on the specific service, state, and structure. The point of the piece is to aim your attention at the right risks, not to substitute for counsel on a specific build.

Legal Medicine publishes on the law that governs medical practice in California. If this is the kind of argument you want in your inbox, subscribe via Substack and read with us.

Sources

Ryan Haight Online Pharmacy Consumer Protection Act, 21 U.S.C. § 829(e) · Cal. Bus. & Prof. Code §§ 651, 650, 2290.5, 17600 et seq. · Cal. Health & Safety Code § 1374.14 · Cal. Ins. Code § 10123.855 · FTC Act § 5 · Restore Online Shoppers’ Confidence Act (ROSCA), 15 U.S.C. §§ 8401–8405 · Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465 · HIPAA marketing authorization, 45 C.F.R. § 164.508 · Consolidated Appropriations Act, 2026 (Medicare telehealth extension) · In re NextMed; FTC v. Cerebral; United States v. Done (founder and clinical president) · FTC “click-to-cancel” rule vacated, 8th Cir. (July 2025).