Telehealth Documentation Requirements: What Therapists Must Know (2026)

Understanding State Telehealth Requirements

Telehealth regulations have evolved significantly since 2020. Most states now recognize and regulate telehealth therapy, but requirements vary considerably. Understanding your state's specific requirements is essential for compliance.

Licensure and Practice Across State Lines

The fundamental rule: you must be licensed in the state where the client is located. If you're treating a client in California, you must have a California license, even if you're physically in another state. Reciprocal agreements and multi-state licensing compacts exist in some regions but don't eliminate this requirement.

Some therapists obtain licenses in multiple states to serve clients across borders. Others limit practice to their home state. Understand your state's specific requirements and obtain proper licensure before treating clients in other states.

Verification of Client Location

Most states require documenting the client's location at the time of service. Some require in-person initial evaluations. Others specify that clients must be in the client's residence or an approved location. Document in your note where the client was located during the telehealth session.

Platform and Technology Requirements

Some states specify that platforms must be HIPAA-compliant. Others require end-to-end encryption. Most require platforms that are secure and private. Choose platforms explicitly designed for healthcare or therapy (HIPAA Business Associate Agreements in place). Avoid free versions of consumer platforms.

Informed Consent Requirements

Most states require specific informed consent addressing risks of telehealth, limitations of video assessment, privacy in home settings, and technology security. Your state may have specific language requirements.

Emergency Response Protocols

States often require documentation of emergency protocols—what happens if the client is in crisis, how you'll respond to emergencies when you can't directly intervene. Document these in your informed consent.

Interstate Compacts

Some states participate in interstate compacts allowing therapists licensed in member states to practice via telehealth across state lines with a single license. The Psychology Interjurisdictional Compact (PSYPACT) allows licensed psychologists to practice across member states. Counseling and social work compacts are developing. Check whether your state and profession participate.

Telehealth Informed Consent Documentation

What Must Be Addressed

Your telehealth informed consent must address specific issues unique to virtual therapy: technology limitations, privacy risks in home settings, platform security, what happens if the connection drops, emergency protocols, and the fact that telehealth may be less suitable for certain presentations (acute psychiatric crises, certain diagnoses).

Core Elements

Method of Communication: Explain specifically which platform(s) will be used and why you chose it. Describe its security features and HIPAA compliance.

Privacy and Security: Address risks of the client being in a home setting where others might overhear. Recommend a private location. Explain your confidentiality protections and limitations.

Technology Limitations: Explain that video assessment may miss some clinical observations. Discuss limitations of non-verbal communication via video. Address the risk of technical difficulties interrupting sessions.

Emergency Response: Explain what happens if the client is in crisis. How will you respond? How will you ensure safety? What are crisis protocols?

Technical Requirements: Specify internet speed and device requirements. Explain that clients are responsible for their own technology and connection quality.

Storage and Records: Explain whether sessions will be recorded (usually they won't be). Explain where records will be stored and how they're protected.

Licensure and Credentials: Confirm your licensure in the client's state. Provide your license number and your state board contact information.

Getting Informed Consent

Obtain written informed consent before beginning telehealth. This can be electronic (email acknowledgment from the client accepting your informed consent document). Keep the signed consent in the client's chart.

What to Document in Telehealth Sessions

Your telehealth documentation should include all elements of in-person therapy documentation plus telehealth-specific information:

• Method of contact: Specify the technology platform used (Zoom, Doxy, etc.)
• Client location: Document where the client was located (home, office, other) and confirm they were in a private space
• Clinician location: Document where you were and confirm your privacy and security
• Technology functioning: Note any technical issues, dropped connections, audio/video problems
• Connection quality: Confirm both parties had secure, functional connection throughout
• Non-verbal observations: Video may miss some observations; document what you could and couldn't assess
• Informed consent verification: Confirm client reviewed and agreed to telehealth consent

Good documentation: "Client contacted via Zoom from home office with closed door, verified private space. Clinician in secure private office. Connection stable throughout 50-minute session. Video and audio functioning appropriately. Client presented with appropriate affect and engaged fully in session."

Avoid vague documentation: "Telehealth session via Zoom." Include meaningful detail about the technology, locations, and connection quality.

Choosing and Using Secure Telehealth Platforms

Platform Requirements

Choose platforms explicitly designed for healthcare with HIPAA Business Associate Agreements (BAAs) in place. Avoid free versions of consumer platforms like Zoom's free tier or FaceTime, which don't have appropriate HIPAA compliance or BAAs.

Appropriate platforms for therapy include: Doxy.me (HIPAA-compliant, encrypted), Teladoc (designed for telehealth), SimplePractice (if using telehealth module), and platforms that explicitly provide BAAs.

Business Associate Agreements

If you use a platform to handle PHI, you need a Business Associate Agreement (BAA). This is a contract requiring the platform to maintain appropriate privacy and security. The platform provider should offer this—if they don't, choose a different platform.

Recording and Storage

Generally, don't record telehealth sessions without explicit client consent (required in some states, prohibited in others). Check your state's recording laws. If you do record, store recordings securely and delete after an appropriate time.

If your platform stores session recordings temporarily (like Zoom's cloud storage), understand their retention policies. Data stored in the cloud must be secure and encrypted.

Practice Recommendations

Use platforms with end-to-end encryption. Ensure strong password protection on your account. Don't share login credentials. Treat telehealth platforms like your physical office—secure and private. Avoid using public WiFi for telehealth sessions.

Telehealth Documentation Best Practices

Maintain Compliance Records

Keep a file of state requirements, your license verification in each state you practice, BAA agreements with platforms, and informed consent documents. Review regularly to ensure continued compliance as regulations change.

Document Technology Proactively

Always document the platform and any technical issues. This protects you if questions arise about session quality or privacy.

Verify Privacy Before Sessions

Begin each telehealth session by confirming the client is in a private space. Ask "Are you in a private location where others can't hear?" Document their response.

Use Secure Note Storage

If keeping notes on a computer, encrypt the drive. If using cloud storage, ensure it's HIPAA-compliant. Never email notes through regular email without encryption. Use secure client portals when available.

Address Non-Verbal Communication Limitations

Telehealth misses some in-person observations. Document what you can observe via video and note any limitations. If you need in-person assessment, recommend scheduling an in-person session.

Maintain Emergency Protocols

Know your state's requirements for handling client crises during telehealth. Keep emergency contact information available. Document any crisis interventions provided.

Related Resources

Strengthen your overall compliance knowledge. Review private practice documentation requirements, and understand insurance documentation standards.

Master SOAP notes which work well for telehealth documentation across all platforms.