Telehealth Documentation Requirements 2026: Checklist for High-Risk Care

The federal telehealth flexibilities, such as lifting the geographic restrictions, have recently been extended through December 31, 2027. But scrutiny around clinical documentation and defensibility has increased. We are in a “merry go round” of policy extensions, but in a Rutgers Policy Lab review of telehealth-related malpractice claims, over 70% were related to diagnosis not documentation highlighting how critical clinical decision-making and escalation protocols are in virtual care. Technological compliance is also complicated: platforms like Zoom require the right configuration and, where applicable, a Business Associate Agreement (BAA), while Apple does not typically offer a BAA for FaceTime. If a vendor should be acting as a Business Associate but won’t sign a BAA, that can create serious compliance risk for the covered entity. Here’s a defensible documentation checklist that you can implement now, with specific protocols for high-risk specialties.

The telehealth ‘must document’ basics (every visit)

Documentation quality drives the initial screening criteria for plaintiff attorneys. To survive a chart audit or legal review, every virtual encounter note must capture four categories.

Consent isn’t consent

Telehealth informed consent differs on legal requirements from general consent to treat. You must document the patient was informed about technological limits (e.g., inability to palpate) and privacy risks. Note that states vary, e.g., Arizona and California allow contemporaneous verbal consent, but Delaware (SW) and Wyoming (Psych) mandate written informed consent.

Modality, platform, and participants

Specialists should make sure their malpractice insurance aligns with how they deliver care virtually, since telehealth adds technical constraints and documentation scrutiny that don’t exist in the exam room. For neurosurgeons in particular where decisions can be high-stakes even on a “routine” follow-up—confirm your neurosurgeon malpractice policy explicitly covers telemedicine and the modalities you use. In the note, record the platform (e.g., Doxy.me), the modality (video vs. audio-only), and everyone who participated. If audio-only, document medical necessity and append Modifier 93 for Medicare when required. Also document “observational transparency” at the start—who else is present with the patient off camera/off mic.

Patient + provider location

Licensure is governed by the patient’s location during the encounter, not their home location. There’s a mandatory verification protocol that must be followed to confirm the patient’s address at the start of the encounter for licensure + safety reasons. But you must also capture your own location if you’re at home. Beware the suppression checkboxes on CMS forms (855I) that keep your location hidden from public provider directories.

Time + Vitals source

If billing by time, it must be documented so that staff time isn’t included, only the billing provider. For vitals, document the source carefully observed (by an FDA approved remote device) or self reported (which could be falsified).

High risk specialties: what changes, and why neurosurgery is special

Neurosurgery is among the highest-risk specialties for professional liability, and other procedure-heavy fields (such as OB/GYN and surgical subspecialties) also carry elevated malpractice exposure. In these settings, virtual care should use stricter suitability criteria, explicit red-flag screening, and clear escalation pathways to in-person evaluation to reduce failure-to-diagnose risk and strengthen defensibility. This approach can be applied even to post-operative follow-up: Morell’s et al. cohort study of 318 brain tumor patients reported “no statistically significant difference”, telemedicine follow-up showed similar emergency department use and wound infection rates compared with in-person visits (7.3% vs 6.01%) – supporting virtualization when patient selection and documentation clearly reflect screening criteria and escalation triggers.

Redflag screening and escalation

There are formal, objective triage tools for high stakes symptom screening. For headaches, the “SNOOP 5” criteria filters redflags (e.g., Systemic, Onset thunderclap, Older age, etc.). Caution the HINTS+ exam for dizziness but only if they have spontaneous nystagmus attempting this on episodic pt will be misleading.

Insurance coverage gaps

Malpractice policies often lack rolling IBNR (incurred but not reported) coverage, which is critical in the mobile telehealth market so that tail coverage isn’t purchased when leaving a platform. You should seek a telemedicine rider that covers risks unique to the mode of electronic communication.

Documenting the virtual exam (and its limitations)

The virtual exam “Diagnostic Hole” creates risk when not looking for nonverbal cues and vitals. A patient might look stable on camera but have a 150 b/p. Documentation has to call out the distinction between what is observed and what is instructed. As noted in npj Digital Medicine, digital health technology-specific risks must be integrated into standard clinical workflows to ensure patient safety and data accuracy.

Virtual substitutes and deferred elements

Don’t copypaste normal findings for non-performed exams (e.g., lungs clear but no remote stethoscope). Instead document compliant virtual substitutes:

• Motor strength: Pt lifts standard weight (e.g., 0.5L water bottle) against gravity
• Pronator drift: Look for “subtle pronation” (hand inward rotation) not full arm drop
• Sensory: Pt touches face/limbs with tissue to compare dermatomes
  

If you can’t adapt a test (e.g., reflexes) then “defer because of virtual modality.” Otherwise, you can be accused of missing a sign that should have been checked off.

Tech fails and connection loss

A “breakdown protocol” should be added to the consent, regarding tech fail. If aav/vid fails in a potential crisis moment, the correct action is to immediately notify the predesignated emergency contact, not fix wifi. This has to be documented for defense of clinical decision-making during a tech fail.

Safety netting and escalation — the most litigated ‘gap’

Safety-netting is a frequent focus in malpractice claims because it’s often rushed at the end of the visit, leading to gaps between what clinicians think they explained and what patients actually understood.

Working assessment + return precautions

Don’t use “return if worse.” Record your working diagnosis/differential and give clear, specific return precautions. Normalizing returning, many patients avoid follow-up because they fear being a “time waster” and document the thresholds for reevaluation and the alternate causes you discussed.

The 911 limitation

Since 911 routes are based on caller location, you can’t depend on dialing 911 to help a remote patient. Your emergency plan must include documenting local emergent numbers (police, fire) at the verified location prior to the start of the session.

Followups, messages, and handoffs – making the record match reality

Documenting understanding

Use the “Teach-Back” method not yes/no questions. Document that the patient can validly explain the next steps back to you.

Messages and referrals

When referring, document the specific doctor name, time of discussion, and what was said. For brief followups, CPT code 98016 (audio only 5-10m) and whether an in person was warranted legitimates the medical decision making for quick calls.

EHR + template pitfalls (and how to make notes defensible)

Modern documentation guidelines trades ridiculous amounts of HX/EXAM data for Assessment and Plan details. This helps avoid “note bloat” of irrelevant autofill that obscures clinical reasoning.

Template rules: customization over quantity

Each “qualifying so what” must exist for every clinical action. Don’t say a test was reviewed but it doesn’t matter, it has to be otherwise. Document so as to be prompted to document Statement of Progress for every session to justify continued.

AI drafting risks

AI Scribes require Knowledgeable Implied Consent but Recording requires Expressed Consent. You as the physician have “Ultimate accountability” for the output. Review for Hallucinations and address any inter-professional conflicts (e.g., nurse then physician) before signing.

Copy/paste telehealth documentation checklist

Just to audit readiness for virtual encounters, missing any of the “big four” (Consent, Modality, Location, Identity) risks recoupment. Incorporate these into every telehealth note:

Start of Visit

•  Identity Verified (visual ID or 2 Factor)
•  Patient Location Verified (not home, matches licensure jurisdiction)
•  Provider Location Documented (verify licensure state)
•  Participants (Observational transparency confirmed, who’s in room)

Consent + Modality

•  Telehealth Consent (risks, privacy, tech limits, accepted)
•  Modality (Zoom for Healthcare, Audio/Video specifically)
•  Audio only Medical Necessity + Modifier 93 (Medicare)

Clinical + Safety

•  Virtual Exam Limitations, “defer” non assessed
•  Safety Netting, specific, legitimized return
•  Escalation plan, local emergency numbers, connection loss protocol
•  Teachback, patient verbalizes plan/understanding