As a provider of mental healthcare, the odds are pretty good that your day-to-day practice in 2021 looks quite different than it did in the early days of 2020. More to the point, it’s likely that you’ve become more familiar with teletherapy practices than you ever would have imagined.

Within the first week of the pandemic-related lockdowns in March 2020, one provider of telehealth software for mental and behavioral practices announced that usage of its services had increased more than 4,300% in just one week.1 By July 2020, it was reported by FAIR Health, the nation’s largest repository of private health insurance claims data, that telehealth claims lines had increased 3,806% in one year, and, moreover, that mental health disorders ranked as the number one category in telehealth diagnoses nationally in every region of the country.2

Here we are, approximately one year into the COVID-19 pandemic in the United States, and as many as 96% of physicians and specialists surveyed are now willing to use telehealth with their patients.3 For teletherapy in particular, this style of practice may be here to stay, as nearly two-thirds of adults surveyed have expressed a desire to continue virtual visits for mental healthcare even after the safety concerns of the pandemic have passed.3

However, as ingrained as telehealth has become in such a short time, the legal landscape related to this area of medicine is still evolving, covering such wide-ranging topics as licensure and geographic restrictions, electronic prescribing, privacy and data security, liability and malpractice concerns, and provider education and competency.

If you plan to continue providing telehealth services in 2021, here is a quick primer on some of the legal and ethical issues related to teletherapy worth following.

Waiver of In-Person Visit and Electronic Prescription Restrictions

In the earliest days of the COVID-19 pandemic, with the need for social distancing at hand, federal and state governments quickly issued a number of laws, regulations, temporary waivers, and guidance documents to better enable practitioners to provide remote care

The Coronavirus Preparedness and Response Supplemental Appropriations Act was signed into law on March 6, 2020, giving the Secretary of Health and Human Services (HHS) the authority to waive geographic and originating site Medicare telehealth reimbursement restrictions for mental health services during the public health emergency.4 Weeks later, the Centers for Medicare and Medicaid Services (CMS) released guidance allowing patients to be seen by providers via telehealth without first having to appear in-person at a qualifying “originating site” in order to establish an initial provider-patient relationship.5

CMS further expanded access to telehealth services by temporarily waiving the typical requirements which state that out-of-state practitioners must be licensed in the state where they are providing services; during the term of the public health emergency, these requirements are waived so long as the practitioner is both licensed in another state and not affirmatively excluded from practice in any other state.6 Finally, to ensure access to medications, DEA made a number of temporary changes, including making it easier for providers to prescribe Schedule II controlled substances orally, as opposed to written or electronic only.7

While loosening restrictions at the federal level was integral to removing legal barriers to telehealth, those measures alone would have been insufficient without corresponding state action. According to the Federation of State Medical Boards, 44 states and the District of Columbia have implemented the federal action within their borders by issuing their own waivers pertaining to out-of-state physicians, the establishment of provider-patient relationships, audio-visual requirements for telehealth, electronic prescriptions, and more.8

How Mental Health Providers Can Stay Up-to-Date

  • Most of the policy changes noted above were meant to be temporary and based upon the length of the public health emergency; some are expiring and/or being renewed by their issuing bodies every few months. Psychiatrists and psychotherapists should not expect these temporary changes to become permanent. It’s important to ensure you are signed up to receive all timely announcements from your licensing boards, including e-newsletters and guidance documents.
  • Professional associations know how overwhelming it can be to stay on top of these rapidly evolving policies, and many are doing their part to help providers of mental health care services by compiling state-by-state guidance. The American Psychological Association, American Psychiatric Association, and American Association for Marriage and Family Therapy have all created continually updated resources to help practitioners remain compliant in their practices.9-11
  • The DEA has provided a detailed decision tree aimed at helping practitioners to fully understand how they may and may not prescribe controlled substances without having to interact in-person with their patients.12

Data Security and HIPAA Compliance

To ensure that medical providers were able to continue treating their patients during the pandemic, the Office of Civil Rights (OCR) within HHS announced that it would not impose penalties for non-compliance with HIPAA Rules against non-compliant videoconferencing software during the nation’s COVID-19 public health emergency.13 By doing so, clinicians were able to treat their patients through widely available and free-to-use software such as Skype, Facebook Messenger, Apple FaceTime, and Zoom, which greatly increased access to care. However, these programs were never designed to be tools used for medical care delivery and protection of sensitive data; specifically, they are not HIPAA-compliant. Further, some states have strict laws related to how telehealth may be delivered, particularly related to patient privacy and data, and loosened federal standards do not override stricter state standards.14

Without additional federal action, HIPAA rules will again take full effect on January 21, 2021, meaning that telehealth providers must have a Business Associate Agreement in place with a HIPAA-compliant program in order to continue to provide telehealth services to their patients.15 Non-compliant software will no longer be allowed, and utilizing these services will expose practitioners to HIPAA fines and liability concerns.

How Mental Health Providers Can Stay Up-to-Date

  • Practitioners should immediately ensure that they’ve secured access to HIPAA compliant software for telehealth, such as Zoom for Healthcare, Skype for Business,, or VSee, and enter into a valid Business Associate Agreement.
  • Ask your licensing board and/or personal attorney if your state has laws and regulations pertaining to data security and telehealth.

Liability and Malpractice Risk

While both the state and federal governments have been making telehealth more accessible by temporarily removing as many barriers as possible, there are still limits to how a practitioner may practice. Under the legal standard of “reasonable care”, practitioners will still be expected to exercise a level of care, skill, and judgment that meets local professional norms.16 However, this standard is a bit of a moving target as it pertains to teletherapy, as the rapid increase in utilization has far outpaced the court system, leaving clinicians without legal precedent to guide their decisions.17

Unsurprisingly, given all of the confusion related to rapidly changing telehealth policies and responsibilities, malpractice liability is at top of mind for many practitioners  ­particularly because it is often unclear whether telehealth is covered under standard malpractice policies.18 Some states, including New York, have temporarily created exemptions from malpractice liability except in cases of gross negligence.19 Other states, such as Hawaii, have taken action to protect both patients and providers, requiring malpractice insurance carriers to provide coverage for telehealth services.20 This state action is necessary to clarify matters for clinicians, as there is currently little information regarding telehealth and malpractice liability across the nation, as claims involving telehealth have been few in number with most having been settled out of court with the final settlements sealed.21

How Mental Health Providers Can Stay Up-to-Date

  • Check your malpractice insurance to see if it specifically mentions the use of telehealth. Be sure to understand the terms of your policy, asking your provider for clarifications if necessary.
  • Ask your licensing board and/or personal attorney how your state laws and regulations are currently dealing with malpractice, liability, and negligence as they relate to telehealth.

Continuing Education and Competency

With the unprecedented rise in the use of telehealth, the nation is also confronted with a corresponding need to ensure that practitioners have been trained in how to optimally and safely treat their patients with this new service delivery method. In a recent comprehensive review of 249 publications analyzing ethical issues pertaining to the use of telehealth, therapist competence and need for special training, as well as clinical and therapeutic competencies specific to the online setting, were ranked as top concerns.22

Because therapeutic skills in in-person settings do not automatically translate into online therapeutic skills, a number of states have started to implement a variety of continuing education requirements specific to mental health professionals and the delivery of telehealth. The Florida Board of Clinical Social Work, Marriage and Family Therapy and Mental Health Counseling, for example, requires three hours of CE relating to “professional ethics and boundary issues or telehealth” each licensure renewal period,23 while the Virginia Board of Counseling states that a “counselor should seek training or otherwise demonstrate expertise in the use of technology-assisted devices, especially in the matter of protecting confidentiality and security.”24

While a number of states have waived CE requirements during the course of the pandemic for certain types of practitioners,25 both the Florida and Virginia requirements were reaffirmed during 2020, so practitioners cannot expect that the ongoing pandemic will toll their educational responsibilities.

How Mental Health Providers Can Stay Up-to-Date

  • Check your licensing board’s website for your CE requirements. Nearly all licensing board websites contain up-to-date information related to licensure renewal and education, with many prominently featuring telehealth FAQs, given the current need for such information.
  • Save yourself the time and headache of locating qualifying CE by letting trusted professionals and state officials do the legwork for you. Many licensing boards curate lists of qualifying CE programs for their licensees (if you cannot find it on their website, simply ask them). In addition, the American Psychological Association has compiled a list of telehealth courses which they are continually updating, and the American Psychiatric Association offers a number of telepsychiatry courses in their online Learning Center.26,27

Change is never easy, and the rapid adoption of teletherapy is no different. However, the effort will undoubtedly be worth your time, as the thoughtful expansion of teletherapy has the potential to advance a key principle of the American Psychological Association’s Ethics Code: Justice.28,29 Teletherapy meaningfully extends the reach of services, extending the benefit of mental health care to those who otherwise would not have access to such services, and that is most certainly something for which to strive.


Last Updated: Jul 12, 2021