The timeline that many providers missed

The COVID-19 public health emergency created a set of temporary flexibilities that fundamentally changed how telehealth operated in the United States. Providers could treat patients across state lines without holding a license in the patient's state. Medicare expanded telehealth coverage to include a broad range of services and settings. Geographic and originating-site restrictions were waived. For many providers, these waivers were the foundation their entire telehealth practice was built on.

Those waivers are now expiring in waves, and the timeline has already passed several critical deadlines:

  • September 30, 2025: Key Medicare telehealth flexibilities expired, including expanded originating-site waivers and certain audio-only coverage provisions.
  • January 30, 2026: Additional state-level emergency orders and cross-state practice waivers expired in multiple jurisdictions.
  • Ongoing: Individual states continue to sunset their own COVID-era telehealth provisions on varying timelines, creating a patchwork of expiration dates that is nearly impossible to track manually.

If you built or expanded your telehealth practice during the pandemic, and you have not recently audited your licensing against your current patient roster, you may already be practicing outside the boundaries of your authorization.

Who is affected

The providers most exposed fall into three categories, and there is significant overlap between them:

Providers who took on patients in new states during COVID. The emergency waivers made it possible to see patients in states where you did not hold a license. If you added patients during 2020 through 2023 in states outside your licensing footprint, those sessions may no longer be authorized. The patient relationship does not grandfather the licensing requirement.

Providers who assumed compacts would cover them. Interstate compacts (PSYPACT, IMLC, NLC) are excellent tools, but they are not universal. A provider who assumed their compact membership covered all of their cross-state patients without confirming individual state membership in each compact may have gaps they have not identified.

Providers who expanded their geographic reach and never right-sized their licensing. The pandemic created opportunities to serve patients in 20, 30, or more states. Maintaining individual licenses in that many states was never economically practical for most solo practitioners and small groups. The waivers made it seem unnecessary. Now that the waivers are gone, the gap between coverage and caseload may be substantial.

What changes without the waivers

The post-waiver landscape is straightforward in principle and complex in practice. The core rule is simple: you must be authorized to practice in the state where your patient is physically located at the time of the session. Authorization means one of three things: a full state license, eligibility under an interstate compact, or participation in a state-specific telehealth registration program.

The complexity comes from the patchwork of state-level rules that govern these pathways:

  • Interstate compacts help enormously but have their own eligibility requirements. Not every provider type has a compact. Not every state is a member of every compact. Compact eligibility must be verified, not assumed.
  • Some states have created telehealth-specific registration programs as alternatives to full licensure. These vary significantly in scope, cost, and requirements.
  • The regulatory landscape is not static. Indiana eliminated its telehealth certificate program entirely in July 2024. Other states are creating new pathways. What was true six months ago may not be true today.

The result is that compliance is no longer a question you answer once. It is a question you need to answer for every session, because the rules change and patients move.

The enforcement apparatus is already in position

This is not a situation where regulators have changed the rules but have not yet built the capacity to enforce them. The enforcement infrastructure is active and expanding:

  • OIG 2025 Work Plan: The Office of Inspector General's work plan explicitly targets telehealth compliance, including cross-state practice authorization and documentation adequacy.
  • Federal court precedent: In May 2025, a federal court upheld New Jersey's enforcement authority against an out-of-state provider who was treating New Jersey patients via telehealth without a New Jersey license. The ruling confirmed that physical location of the patient, not the provider, determines licensing jurisdiction.
  • Criminal classification: New Jersey now classifies unlicensed telehealth practice as a third-degree crime. This is not an administrative fine. It is a criminal charge.
  • Insurance requirements: Connecticut requires out-of-state telehealth providers to maintain malpractice insurance equivalent to in-state requirements. Non-compliance with this rule creates a separate regulatory violation independent of the licensing question.

The direction of travel is clear. Enforcement is becoming more aggressive, penalties are increasing, and the legal framework is being tested and reinforced in court.

What malpractice insurers are signaling

A development that has received less attention but may prove equally consequential: several malpractice insurance carriers have begun flagging telehealth location documentation in their risk assessments. The concern is specific. If a claim arises from a telehealth session, and the provider cannot demonstrate that they verified the patient's location and confirmed their own authorization to practice in that state, the carrier may face difficulties mounting a defense.

This has not yet resulted in widespread policy exclusions or coverage denials. But the fact that carriers are raising it publicly is a leading indicator. Insurance underwriting changes tend to follow a predictable pattern: risk identification, guidance, surcharges, exclusions. The industry appears to be between the first and second stages. Providers who get ahead of this signal will be better positioned when underwriting standards tighten.

Four things to do now

The post-waiver environment does not require panic, but it does require action. Here are four concrete steps that address the highest-priority risks:

  1. Audit your patient list by state. Determine where your patients are actually located, not where they were when they started treatment, but where they are now. This is the foundation for everything else. You cannot assess your compliance posture without knowing your geographic exposure.
  2. Verify your licenses and compact eligibilities against those states. For each state where you have patients, confirm that you hold an active license or that an applicable compact covers you. Document the basis for your authorization in each state. Identify gaps.
  3. Start documenting location verification for every session. Even before you close licensing gaps, begin creating a record of location verification for each appointment. Timestamp, patient-reported location, verification method. This documentation habit will protect you even if your licensing coverage is not yet complete.
  4. Set up a system to catch patients who travel. A patient who was in New York last week may be in Florida this week. One-time verification at intake is not sufficient. You need a process that checks location at the time of each session, not just at the start of the therapeutic relationship.

Making this sustainable

The four steps above are the right starting point, but they are difficult to maintain manually at scale. A provider with 40 active patients across eight states needs to verify and document compliance 40 times per week, track licensing changes across eight jurisdictions, monitor compact membership updates, and catch patients who travel. That workload compounds as the practice grows.

TeleVerify tracks all of this automatically. It verifies patient location against provider licensing and compact eligibility for every session, generates audit-ready documentation, and alerts you when a patient's location creates a compliance issue before the session begins. If you are looking to operationalize the steps outlined above without adding administrative hours to every week, you can start a free trial here.

The waiver era is over. The enforcement era has begun. The providers who adapt their workflows now will be the ones who can continue practicing telehealth with confidence across state lines.