Telehealth informed consent by state: written, verbal, and how often

Telehealth informed consent requirements by state are one of the few compliance items an online clinic can settle completely in a single afternoon of intake design, and one of the few that will be read back to the operator word for word in a board complaint. The rules differ on three axes: whether the consent must be written or may be spoken, whether it is taken once or at every visit, and whether the state prescribes what it has to say. The differences matter far less than they seem, because the strictest version of each answer is also the cheapest to build into an online intake. Build to written, per visit, with the fullest disclosure list, and the states that ask for less are covered by the same screen.

What telehealth consent has to say

Telehealth consent is consent to the modality. It is separate from consent to the treatment itself, which a clinician documents in the chart in the ordinary way, and separate from the privacy notice, the terms of service and any marketing permissions. Its subject is the fact that the visit is happening through a screen, and what that changes. The core of every state's version is the same handful of disclosures, and a consent that covers all of them satisfies most states without further tailoring:

• That the service is being delivered by telehealth, and which form: live video, audio, or store-and-forward review of submitted information.
• What the modality cannot do, principally that no physical examination is taking place and that the clinician relies on what the patient reports and uploads.
• The risks specific to the modality: technology failure, interruption, and the possibility that information is insufficient and the patient will be asked for more or referred elsewhere.
• That in-person treatment is an alternative and the patient may decline telehealth or stop at any time without losing the right to other treatment.
• Who the provider is, that the provider is licensed in the patient's state, and the name of the professional entity delivering the service.
• How the patient's information is stored and shared, and that the same confidentiality rules apply as to in-person treatment.
• What to do in an emergency, including that the patient should confirm a physical location at each visit so that help can be sent if needed.
• How to reach the provider between visits, and the expected response time.
• How to raise a complaint, including with the licensing board where the state requires that notice.

California's statute is a useful anchor because it is short and explicit. Business and Professions Code section 2290.5(b) requires that, before the delivery of health care via telehealth, the provider initiating the use of telehealth "inform the patient about the use of telehealth and obtain verbal or written consent from the patient for the use of telehealth as an acceptable mode of delivering health care services," and adds that "the consent shall be documented." That is the whole federal-style minimum in three clauses: inform, obtain, record. Most other states' rules are elaborations of one of those three. The informed consent glossary entry covers the clinical side; this post stays with the telehealth-specific consent.

Written or spoken

States split on whether the patient's agreement must be in writing. California accepts either, verbal or written, so long as it is documented. Other states require a signed writing, with electronic signature accepted almost everywhere. A few states are silent in statute and leave the form to the board's general standard-of-care rules, which in practice means the board expects to see it in the chart.

For an online clinic the split is academic. An asynchronous intake has no spoken channel, so the consent is written by construction: a screen with the disclosure text, an affirmative action by the patient, and a log entry recording the version of the text, the timestamp, the patient's identity and the state the patient reported. That record satisfies the verbal-or-written states, the written states, and the documentation requirement of the silent states in one stroke. The one design rule that matters is that the affirmative action must be its own step. A consent buried in a pre-ticked checkbox next to the terms of service, or in a paragraph the patient scrolls past, is the kind of consent a board declines to recognize, and it is the first thing a plaintiff's lawyer looks for.

Where the brand also runs live video visits, the clinician should still confirm consent verbally at the start of the visit and note it, even though the written consent already exists. It costs a sentence and it closes the gap in the states whose rules speak of the provider informing the patient rather than the patient signing a form.

Once or every visit

The most common statutory phrasing is the one California uses: consent is obtained before the delivery of telehealth services. Read literally that means before the first telehealth encounter, and most states, boards and payers treat it as a one-time consent that stands until something material changes. A minority of states are read as requiring consent at each encounter, and some payer and Medicaid rules require annual renewal even where the licensing statute does not.

The cheapest design ignores the distinction and takes consent at every visit. In an async model each questionnaire submission already carries an affirmative step, so adding the modality consent to it costs nothing and makes every encounter self-contained: the chart for that visit holds that visit's consent, in the version of the text that was current on that day. In a live-visit model the same effect comes from the clinician's opening confirmation. An operator who does this never has to answer the question of whether a given state wanted once or every time, and never has to find the consent from eighteen months ago when a complaint arrives.

Re-consent is also required, in every reasonable reading, when the thing consented to changes. The three changes that matter in a consumer clinic are a change of modality, such as an async patient moving to video, a change in the professional entity delivering the service, and a change in the patient's state, since the consent was taken under one state's rules and the new state may differ. The intake should treat each of those as a trigger.

Take the modality consent at every visit. It costs one affirmative step the patient is already making, and it means no one ever has to argue about which state wanted it once and which wanted it every time.

States with their own wording rules

A handful of states go past the general disclosures and require specific content or specific notices. The common additions are a notice of how to file a complaint with the licensing board, given before the first service; a privacy-practices notice delivered before the telemedicine evaluation, with a good-faith effort to obtain the patient's written acknowledgement; a statement of the provider's name, licence type and the state in which the licence is held; an explicit statement that the patient may be referred for in-person treatment; and in some states a statement about what will and will not be prescribed by telehealth. Texas's medical board, for one, publishes a dedicated telemedicine chapter in its rules that carries notice requirements of this kind, and the rule text should be read directly rather than from a summary before the Texas screens are drafted. Some states also regulate the language and reading level of consent documents, or require translation where the patient's preferred language is not English.

The practical way to handle these states is a base consent that contains every common disclosure, plus a short set of per-state additions that the intake shows when the patient's state calls for them. The additions are rarely more than a paragraph. What an operator should not do is write one consent per state, because fifty documents drift apart the first time counsel edits one and not the others. The state index notes which states carry additions of this type.

Where consent sits in an online intake

Order matters, because the consent has to precede the clinical service. The sequence that works is: account creation and acceptance of the terms of service; the patient's state and location; the telehealth consent, the privacy notice and any state-specific notices; the intake questionnaire; checkout; and only then clinician review. Putting the consent at checkout, after the questionnaire, is the common mistake. In an async model the questionnaire is the clinical encounter, so a consent taken after it was taken after the service began.

Keep the telehealth consent separate from the other agreements the patient makes in the same flow. The terms of service are a contract with the management company, not with the clinician. Marketing permissions are their own consents, and for text messages the federal standard is prior express written consent under the TCPA rules at 47 CFR 64.1200(f)(9), with statutory damages of $500 to $1,500 per message for getting it wrong. A single checkbox that purports to cover all three is weaker than three checkboxes, and in the case of the TCPA consent it is likely invalid. The telehealth consent belongs to the professional entity, is stored with the medical record, and is produced from the record when a board asks.

Version the text. Every consent record should point to the exact wording the patient saw, so that when the wording changes, the older records still show what was agreed. Store the record with the chart rather than in the marketing database, because the chart is what gets produced in a complaint, and because the professional entity, not the management company, is the custodian of it.

Minors and controlled substances

Two situations carry extra rules. For minors, a parent or guardian generally has to give the telehealth consent, and the exceptions, such as mature-minor rules and confidential services in specific areas, vary enough by state that most consumer brands in the verticals this site covers set the minimum age at eighteen and verify it at intake. Meta's advertising standards independently require weight-loss ads to be targeted at adults, so a brand in that vertical has a second reason to draw the line there. A brand that does treat minors needs a guardian-consent flow, identity verification for the guardian, and a state-by-state map of the exceptions before the first patient.

For controlled substances, the telehealth consent is one of several documents. The federal telemedicine flexibilities that allow prescribing without a prior in-person visit run through December 31, 2026, under the extension published in the Federal Register on December 31, 2025, and a prescribing encounter under those flexibilities must be a live audio-video visit. A brand prescribing testosterone or other controlled medications usually adds a treatment agreement covering monitoring, refills, prescription-monitoring checks and the conditions on which treatment stops, and records the patient's agreement to it alongside the telehealth consent. Several states add their own conditions to controlled-substance telemedicine, and the consent text for those states should say what the state requires.

In Tessic Health's client clinics the telehealth consent, the privacy notice and the per-state additions sit inside the intake before the questionnaire, are versioned, and are stored with the record in the client's professional entity, so that the client can produce the consent for any encounter and takes the records with it if the relationship ends.

Questions operators ask

Does a consent to telehealth cover a switch from async to video? Not reliably. The consent described the modality the patient agreed to. If the intake routes a patient from questionnaire review to a live visit, take the consent again for the new modality. In practice this is a sentence at the top of the scheduling screen and a note in the chart.

Can the consent be part of the terms of service? It can be presented in the same session, but it should not be the same document or the same checkbox. The terms bind the patient to the management company. The telehealth consent is between the patient and the professional entity and belongs in the medical record. Merging them creates a corporate-practice problem as well as a consent problem, because the management company is then holding the clinical consent.

Is a consent taken in one state valid when the patient moves? Treat it as needing renewal. The disclosures may differ, the professional entity delivering the service may differ, and the provider will differ if the original one is not licensed in the new state. The intake should re-run the consent step when the patient's reported state changes.

What if the patient refuses? Then no telehealth service is delivered, and the intake should say so plainly and point the patient to in-person options. A refusal is also a record: note it, so that no one later treats the account as consented.

How long should consent records be kept? As long as the medical record they belong to, under the retention rule of the patient's state, which for adults is commonly measured in years from the last encounter and is longer for minors. Since the consent lives with the chart, the chart's retention rule governs.