Telehealth consent documentation: what to capture and where it lives
Most practices built a telehealth consent form in 2020 and have not looked at it since. The federal requirement is narrower than the form, the state requirement is wider, and neither is what the form was written for.
Medicare requires documented patient consent to the service, not a signed telehealth consent form, and it can be obtained verbally at the time of service by non-clinical staff. New Jersey adds five separate encounter requirements that have nothing to do with consent at all.
There is no federal telehealth consent form. There never was one.
What exists is a requirement that the patient consented, and that the record shows it. Those are different problems, and the second one is the one that fails. A practice can run a decade of virtual visits with a consent process that works perfectly at the point of care and still be unable to produce evidence of it when somebody asks eighteen months later.
Telehealth consent documentation went into most practices as a one-time 2020 project: build a form, get it signed, move on. Five years later the rules underneath it have moved twice, the form captures things nobody requires, and it is silent on two things New Jersey does require. This is a configuration question rather than a legal one. The rules are short and mostly settled. What is not settled, in most practices we look at, is where the answer lives once the visit is over.
Medicare telehealth consent: what CMS actually requires
CMS is explicit and it is brief. Its telehealth and remote monitoring guidance states that patient consent is required for all services, including non-face-to-face services, and that consent may be obtained at the same time the services are initially provided. There is no form, no template, and no signature requirement in that sentence. See the CMS telehealth and remote monitoring booklet for the current wording.
The second half is the part practices tend not to know. CMS does not require direct supervision to obtain consent: auxiliary personnel under general supervision can, and that person may be an employee, an independent contractor, or a leased employee. Which means the front desk can take it, where the workflow should have lived all along.
- Does require patient consent to the service, including non-face-to-face services.
- Does allow it to be obtained at the same time the service is first provided.
- Does allow auxiliary personnel under general supervision to obtain it.
- Does not specify a form, a template, a signature, or a retention period.
One wrinkle worth naming rather than glossing. For communication technology based services, the virtual check-ins, CMS stated that consent must be obtained annually. That instruction appears in Transmittal 10160 from May 2020, and we could not find it restated in the December 2025 booklet. It has not been withdrawn either, so it likely still stands, but a practice building policy around it should know the source is a 2020 transmittal rather than current guidance.
New Jersey telehealth requirements sit underneath all of this
New Jersey’s telemedicine and telehealth standards are set by N.J.S.A. 45:1-62, enacted in 2017 and unamended since. Later legislation changed telehealth coverage and reimbursement; it did not touch the practice standards in this section.
It is worth reading once, because it is short and because almost none of it is about consent. Subsection b sets four requirements on the provider: New Jersey licensure, continued regulation by the New Jersey board, liability insurance, and continued New Jersey jurisdiction if either party is in the state. Subsection c sets five requirements on the encounter itself.
Two of the five are things a platform either does or does not do. The encounter has to use interactive, real-time, two-way communication technology, and the provider’s identity and credentials have to be available to the patient during and after the visit, with contact information available for at least seventy-two hours afterwards. Neither is a consent question. Both are settings, and both are commonly wrong on a platform that was chosen in a hurry.
Two more are records questions: review the patient’s history before initiating contact on an initial encounter, and afterwards make records available to the patient on request and forward them to other providers with the patient’s affirmative consent. That last clause is the only place consent appears in the whole section, and it is about releasing records rather than about agreeing to be seen virtually.
The fifth is a policy judgement. Asynchronous store-and-forward is permitted only where the provider determines it can meet the same standard of care as an in-person visit. That determination should be written down somewhere, because the statute puts it on the provider to have made it.
Does a telehealth consent form need to exist at all?
A form is not required. A form is often still a good idea, for reasons that have nothing to do with CMS.
New Jersey is explicit that where consent is needed for forwarding records, it may be oral, written, or digital, provided the method chosen is appropriate under the standard of care. That is permissive language, and it is the statute telling you to use judgement rather than telling you to collect a signature. The practices we work with that handle this well have usually made the same choice: capture it as a structured field in the encounter rather than as a document.
- Decide what the consent is to. Consent to the service is a federal requirement. Consent to release records is a New Jersey requirement. Consent to a specific modality is neither. Conflating them is why the 2020 forms are so long.
- Put the capture where the encounter is. A checkbox and a free-text field on the telehealth template, filled at the point of care, beats a scanned PDF in a folder that nobody can search.
- Record who obtained it. CMS allows non-clinical staff to obtain consent. That is only useful if the record says which staff member did, because the alternative is an unattributed checkbox.
- Timestamp it. The annual question for communication technology based services is unanswerable without a date, and so is any question about whether consent preceded a change in the plan of care.
- Decide once where it is retained. The clinical record runs on New Jersey’s general treatment-record rule, not on anything in the telehealth statute. Security Rule policies and documentation run on a separate six-year clock under 45 CFR 164.316.
The reason to prefer a structured field over a document is retrieval. A signed PDF answers the question only if somebody can find the PDF. A field on the encounter answers it from the chart, which is where anyone asking is already looking, and makes it answerable in aggregate, which a folder of scans never will be.
None of this is expensive: a template change, a field, and a short conversation about who fills it in. Most of the cost of getting it wrong is paid years later. Our template work treats this as a standard build rather than a custom one.
Behavioral health telehealth consent has an extra layer
If the practice touches substance use disorder records, a second rulebook applies, and it changed recently enough that most published guidance is now wrong.
The 2024 final rule aligning 42 CFR Part 2 with HIPAA reached its compliance date on 16 February 2026. A single patient consent now covers all future uses and disclosures for treatment, payment and health care operations, which replaces the separate-consent-per-disclosure regime that made Part 2 so painful to administer. Counselling notes are carved out and still require their own separate consent. The HHS fact sheet on the Part 2 rule sets out the change.
HHS guidance for telebehavioral health is also more permissive than practices expect on the mechanics. Consent can be documented in writing or electronically before the appointment, or recorded through verbal consent at the beginning of each session. What HHS asks for alongside it is a specific disclosure: if the patient may have a history of substance use disorder, explain that this information will not be included in their medical record without additional consent.
That sentence is a workflow, not a form field. Somebody has to say it, and the record has to show they did. For practices running behavioral health telehealth, it is the most common gap we find, and it is fixable inside the encounter template.
Not sure what your telehealth template actually records?
We will look at what a telehealth encounter captures today, against what CMS and New Jersey each require, and tell you which of the two is the gap.
Remote patient monitoring consent moved, and most policies did not
Before 2020, consent for remote physiologic monitoring had to be obtained in advance. Transmittal 10160 changed both halves of that: consent can be obtained at the time services are furnished, and it can be obtained by individuals providing the service under contract to the ordering practitioner rather than by the practitioner personally.
The December 2025 booklet restates the current position simply, requiring patient consent at the time RPM services are provided. If a practice policy still says consent must be documented before the device ships, that policy is describing a rule that stopped applying five years ago, and it is almost certainly slowing down enrolment for no compliance benefit.
Advance-consent policies are a common reason RPM programmes stall between the order and the first reading, and the delay is self-inflicted. Practices running remote patient monitoring should check the policy against the transmittal before adding staff to fix what is actually a paperwork problem.
What a telehealth consent documentation review looks at
Not the form. Four things: whether consent to the service is captured inside the encounter, whether the capture records who obtained it and when, whether the New Jersey encounter requirements are met by the platform rather than by habit, and whether the current policy describes a rule that has since changed. Nearly every review turns up one superseded policy and one statutory requirement nobody configured. Both are cheap. Neither fixes itself, because the form looks fine and nobody opens it. A wider EHR solutions engagement usually catches this as a side effect of template work.
Telehealth consent: common questions
Does Medicare require a signed telehealth consent form?
Who is allowed to obtain telehealth consent?
What does New Jersey require that Medicare does not?
Is verbal telehealth consent enough, or does it need to be in writing?
How does HIPAA affect where telehealth consent is stored?
Let’s meet
Qventive supports telehealth programmes across New Jersey. Thirty years healthcare-exclusive, from our office in Hackensack.
- CMS requires patient consent for all services including non-face-to-face services, obtainable when services are initially provided, by auxiliary personnel under general supervision. cms.gov
- Annual consent for communication technology based services, and the 2020 change moving RPM consent to the time of service. cms.gov
- New Jersey telemedicine and telehealth practice standards, N.J.S.A. 45:1-62. pub.njleg.gov
- HHS fact sheet on the 42 CFR Part 2 final rule and its alignment with HIPAA. hhs.gov
- HIPAA Security Rule six-year retention for required documentation. ecfr.gov