Behavioral Health Telehealth: Setup, Billing and Privacy

By Awais Afzal, Healthcare Operations & Data Analyst · Published November 1, 2026

Behavioral health telehealth under Medicare allows patients to be treated at home, including by audio-only, through December 31, 2027, and the in-person visit rule starts only after that date. Beyond billing, a practice needs a license valid where the patient sits, written consent, a platform covered by a business associate agreement, and a crisis plan.

A telehealth program in a therapy or psychiatry practice is more than a video link. It is a licensure check, a consent form, a vendor contract, a billing setup and a plan for the day a patient is in crisis and the clinician is in another town. This guide is for owners and practice managers, not patients, and it covers the Medicare rules as they stand on October 22, 2026.

It stays on telehealth. The wider operating picture is in the behavioral health practice management guide, records and templates are in the behavioral health EHR evaluation guide, and between-visit follow-up is in the behavioral health patient engagement guide.

What are Medicare's behavioral health telehealth rules today?

As of October 22, 2026, Medicare pays for behavioral health telehealth delivered to patients at home, with no geographic limit, through December 31, 2027. CMS’s telehealth FAQ, updated October 9, 2026, says beneficiaries can receive telehealth services “anywhere in the United States” through that date and that behavioral health is the exception to the facility-and-rural limit that returns on January 1, 2028 (CMS).

The path was uneven: the American Psychiatric Association warned in January 2026 that an in-person visit would be required from January 31 unless Congress acted (APA), and a funding law then extended the flexibilities through 2027 (Home Care magazine, February 2026). Treat the dates as current, not permanent.

Source: CMS Telehealth FAQ (updated October 9, 2026); HHS Telehealth policy updates (page updated February 5, 2026).

The HHS policy page is inconsistent on the in-person rule, so this guide follows the clearer CMS FAQ. Commercial plans and Medicaid set their own rules; confirm each payer.

Which license does a remote session require?

The clinician needs authority to practice where the patient is located, as well as where the clinician sits. HHS states that providers must be “licensed or legally permitted to practice in the state where the patient is located” and should check the licensing board in both states first (HHS Telehealth). A September 2026 licensure summary puts it plainly: licensure follows the client’s physical location, not the clinician’s and not the platform’s (Triad).

That makes one front-desk habit essential: ask where the patient is at the start of every visit and record it. A client who travels or moves has changed the licensing question.

Source: PSYPACT FAQs; HHS Telehealth licensure page (April 30, 2025); Triad licensure summary (September 3, 2026).

PSYPACT’s own map page lists 39 states as effective but shows no as-of date, and its latest enactment is April 2024 (PSYPACT). The September 2026 summary says more than 40 states and territories participate. Use the live map, not either count, before accepting an out-of-state patient. PSYPACT complaints can also be filed where the patient was located during the session (PSYPACT FAQs).

What consent and documentation does a remote visit need?

Get consent before the first telehealth session and document it. HHS says consent can be written or electronic before the appointment, or verbal at the start of each session, that most states require informed consent for telehealth, and that anyone else joining the visit must also consent (HHS Telehealth). Have a lawyer review the form against your state’s rules.

A telehealth consent form for a behavioral practice usually covers these points, based on the HHS guide:

• That the session is private, and the rare cases where information may go to a caregiver or another party.
• What records the clinician can see, such as the chart or a state prescription monitoring program.
• For patients with a substance use history, that this information needs additional consent before it enters the shared record.
• A request for a private, quiet location, with headphones as an option.
• What happens if the connection drops, and the emergency steps in the crisis section below.

Documentation is where revenue is lost. An HHS Office of Inspector General audit of Medicare psychotherapy payments from March 2020 to February 2021 sampled 216 enrollee days. 128 failed Medicare requirements, and OIG estimated $580 million of about $1 billion was improperly paid, including $348 million for telehealth. Undocumented session time and missing signatures were among the causes (HHS OIG, May 2023).

For each remote session, the note should show:

• The patient’s location (city and state at minimum), and the clinician’s.
• That the visit was real-time audio and video, or audio-only, and why audio-only was used.
• That consent was on file or confirmed.
• The start and stop times or total time, so the time-based code is supported.
• The clinician’s signature and credentials.

The revenue effect of these gaps is covered in the behavioral health revenue cycle management guide.

How do you vet a telehealth platform for HIPAA?

A video platform that creates, receives, maintains or transmits patient information for your practice is generally a business associate and must sign a business associate agreement (BAA) before you use it for care. HHS lists a cloud service provider engaged to handle electronic protected health information as a business associate, and says this holds even when the provider stores only encrypted data (HHS; HHS business associates). The consumer-versus-clinical-plan question for one popular tool is covered in is Zoom HIPAA compliant.

Telephone sessions need thought too. OCR’s audio-only guidance says the Security Rule does not apply to audio-only calls on a standard landline, but does apply to VoIP, apps and mobile systems. A BAA is not needed for a carrier that only transmits the call, but is needed for a vendor that stores recordings or transcripts or provides translation. OCR expects telehealth in private settings to the extent feasible, and identity checks for people the clinician does not know (HHS OCR). OCR’s pandemic-era enforcement notice is no longer in effect: its transition period ran through August 9, 2023 (HHS).

Source: HHS (cloud computing, business associates, Security Rule summary, OCR audio-only guidance).

HHS describes the Security Rule as flexible and technology-neutral but requires an accurate and thorough risk analysis (HHS). Add each telehealth tool to it. Booking and intake pages raise a separate tracking-technology issue, covered in the behavioral health digital marketing guide.

What is the crisis plan for a patient who is not in the room?

A remote practice needs a written plan for when a patient is in danger and the clinician cannot reach them physically. HHS’s telehealth emergency-plan guide starts with confirming the patient’s exact location at the beginning of each appointment and recording a full address. It notes that 911 only works if you are in the same location as the person needing help (HHS Telehealth).

Build these items into the plan, all drawn from the HHS guide:

• A recorded location and a local emergency contact for each patient, looked up in advance: police, fire, mobile crisis, crisis hotline and the nearest emergency room.
• A named local support person, with the patient’s permission to share information if needed.
• A disconnection plan: who calls whom, at which number, and the backup route such as phone if video drops.
• Defined triggers that start the plan, in-person referral criteria, and a rule for missed appointments when a patient may be in crisis.

HHS adds that an emergency plan is especially essential for out-of-state providers (HHS Telehealth). Train front-desk and clinical staff on the plan and test it with a drill.

How should telehealth sessions be coded and billed?

For Medicare, the CMS FAQ says to use place of service (POS) 10 for telehealth provided in the patient’s home and POS 02 for telehealth provided somewhere other than the home, and that home-based claims have been paid at the non-facility rate since January 1, 2024 (CMS). The POS 10 telehealth guide and the telehealth billing guide cover the wider coding picture.

Modifiers are less settled and depend on payer and setting. A Medicare administrative contractor page dated October 7, 2026 says telehealth modifiers must be submitted with distant-site telehealth services, describes modifier 93 for audio-only services for patients at home, and lists modifier 95 for narrow cases such as hospital-employed therapists and certain opioid treatment services (First Coast Service Options). A November 2025 policy-center FAQ, written before the extension, said rural health clinics and FQHCs use 95 for audio-video and FQ or 93 for audio-only mental health visits (CCHP). Your MAC and each commercial payer decide for your claims.

• Set POS and modifier rules per payer in the billing system, and keep a one-page payer sheet.
• Watch for CMS modifier changes: the FAQ lists new modifiers BB and BC from January 1, 2027, which it says have no payment implications.

The CMS FAQ does not address modifiers 93, 95 or FQ, hence the MAC citation.

What is a practical setup sequence?

Roll it out in this order:

1. List the states where clinicians hold a license or compact authority and where patients live. Close gaps before accepting out-of-state patients.
2. Choose a platform, sign the BAA and add it to the security risk analysis.
3. Adopt a telehealth consent form and a patient-location script for the front desk and clinicians.
4. Write the crisis plan and collect emergency contacts at intake.
5. Create the telehealth note template with location, modality, time and consent fields. The behavioral health practice management software guide covers what the software should hold.
6. Set the POS and modifier rules for each payer and test with a few claims.
7. Calendar the dates: DEA December 31, 2026 and Medicare December 31, 2027.

Our recommendations

1. Make patient location a required field. We would ask for and record it at the start of every session, not once at intake. It answers both the licensure and the emergency questions.
2. Verify licensure before the first visit, not after. Check the board or compact site for the patient’s state and keep the authority on file.
3. Sign the BAA before the first session. Ask any vendor, including us, to sign one before it touches patient data. We put a Business Associate Agreement in place before accessing patient data.
4. Rehearse the crisis plan. Run a short drill with the front desk and clinicians so the steps are familiar.
5. Keep a one-page payer sheet. List POS, modifiers and audio-only rules for each payer and update it when rules change.
6. Put the 2027 and 2028 dates on the calendar. Assign someone to re-check CMS each quarter, because the rules have moved more than once.

Bottom line

Behavioral health telehealth is a licensing, consent, privacy, safety and billing program as much as a video link. Medicare allows home-based care through December 31, 2027, but the dates are set by Congress and can change. The behavioral health practice management guide shows how this fits with the rest of the practice, and RCM Finder’s practice management system page lists what its claims portal does today and what is still early access.

Frequently asked questions

Does Medicare still pay for behavioral health telehealth at home?

Yes. As of October 22, 2026, CMS says beneficiaries can receive telehealth services anywhere in the United States through December 31, 2027, and behavioral health stays exempt from the facility-and-rural limit after that. The in-person visit rule starts after December 31, 2027. Confirm before acting, because Congress sets these dates.

When does the in-person visit requirement start?

CMS says Section 1834(m) requires an in-person, non-telehealth visit within 6 months before the first mental health telehealth service, effective after December 31, 2027. Patients who began home telehealth before January 1, 2028 skip that first visit but need one at least every 12 months. CMS notes limited exceptions.

Can I treat a patient who is in another state?

Only if you are licensed or legally permitted to practice in the state where the patient is located, for example through a compact such as PSYPACT for psychologists. HHS advises checking the licensing board in both states first. Ask for the patient’s location every session, because a move or a trip changes the answer.

Do I need a business associate agreement with my video platform?

Generally yes, if the vendor creates, receives, maintains or transmits patient information for you. HHS says cloud vendors that handle ePHI are business associates even when data is encrypted. A carrier that only transmits a call is treated differently. Ask the vendor to sign one for your plan before use.

Is audio-only therapy allowed?

Medicare allows audio-only through December 31, 2027. From January 1, 2028, it is allowed for behavioral health if the clinician can use video and the patient cannot or does not consent to it. HIPAA treats standard landlines differently from VoIP and apps, so assess the technology in your risk analysis.

What should a crisis plan include for remote patients?

HHS suggests confirming the patient’s exact location every visit, listing local emergency numbers, naming a local support person with permission, setting a plan for dropped connections, defining triggers and in-person referral criteria, and deciding what to do after a missed appointment when a patient may be in crisis.

Sources

1. Medicare Telehealth FAQ (updated October 9, 2026) — Centers for Medicare & Medicaid Services (2026)
2. Telehealth — Centers for Medicare & Medicaid Services (2026)
3. Telehealth policy updates — HHS Telehealth (2026)
4. Medicare Telehealth Updates: What Psychiatrists Need to Know for 2026 — American Psychiatric Association (2026)
5. CMS releases telehealth FAQs after extension announcement — Home Care magazine (2026)
6. Licensure for behavioral health — HHS Telehealth (2025)
7. PSYPACT FAQs — PSYPACT Commission (2026)
8. PSYPACT state map — PSYPACT Commission (2024)
9. Telehealth across state lines 2026 — Triad (2026)
10. Guidance on HIPAA and audio-only telehealth — HHS Office for Civil Rights (2026)
11. HIPAA and telehealth — HHS Office for Civil Rights (2023)
12. Guidance on HIPAA and cloud computing — HHS (2026)
13. Business associates — HHS (2026)
14. The Security Rule — HHS (2026)
15. Creating an emergency plan — HHS Telehealth (2026)
16. Informed consent for telebehavioral health — HHS Telehealth (2026)
17. Medicare improperly paid providers for some psychotherapy services (A-09-21-03021) — HHS Office of Inspector General (2023)
18. Telehealth service modifiers — First Coast Service Options (Medicare MAC) (2026)
19. Medicare telehealth flexibility FAQs (November 2025) — Center for Connected Health Policy (2025)