BC-TMH cheat sheet

Telemental health is the delivery of behavioral health services through synchronous or asynchronous telecommunications technology; it includes video, phone, messaging, and remote monitoring, and is a modality of practice rather than a separate specialty.

Two service categories drive most rules: synchronous (real-time audio/video or audio-only) and asynchronous (store-and-forward, messaging, apps). Reimbursement, consent, and documentation requirements often differ between them.

Licensure rule: the clinician generally must hold a license in the state where the client is physically located at the time of service; the clinician's own location governs only where state law says so. Verify both jurisdictions before intake.

Interstate compacts (PSYPACT for psychologists, counseling and social work compacts where enacted) permit cross-state practice only for participating states and only for clinicians who have completed the compact's authorization process.

Prescribing controlled substances via telemedicine is governed by federal (DEA) registration plus state rules; Ryan Haight Act exceptions and their extensions change over time, so verify current status before each prescribing episode.

Emergency management plan must be established at intake: client's exact physical address each session, local emergency number, nearest emergency department, a designated emergency contact, and the clinician's backup communication channel.

Technology standards: use HIPAA-compliant, encrypted platforms with a signed business associate agreement; consumer video apps without a BAA are generally noncompliant for protected health information.

Informed consent for telemental health specifically covers technology risks, privacy limits, backup communication plan, emergency procedures, fees, and the client's right to withdraw or switch to in-person care.

Documentation for telehealth sessions records modality, client's physical location, clinician location, platform used, consent obtained, and any technology failure or interruption.

Informed consent has three elements: capacity to decide, adequate disclosure of risks/benefits/alternatives, and voluntariness. Telehealth adds technology-specific disclosures without replacing these core elements.

Confidentiality exceptions to disclose at intake: imminent risk of harm to self or others, suspected abuse or neglect of children, elders, or dependent adults, court order, and duty-to-protect statutes where the state imposes them.

Mandated reporting duties follow the law of the state where the client is located; a clinician licensed elsewhere must know that state's reporting thresholds and reporting mechanism.

Boundary and multiple-relationship rules are largely set by the licensing board's code of ethics; telemental health increases incidental contact risk (social media, shared online communities), so a written social media and contact policy is standard.

Competence requirement: clinicians must obtain training and, where applicable, supervision before practicing telementally; competence includes technology literacy, risk assessment at a distance, and adapting interventions to the medium.

Record retention periods vary by state and by client age (minors often retained until age of majority plus a set number of years); the longer of state law and payer contract controls.

HIPAA Security Rule requires administrative, physical, and technical safeguards; the Privacy Rule governs use and disclosure. Breach notification timelines and thresholds are set federally and may be tightened by state law.

Jurisdiction for complaints and legal actions usually lies where the client received services; malpractice coverage should explicitly include telehealth in all states of practice.

Cultural and accessibility obligations include interpreter access, captioning, and accommodation for disability; failure to provide language access can be both a clinical and a legal problem.

Encryption standard in practice: TLS for data in transit and AES-256 for data at rest are common benchmarks; HIPAA itself is technology-neutral but requires reasonable safeguards for confidentiality, integrity, and availability.

Business associate agreement (BAA) is required before a covered entity transmits PHI through a vendor; absence of a BAA makes the vendor noncompliant for PHI use regardless of the vendor's general security posture.

Minimum necessary standard limits PHI in messages, emails, and scheduling notes to what the recipient needs for the task at hand.

Authentication controls: unique user IDs, strong passwords or multi-factor authentication, automatic logoff, and role-based access reduce unauthorized access risk under the Security Rule.

Contingency planning: backup communication method (phone number), data backup, disaster recovery, and an emergency mode of operation must be documented and tested.

Asynchronous messaging is not appropriate for emergencies or time-sensitive risk; a stated response-time policy and an escalation path must be given to clients in writing.

Session documentation should include start/stop times, modality, participants, client location, clinical content, risk assessment, plan, and any technical disruption; the same standard of care applies as in person.

Audit and monitoring: access logs, device inventory, patch management, and staff training records are typical evidence of Security Rule compliance during investigation.

Recording sessions requires separate, specific consent; recordings are PHI and carry the same storage, access, and retention obligations as the clinical record.

Risk screening at a distance requires verifying the client's physical location and a call-back number before or at the start of every session; without a location, emergency response cannot be dispatched.

Validated instruments (e.g., PHQ-9, GAD-7, C-SSRS) can be administered remotely; remote administration does not change scoring but does change how item-level risk responses are followed up.

Suicide risk assessment elements: ideation, intent, plan, means access, prior attempts, protective factors, and collateral information. Distance increases reliance on verbal and observed cues and on collateral contacts with consent.

Means safety counseling is a core remote intervention: ask about firearms and medications in the home and negotiate specific storage changes with the client and, when appropriate, family.

Crisis plan components: warning signs, coping strategies, social contacts, professional contacts, emergency numbers, and steps to restrict access to lethal means; the client should have a written copy.

Escalation protocol at a distance: attempt to keep the client on the line, obtain exact address, contact emergency services in the client's jurisdiction, notify the emergency contact, and document the sequence and times.

Involuntary evaluation procedures are governed by the law of the state where the client is located; the clinician may need to contact that jurisdiction's crisis or law enforcement system directly.

Collateral contact requires a signed release unless an emergency exception applies; document who was contacted, when, and what was disclosed.

Follow-up after a crisis contact is a documented step: re-engagement within a defined interval, re-screening, and updating the safety plan.

Needs assessment, workflow mapping, and a written telehealth policy are typical prerequisites before launching a service; the policy should cover eligibility, exclusion criteria, consent, emergencies, and technology standards.

Eligibility screening should identify clients unsuitable for telehealth at intake: active high risk without a safe environment, lack of private space, insufficient connectivity, and need for physical examination.

Quality indicators include access metrics (time to appointment, no-show rate), clinical outcomes (standardized measure change), technical failure rate, and adverse event tracking.

Training and competency verification for staff typically includes platform use, privacy safeguards, emergency procedures, and documentation standards, with periodic refreshers.

Reimbursement rules differ by payer: Medicare, Medicaid, and commercial plans each define eligible codes, originating-site rules, modality restrictions, and modifiers; verify per payer and per state.

Credentialing and privileging: telehealth services must be within the clinician's scope and privileges; some organizations require site-specific privileging for distant-site providers.

Sustainability planning covers cost per encounter, technology licensing, staff time for setup and documentation, and contingency for platform outages.

Professional development includes staying current on state licensure changes, compact participation, and payer policy updates, which change more frequently than in-person practice rules.

Program evaluation should include client and clinician satisfaction, equity analysis by subgroup (broadband access, language, disability), and a feedback loop into policy revision.