Guide · Healthcare · Behavioral Health Telehealth

Psychology Practice Telehealth Compliance: Consent, Records, and Vendors

Telehealth turned every behavioral health practice into a technology operation almost overnight, and the compliance obligations did not pause for the transition. Three areas, informed consent, records, and the vendors in between, carry most of the risk, and each is manageable with a little deliberate attention.

By Lincoln Square Law · 9-minute read

For a psychologist or behavioral health practice, telehealth is now simply how a large share of care is delivered. That normalization is a good thing clinically and a quiet risk legally, because obligations that were designed around an office visit apply just as fully to a video session, and the technology adds new ones. The good news is that the requirements are not mysterious. They cluster around informed consent for remote care, the confidentiality and handling of especially sensitive records, and the security of the platforms and vendors that make the session possible. Get those three right and you have addressed most of what matters.

Informed consent for telehealth is its own conversation

Consent to treatment is familiar, but telehealth requires consent to the modality, not just the care. A patient should understand and agree to receiving services remotely, and that consent should cover the things that are genuinely different about a video session: the possibility of technology failure and what happens if a session drops, the limits of remote care and when an in-person visit is needed, how privacy is protected on the patient’s end as well as yours, and the plan for emergencies when you and the patient are not in the same place. That last point deserves particular care in behavioral health. Before a remote session begins, you should know the patient’s physical location and have a protocol for a crisis: local emergency contacts, the patient’s address, a plan for when a patient in distress is a state away from you. Document the telehealth consent as its own element, because it establishes that the patient agreed to the format and its limits, not merely to treatment in the abstract.

Records: sensitive by default, and doubly protected

Behavioral health records are among the most sensitive information a practice holds, and they carry protection beyond the baseline. HIPAA applies, and psychotherapy notes maintained separately receive special treatment under the Privacy Rule, generally requiring specific authorization to disclose and standing apart from the rest of the record. On top of the federal framework, Illinois provides strong statutory protection for mental health records through its Mental Health and Developmental Disabilities Confidentiality Act, which imposes its own consent and disclosure requirements that can be more restrictive than HIPAA. The practical implication is that a behavioral health practice cannot treat records the way a general medical office might. Confirm how your telehealth platform creates, stores, and transmits records, keep psychotherapy notes appropriately separate, and make sure your release-of-information practices satisfy both the federal rules and the Illinois confidentiality statute, which is easy to overlook and consequential to miss.

Subpoenas and requests: pause before you produce

Telehealth does not change a reality that behavioral health practices face regularly: a subpoena or records request for mental health information is not a command to hand everything over. Because these records carry heightened protection under both federal law and the Illinois confidentiality statute, the arrival of a subpoena is a moment to slow down and confirm what may lawfully be disclosed, to whom, and with what authorization or court order. Producing protected mental health records in response to a request that did not actually authorize their release is a serious disclosure problem. Build a habit of treating every request for these records as something to verify before you respond, not after.

Vendors: your platform is a business associate

A telehealth session runs through technology you do not own: a video platform, a scheduling tool, a practice-management or records system, perhaps an AI-assisted note-taker. Each vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and each requires a business associate agreement before it touches patient information. The consumer video tools people reached for in a hurry are frequently not built for this, and using a platform that will not sign a BAA or that is not configured for healthcare is a compliance gap sitting in plain sight. Inventory the vendors in your telehealth workflow, confirm you have a BAA with each, and pay special attention to any tool that records, transcribes, or analyzes sessions. A note-taking assistant that captures a therapy session is handling exceptionally sensitive information and warrants a hard look at what it does with it.

Licensure and the patient’s location

Telehealth makes geography invisible on the screen and very much present in the law. As a general rule, care is regulated where the patient is located at the time of the session, which means a psychologist must be mindful of the licensure requirements of the state the patient is sitting in, not only the state where the practice is based. A patient who travels, moves, or is simply out of state for a session can raise a licensure question that did not exist in an office-only practice. Know where your patients are when you treat them, and understand the boundaries of your licensure before a convenient remote session becomes a jurisdictional problem.

Put it in a telehealth policy

The way to make all of this durable is to write it down. A telehealth policy that specifies your consent process, your emergency protocol, your records handling under both HIPAA and the Illinois confidentiality statute, your vendor and BAA requirements, and your approach to patient location turns a set of good intentions into a repeatable standard your whole practice follows. It also gives you something to show if your practices are ever questioned. A policy is not bureaucracy for its own sake. It is how a small practice makes sure that the tenth clinician’s tenth remote session is handled as carefully as the first.

How we help behavioral health practices

We help psychologists and behavioral health practices build telehealth compliance that fits the realities of remote care: consent that covers the modality and its emergencies, records handling that satisfies both HIPAA and the heightened Illinois protections, vendor arrangements backed by real business associate agreements, and clarity on the licensure questions that geography raises. The aim is not to make telehealth harder. It is to let a practice deliver remote care with the same confidence it brings to the office, knowing the compliance foundation underneath is solid.

Minors, guardians, and remote consent

Treating minors by telehealth adds a layer, because consent generally must come from a parent or guardian, and the practice has to confirm it is dealing with the person authorized to consent, harder to verify through a screen than across a desk. Custody arrangements can determine who may consent and who may access records, and a remote workflow makes it easy to lose track of which adult is on the other end. Build a process for verifying guardianship and documenting who consented, and be clear about how a minor patient’s records are handled and disclosed, particularly given the heightened protection Illinois law affords mental health information. The convenience of telehealth should not erode the care you would take, in an office, to confirm who is authorized to make decisions for a child.

Group, couples, and family sessions on video

Remote group, couples, and family work raises confidentiality questions an individual session does not. Multiple participants, sometimes in different physical locations, complicate who can hear what, how you confirm each participant’s identity and privacy, and how records reflect a session involving several people. Set expectations with participants about the privacy of their own environments, confirm that your platform supports these formats securely, and think through how a multi-party session is documented in a way that respects each participant’s confidentiality. These formats are entirely workable remotely, but they reward planning, because a privacy lapse in a group setting can affect several people at once.

Train the practice, not just the policy

A telehealth compliance policy only protects a practice if the people delivering care actually follow it, which makes training the connective tissue between intention and reality. Every clinician and staff member who touches a remote session should understand the consent process, the emergency protocol, the records rules under both HIPAA and the Illinois confidentiality statute, and which platforms and tools are approved, and which are not. The most common way a sound policy fails is quietly, when a well-meaning clinician reaches for a convenient but unvetted tool or skips a consent step to save time. Periodic, practical training that reflects how care is actually delivered keeps the policy alive, and documenting that training gives the practice something to stand on if its practices are ever questioned.