Everything a Telehealth Company Needs to Operate in Every State

Licensure follows the patient, not the company. The Interstate Medical Licensure Compact puts it directly: the location of medical practice is the state where the patient is located, and all laws and regulations of the patient's state apply. The APRN Compact and the PA Licensure Compact hold clinicians to the practice laws of the state where the patient is located at the time of care. So a company's service map is really a grid of clinicians and states, and every cell needs a license, a compact privilege or a multistate license.

Compacts shorten the work for clinicians who qualify. Physicians can use the IMLC to get additional full state licenses faster, nurses can hold one multistate RN license through the Nurse Licensure Compact, and separate compacts cover APRNs, physician assistants and psychologists. Each has its own eligibility rules and membership, and the current status of each is shown below. Medicare treats a license obtained through a compact as a valid, full license for enrollment.

We build the grid first: which clinicians, which states, and which path is fastest for each pair. Then we file the applications, track every renewal and continuing education requirement, and update the plan as you add states or clinicians. Where a board requires applicants to submit their own applications, such as the Iowa Board of Medicine or the Alabama and Mississippi Boards of Nursing, we prepare everything and the clinician submits it.

A telehealth company that prescribes controlled substances needs DEA coverage in every state it prescribes into. DEA requires a separate registration in each state where a practitioner prescribes, each one resting on the clinician's license and, where the state requires it, a state controlled substance registration. Nurse practitioners and physician assistants register as mid-level practitioners and need state authority first.

Prescribing controlled substances by telemedicine without a prior in-person visit is governed by DEA rules that have been extended and revised several times; the current federal status is shown below. States layer their own rules on top. We keep a per-state view of what each of your clinicians may prescribe by telemedicine, and update it when federal or state rules change.

Some states limit who may own a medical practice or employ physicians, a doctrine known as the corporate practice of medicine, and some apply similar rules to other professions. Some telehealth companies owned by non-clinicians use a two-entity structure: professional corporations owned by licensed clinicians that provide the care, and a management services organization (MSO) owned by the company that provides everything else under a management agreement.

Whether that structure is needed, and how it is built in each state, is a legal question, and Doctor Rebrand is not a law firm. We handle it alongside your attorney: your attorney decides the structure and drafts the agreements, and we handle the filings and operational work that follow, from tax registrations and organizational NPIs for each professional entity to enrolling each entity with payers and keeping every agreement and registration on a calendar.

Payer enrollment is also state by state. Each state's Medicaid agency must screen every provider it enrolls and must require the physicians and other professionals who order or refer services under its plan to enroll, and it may rely on screening already done by Medicare or another state's Medicaid program. Commercial plans contract by state, and Medicare Advantage plans must credential every physician and independently practicing professional, then recredential at least every three years.

For Medicare, each enrolled practice location is reported with a nine-digit ZIP code, billing privileges for practitioners begin on the later of the filing date or the date services begin at the location, and enrollment is revalidated every five years. That makes the order of work important: we file each clinician's enrollment as soon as their license in that state is issued, so visits are billable from the first day possible.

Telehealth claims can carry rules that in-person claims do not: payer-specific place of service codes and modifiers, limits on which services count as telehealth, and coverage that can depend on where the patient is. Medicare's telehealth rules have changed several times, and the current status is shown below. Commercial plans and each state's Medicaid program set their own telehealth policies.

Our billing team applies each payer's telehealth rules by state, checks that the rendering clinician is licensed and enrolled in the patient's state before a claim goes out, and reports collections by state, payer and clinician every month.

Every new state follows the same dependency chain, and most delays come from starting a later step before an earlier one is finished. We run the chain for each state you add, in parallel across clinicians, and report where each clinician stands in each state.

A telehealth company's patient data runs through more vendors than a typical practice: video, messaging, e-prescribing, pharmacies, labs, analytics and ad platforms. HIPAA requires a security risk analysis that covers every system holding electronic patient information, a designated security official, workforce training and business associate agreements with the vendors that handle patient data.

We run the risk analysis across your full stack, write the policies, train your clinicians and staff, collect BAAs, and review website forms, analytics and ad pixels so patient information never reaches an ad platform. Companies that treat substance use disorders may also fall under 42 CFR Part 2, which we build into the program alongside your attorney.

If you need the visit itself, our telehealth platform runs HIPAA video visits from a browser, with no app for patients to install, under your company's name and logo. Patients wait in a virtual waiting room, pay when they book or after the visit, and see upcoming visits and receipts in your patient portal. Visit notes save to the chart, and e-prescribing, including controlled substances once the DEA's identity proofing and two-factor steps are done, runs from the same EHR.

Companies that already have a platform can keep it and use us only for licensing, credentialing, billing and compliance.