How to Build a Compliant Multi-State Telehealth Practice?

Telehealth makes it technically effortless to see patients anywhere in the country. The compliance framework underneath it makes the same goal operationally complex in ways that stop most organizations before they reach their growth targets. Building a compliant multi-state telehealth practice in 2026 means building a compliance infrastructure that scales with the business and doing so before regulatory exposure catches up to geographic ambition.

The foundational rule has not changed despite the post-pandemic expansion of telehealth: providers must be licensed in the state where the patient is physically located at the time of the encounter not where the patient lives, where they are domiciled, or where they receive their mail. That rule applies to every provider type physicians, NPs, PAs, therapists and in every state. What has changed in 2026 is how aggressively states enforce it, and how much infrastructure is now available to help organizations manage it at scale.

Many states have become stricter about verifying licensure, enforcing supervision requirements, and requiring telehealth-specific registration even as more patients seek virtual care and more organizations rush to meet that demand. The organizations succeeding in multi-state telehealth are not the ones that move fastest. They are the ones that build their compliance layer first and expand from a position of documented readiness rather than reactive catch-up.

This guide covers the complete compliance architecture of a multi-state telehealth practice licensing, corporate structure, physician oversight, HIPAA, prescribing, and the operational systems that keep everything current as the practice grows.

Step 1: Build your licensing foundation

Licensing is the long lead-time constraint in every multi-state telehealth expansion. Every other element of your compliance infrastructure can be built in parallel or in weeks. Licensing takes months and in some states, the better part of a year. Planning licensing timelines correctly is the difference between a delayed launch and a costly compliance gap.

The patient-location rule and what it means operationally

Your provider must be licensed in the state where the patient is physically located during the visit — not where the patient lives or where your practice is headquartered. This has practical implications for your intake workflows: every telehealth encounter must document the patient’s physical location at the time of service, because that location determines which state’s law governs the encounter. Patient location documentation — every telehealth encounter should clearly record where the patient was physically located at the time of the visit. This is not optional. It is the basis for determining which state’s rules apply.

Interstate Medical Licensure Compact (IMLC) for physicians

The IMLC is the most significant licensing efficiency tool available to multi-state physician telehealth practices. As of 2026, 42 states plus Washington D.C. and Guam participate in the compact. The IMLC allows eligible physicians — those holding a primary license in a participating state with no disciplinary history and meeting board certification requirements — to apply for licenses in multiple additional compact states through a single streamlined application, cutting months off traditional individual state licensing timelines.

Critical caveats: the IMLC does not remove the requirement to hold a license in each state where you practice. What it does is simplify the application process significantly. Each state still charges its own fee, and annual renewal requirements add ongoing administrative overhead. Additionally, IMLC licenses in Michigan became invalid as of March 28, 2026, following Michigan’s withdrawal from the compact. Verify current compact membership before structuring your licensing strategy around any specific state.

NLC and APRN Compact for non-physician providers

Nurse practitioners, CRNAs, CNMs, and CNSs are not covered by the IMLC — they have their own compact track. The NLC covers RNs and LPNs/LVNs across approximately 41 compact states. The APRN Compact, which would extend multistate practice to NPs and other APRNs, covers 17 states as of 2026 — and critically, major patient markets including California, New York, Texas, and Florida are not compact members for APRNs. NPs serving patients in these high-volume states must still obtain individual APRN licenses. Physician assistants have no active compact and require individual state licenses in every state they practice.

Licensing timeline rule of thumb: IMLC states: 30–60 days. Non-IMLC physician states: 60–120 days. Non-compact NP states: 60–150 days. California (any provider type): 4–9 months. Build your expansion timeline backwards from when you need licensed providers in a new state — not forwards from when you decided to expand there.

Step 2: Establish a compliant corporate structure

Licensing tells you who can see patients in each state. Corporate structure determines whether your business entity is legally permitted to operate in each state at all — and this is where multi-state telehealth practices most commonly create invisible compliance exposure that only surfaces during a regulatory investigation or an acquisition due diligence review.

Corporate Practice of Medicine (CPOM)

For telehealth providers serving patients in multiple states, compliance is not a single federal framework — it is a federal baseline plus the requirements of every state where patients are located. CPOM is one of those state-specific requirements. Most states prohibit non-physicians from owning or controlling medical practices — meaning a telehealth company structured as a standard LLC owned by a non-physician entrepreneur may be violating CPOM in every state where it sees patients, regardless of how its technology and services are otherwise structured.

The PC/MSO solution for multi-state telehealth

The standard compliance solution is the Professional Corporation (PC) and Management Services Organization (MSO) structure — a physician-owned PC in each CPOM state that employs clinical providers and delivers medical services, paired with a non-clinical MSO owned by the business operator that provides administrative and management services to the PC. For a multi-state telehealth organization, this means maintaining properly constituted PCs in every state with CPOM enforcement, with physician ownership and clinical control appropriately documented in each jurisdiction.

LocumTele’s 51-state compliant PC infrastructure service is designed to provide this structure correctly across every U.S. jurisdiction — eliminating the need for each telehealth organization to independently establish and maintain state-specific professional entities as they expand.

Step 3: Secure physician oversight in every state

Multi-state telehealth practices that employ NPs or PAs — which is the majority of telehealth organizations, since non-physician providers are the workforce backbone of virtual care delivery — need two distinct layers of physician oversight in every state of operation: a practice-level medical director and individual supervision or collaboration agreements for each NP or PA.

The medical director provides organizational-level clinical governance — protocols, standing orders, chart reviews, quality assurance — and must hold an active, unrestricted license in each state where the practice operates. Individual supervision or collaboration agreements govern the specific scope of each NP or PA’s practice in that state, filed with the appropriate licensing board and meeting that state’s specific documentation requirements.

For a telehealth organization operating in 20 states, this means 20 sets of physician oversight documentation — each tailored to that state’s specific requirements for the provider types on staff. LocumTele’s provider staffing network maintains physicians with active credentials across all 51 jurisdictions, providing both the medical director layer and the individual provider supervision layer without requiring each organization to source state-specific physicians independently.

The cascade risk: Most clinicians must still be licensed in every state where their patients are physically located at the time of a telehealth visit.

 If your NP’s collaborating physician does not hold a license in the state where a patient is located, the NP may not be authorized to see that patient — even if the NP themselves is licensed in that state. The physician oversight chain must be complete in every jurisdiction, not just the ones where your organization is most active.

Step 4: HIPAA-compliant platform and data infrastructure

HIPAA compliance is federal and applies uniformly across all states — but it is the floor, not the ceiling. Before expanding telehealth practice to a new state, assess whether that state has health privacy requirements beyond federal HIPAA. If it does, incorporate those requirements into your privacy policies and BAA review process. California’s CMIA, New York’s SHIELD Act, and similar state-level privacy frameworks add requirements that HIPAA alone does not address.

For platform infrastructure, the minimum requirements for a multi-state telehealth practice include:

• Signed Business Associate Agreements (BAAs) with every technology vendor that handles PHI — video platforms, EHR systems, scheduling tools, billing software, and any third-party data processors. Using a consumer-grade app like FaceTime or Zoom without a HIPAA-compliant setup puts your practice at risk.
• End-to-end encryption for all video sessions, messaging, and stored patient records — with encryption standards meeting HIPAA’s technical safeguard requirements (AES-256 at rest, TLS 1.2+ in transit)
• Audit logging that tracks who accessed what patient data and when — required by HIPAA and increasingly reviewed during state medical board inspections
• Role-based access controls ensuring providers only access records for patients they are authorized to treat
• 21st Century Cures Act compliance — patients should have easier access to their own records, and your systems should work with other platforms when needed

Step 5: Multi-state prescribing compliance

Prescribing across state lines adds a third layer of jurisdiction-specific requirements on top of licensing and CPOM: DEA registration, state controlled substance schedules, prescription monitoring programs, and telehealth-specific prescribing rules that vary by state.

DEA registration

Providers need a DEA registration in every state where they prescribe controlled substances to patients. The COVID-era special rules that allowed cross-state controlled substance prescribing expired in 2023. However, a fourth temporary DEA extension through December 31, 2026 currently allows controlled substance prescriptions via telehealth without a prior in-person visit, but permanent rules are still being developed. Monitor this closely — the expiration or modification of this extension will require operational changes for any telehealth organization prescribing Schedule II–V medications.

State prescription monitoring programs

Most states require providers to query the state’s Prescription Drug Monitoring Program (PDMP) before prescribing controlled substances — including for telehealth encounters. Requirements vary: some states mandate queries at every controlled substance encounter; others specify timeframes or exceptions. For a multi-state telehealth practice prescribing controlled medications, PDMP query compliance must be documented in the patient record for each applicable encounter in each state.

State-specific telehealth prescribing rules

Some states impose additional prescribing restrictions for telehealth encounters beyond federal rules — including requirements for a synchronous audio-video evaluation before prescribing certain medication classes, prohibition on prescribing specific substances via telehealth, or mandatory follow-up visit requirements for ongoing prescriptions. Verify the prescribing rules in each state before enabling those services for patients in that jurisdiction.

Step 6: Ongoing operational compliance systems

Building the compliance infrastructure is a one-time project. Maintaining it is an ongoing operational function. Multi-state telehealth compliance is not static — state laws change, licenses expire, supervision ratios shift, and new enforcement priorities emerge. Monthly or automated monitoring is becoming standard for multi-state operations. Organizations expanding to 10, 20, or 50 states benefit from outsourcing licensing and credentialing to specialists.

An operational compliance system for a multi-state telehealth practice includes:

LocumTele’s compliance and educational hub provides the regulatory monitoring, protocol update framework, and provider training infrastructure that keeps multi-state telehealth organizations current across all 51 jurisdictions — without requiring each organization to maintain a dedicated in-house compliance team for every state they operate in.

Related reading from LocumTele

• Compliant PC Infrastructure — 51-state professional corporation structure
• Medical Director Oversight — physician governance across all 51 states

Frequently asked questions

Q.1.Do telehealth providers need a license in every state they practice in?

Yes — the fundamental rule is that providers must be licensed in the state where the patient is physically located at the time of the encounter, regardless of where the provider is based. Licensing compacts like the IMLC (for physicians) and the NLC (for RNs/LPNs) streamline the process of obtaining multi-state licenses, but they do not eliminate the requirement to hold a license in each practice state.

Q.2.How many states are in the IMLC in 2026?

As of 2026, 42 states plus Washington D.C. and Guam participate in the Interstate Medical Licensure Compact. Michigan withdrew from the compact in March 2026, making IMLC licenses in Michigan invalid. Always verify current compact membership before relying on the IMLC for any specific state, as participation can change with legislative action.

Q.3.What is CPOM and does it apply to telehealth companies?

The Corporate Practice of Medicine (CPOM) doctrine prohibits non-physicians from owning or controlling medical practices in most states. It applies to telehealth companies just as it does to in-person clinics. A non-physician-owned telehealth LLC that employs physicians or NPs and directs their clinical activities may be violating CPOM in every state where it sees patients. The standard compliance solution is the PC/MSO structure — a physician-owned Professional Corporation delivering clinical services, with a non-clinical MSO providing administrative services.

Q.4.Do telehealth companies need a medical director in every state?

Any telehealth company operating in a state that employs non-physician providers needs physician oversight in that state. The medical director must hold an active, unrestricted license in each state where they are providing oversight. For multi-state telehealth organizations, this typically means either a physician with licenses in all operating states or a network of state-licensed physicians covering the full geographic footprint — exactly the structure LocumTele’s medical director service provides.

Q.5. Can telehealth providers prescribe controlled substances across state lines?

As of 2026, a fourth temporary DEA extension allows controlled substance prescribing via telehealth without a prior in-person visit through December 31, 2026. However, providers still need a separate DEA registration in every state where they prescribe controlled substances — the COVID-era single DEA rule expired in 2023. Most states also require PDMP queries before prescribing, including for telehealth encounters. Monitor DEA rulemaking closely, as permanent rules governing telehealth controlled substance prescribing are still being finalized.

Q.6.How can LocumTele help build a compliant multi-state telehealth practice?

LocumTele provides the complete compliance infrastructure for multi-state telehealth organizations: multi-state physician licensing and credentialing, medical director oversight with state-specific licensure, compliant PC/MSO corporate structure across all 51 states, individual NP and PA supervision agreements, and ongoing regulatory compliance monitoring. Our staffed provider network gives telehealth organizations immediate access to licensed physicians, NPs, and PAs in any jurisdiction — without managing individual state licensing applications independently.