Telehealth Launch Without a Risk Assessment
TeleHealth Now is a 30-clinician group launching direct-to-consumer telehealth in 12 states within 90 days. Clinicians are licensed in only three states; the group plans to use contracted advanced practice providers and a national laboratory. The service will prescribe some controlled substances, collect cash pay, and bill commercial insurers. Marketing says board-certified physicians and HIPAA-compliant platform. The compliance officer has not completed a formal risk assessment; the last enterprise risk assessment covered only the brick-and-mortar clinics. The COO wants to launch on time and asks compliance to sign off on the model. The general counsel asks for a ranked risk register and a 90-day mitigation plan. Two states have recently changed telehealth prescribing rules, and one payer has issued a prepayment review notice.
1. Design the risk assessment approach for the launch. Explain how you would identify, score, and prioritize risks, and what makes this assessment defensible.
Read the worked answer
Start with a regulatory inventory by state and service: licensure, telehealth modality, prescribing including controlled substances and state-specific rules, consent, privacy, billing, and marketing. Build a risk register with likelihood, impact, velocity, and detectability; score before and after controls. Use state boards, payer policies, CMS, FDA, and internal data on clinician licensure. Defensibility comes from documented methodology, reproducible scoring, an owner and due date for each risk, and evidence of board review. Include a 90-day plan: weeks 1–2 inventory; weeks 3–4 scoring and prioritization; weeks 5–8 control design; weeks 9–12 testing and launch gate. Do not treat the assessment as a one-time sign-off; set triggers for new states, new payers, and prescribing changes. Because the service is launching in 90 days, distinguish launch-blocking risks such as unlicensed practice, controlled-substance prescribing, and false marketing from risks that can be monitored after launch, such as documentation quality. The assessment should be approved by the compliance committee and reported to the board with residual risk.
2. Identify the top five compliance risks and, for each, a specific control or mitigation that must be in place before launch.
Read the worked answer
Top risks: (1) Unlicensed practice - clinicians seeing patients in states where they lack licensure. Control: licensure matrix by state, patient-location capture, blocking workflows, and credentialing verification before scheduling. (2) Controlled-substance prescribing - DEA registration, state telehealth restrictions, and prescription monitoring program checks. Control: narrow formulary, specialist review, hard stops, and audit. (3) False or unsupported marketing - board-certified used for non-physicians or expired certifications. Control: substantiation file, marketing review, and corrective takedown. (4) Billing for non-covered services or wrong modality - payer-specific telehealth rules and place-of-service or modifier errors. Control: payer matrix, claim edits, and prebill review. (5) Privacy and security - platform BAAs, patient identity verification, and home-environment privacy. Control: BAA inventory, security risk analysis, encryption, and identity-proofing. Add a sixth: cross-state consent and minor consent. Each control needs an owner, a test, and evidence; before launch, the top three must be tested and pass.
3. The COO asks you to sign off. Explain what you would and would not sign, and how you would communicate residual risk to the board.
Read the worked answer
Do not sign an unqualified launch approval. Sign a conditional compliance clearance that states what has been verified, what remains open, and the residual risk. For example: Compliance has verified licensure for the three states and payer rules for two payers; controlled-substance prescribing and nine state launches remain open and are launch-blocking. If the COO proceeds, document the decision and escalate to the board or audit committee chair. The compliance officer’s role is not to veto business decisions but to ensure informed risk acceptance. Communicate a one-page risk register with red, amber, and green status, the specific patient and billing harms, and the mitigation timeline. Recommend a phased launch in licensed states only, with a gate for additional states. Avoid signing a blanket HIPAA-compliant or compliant statement; those are legal conclusions and may be false. Ask legal to review marketing claims and payer notices. The board should receive residual risk and the COO’s acceptance in writing; if the COO refuses, the compliance officer should use the escalation pathway in the compliance charter.