Nationwide telehealth means six overlapping 50-state matrices: clinician licensing (the patient’s location controls), modality rules for how relationships can be established, prescribing rules layered federal and state, corporate-practice-of-medicine structures, pharmacy licensure, and 150+ boards with recurring filings. Every one changes continuously — compliance is an operating function, not a launch checklist.
1. Clinician licensing, per state
A clinician can only treat patients located in states where they hold a license. Covering 50 states means maintaining a network whose combined licensure covers every state you serve — and keeping it current as licenses renew, lapse, and clinicians come and go. Compacts (the IMLC for physicians, compact licensure for NPs in participating states) help, but they accelerate licensing rather than replace it.
The operational wrinkle most teams miss: it is the patient's location at the time of the visit that controls, not the clinician's. A patient who signs up in Texas and opens your app on vacation in California is, legally, a California encounter. Your routing has to know that and assign a California-licensed clinician — or decline the visit gracefully.
2. Telehealth modality rules
States differ on how a valid patient-clinician relationship can be established: some allow asynchronous (store-and-forward) intake review, others require a synchronous audio or video encounter for the first visit or for certain prescriptions. Your intake flow has to branch by state — one flow for all fifty is either over-restrictive or non-compliant somewhere.
These rules also move. States amended telehealth statutes repeatedly in the years after the pandemic-era flexibilities ended, and prescribing-specific modality rules (especially for weight-loss and hormone medications) continue to shift. Someone has to own watching them — legislation, board rulemaking, and attorney-general guidance — in every state you serve, continuously.
3. Prescribing rules, especially for controlled substances
E-prescribing of controlled substances requires EPCS: DEA-registered, identity-proofed prescribers using certified software with two-factor signing. On top of federal rules, states layer their own prescription monitoring program (PDMP) checks and telehealth prescribing restrictions that vary by schedule and drug.
Even for non-controlled medications, states regulate prescription validity: some cap how long a prescription based on a telehealth encounter can run before a follow-up visit, and some restrict which practitioner types can prescribe which drug classes. Your refill logic needs those rules encoded, not remembered.
4. Corporate practice of medicine
Many states restrict who may employ physicians and own clinical revenue. Operating nationally usually means a professional entity structure (often called an MSO/PC or "friendly PC" model) set up so the business side and the clinical side relate correctly in each state. Getting this wrong is not a paperwork issue — it can void your ability to operate.
Fee-splitting rules ride along with CPOM: how the management company charges the professional entity (flat fee versus percentage of collections) is regulated differently by state. This is a structure-once, maintain-forever problem, and it is squarely lawyer territory — the point of infrastructure is that it should be someone else's lawyers.
5. Pharmacy and fulfillment rules
The pharmacy side has its own 50-state matrix: pharmacies must be licensed in each state they ship into, compounding pharmacies live under additional rules (a moving target for GLP-1 compounds especially), and some states restrict mail-order dispensing of certain drug classes. If your fulfillment partner loses a state license, your patients in that state stop getting medication — you need visibility into that risk, not just a vendor contract.
6. Boards, filings, and the audit trail
- Medical, nursing, and pharmacy boards each have jurisdiction over parts of your operation — that is easily 150+ regulators nationally.
- Registrations and filings recur — this is an operating obligation, not a launch task.
- When a board asks about an encounter, you need charting and an audit trail that reconstructs it completely: who saw the patient, what they reviewed, what they prescribed, and when.
The checklist, in one view
| Area | What varies by state | Operational consequence |
|---|---|---|
| Clinician licensing | License required where the patient is located | Network coverage + per-visit routing |
| Modality rules | Async allowed vs live visit required, by condition and drug | Intake flow must branch by state |
| Prescribing rules | EPCS, PDMP checks, validity windows, practitioner scope | Refill logic must encode the rules |
| Corporate practice | Who may employ clinicians and own clinical revenue | MSO/PC structure, state-specific terms |
| Pharmacy rules | Per-state pharmacy licensure, mail-order and compounding limits | Fulfillment routing + license monitoring |
| Boards & filings | 150+ regulators, recurring registrations | Standing compliance operations + audit trail |
A practical sequencing, if you go state by state
Businesses that build coverage themselves rarely launch all fifty at once. The usual sequence: start with a handful of large, modality-friendly states to prove the model, then expand in waves as licensing and legal review land. The hidden cost of that approach is marketing waste (turning away out-of-state demand) and a permanently split operational playbook. The alternative is infrastructure that arrives with all fifty states already live, and lets you decide which markets to turn on commercially.
This is the layer Lithos operates as a product: licensing coverage, state-aware intake and modality rules, EPCS, pharmacy routing, and audit logging, maintained continuously across all 50 states — behind one API. It is the part of a telehealth business that customers never see and boards always do.
Frequently asked questions
Which state’s law applies to a telehealth visit?
The state where the patient is located at the time of the encounter — not where they signed up and not where the clinician sits. Routing has to resolve this per visit.
Don’t licensing compacts solve 50-state coverage?
Compacts like the IMLC accelerate getting licenses; they don’t eliminate the need to hold one in each state or to maintain them as they renew and clinicians change.
How often do state telehealth rules change?
Continuously — statutes, board rulemaking, and AG guidance all move, and prescribing-specific rules for weight-loss and hormone medications have been especially active. Someone must own monitoring in every state you serve.
What actually happens if we get a state wrong?
Consequences range from board inquiries and orders to cease operations in the state to unwinding revenue tied to invalid encounters — and a public record that follows the brand. It is far cheaper to encode the rules up front.
Get the Journal by email
Our best guides on building compliant telehealth programs — a couple a week, unsubscribe any time.
HIPAA and your marketing stack: pixels, analytics, and ads for telehealth brands
Where the Meta pixel and GA4 collide with health privacy law, which pages they can never run on, and how to build a funnel you can defend.
Read the guide
Telehealth informed consent: what states actually require
The disclosures states enumerate, the four axes they differ on, and how to build consent as a versioned, state-aware flow rather than a checkbox.
Read the guide
Can your pharmacy ship there? Non-resident pharmacy licensing for telehealth brands
Why a pharmacy needs a license in every state it ships into, why the map is never fully green, and how to route orders so none go where the pharmacy cannot serve.
Read the guideFrom first call to first patient, in weeks.
A 15-minute intro call, sandbox credentials the same day, go-live in 3–4 weeks — new launches and existing patient bases alike.