The Complete Guide to Telehealth Therapy for Providers in 2026

Telehealth therapy has moved past the “pandemic experiment” phase. The American Psychological Association’s 2025 practitioner survey found that 67% of psychologists now deliver at least some services via telehealth, up from 49% in 2022. Medicare’s permanent telehealth expansion, signed into law in late 2024, eliminated the last major uncertainty about whether virtual therapy would remain reimbursable. The question for providers is no longer whether to offer telehealth therapy — it is how to do it well.

This guide covers every operational decision a therapist needs to make when launching or refining a telehealth practice: compliance requirements, platform selection, clinical adaptation, reimbursement, and the hybrid model that most providers are converging on.

Why Telehealth Therapy Adoption Continues to Grow

Three forces are sustaining telehealth therapy demand beyond the pandemic surge:

Client expectations have permanently shifted. A 2025 survey by the National Council for Mental Health Wellbeing found that 74% of clients who tried virtual therapy prefer it for at least some sessions. Convenience is the top driver — eliminating commute time, childcare logistics, and workplace stigma.

Therapist supply cannot meet local demand. HRSA estimates a shortage of over 8,000 mental health providers across the U.S. in 2025, concentrated in rural counties. Telehealth therapy allows providers in saturated urban markets to serve underserved regions, provided licensing requirements are met.

Payer coverage has stabilized. All 50 states and D.C. now have some form of telehealth parity law. While specifics vary, the reimbursement landscape is far more predictable than it was even two years ago.

The financial case reinforces the clinical one. The Veterans Health Administration reported telehealth no-show rates of 7.5% compared to 16.7% for in-person visits. Lower overhead, fewer cancellations, and broader geographic reach add up.

HIPAA Compliance for Telehealth Therapy: What the Rules Actually Require

HIPAA compliance is the non-negotiable foundation of any telehealth therapy practice. The penalties are real: the Office for Civil Rights (OCR) imposed over $4 million in HIPAA fines related to telehealth and electronic PHI breaches in 2024 alone. The COVID-era enforcement discretion for telehealth — where OCR looked the other way on non-compliant platforms — officially ended in late 2023.

The Four Pillars of HIPAA-Compliant Telehealth

1. Business Associate Agreement (BAA). Any technology vendor that transmits, stores, or could access protected health information (PHI) must sign a BAA with your practice. This includes your video platform, your EHR, your email provider (if you send session links or clinical content via email), and your cloud storage. A vendor claiming to be “HIPAA compliant” without signing a BAA is not, in fact, HIPAA compliant for your purposes.

2. End-to-End Encryption. Video and audio transmissions must be encrypted in transit and at rest. The standard is AES-256 encryption for data at rest and TLS 1.2+ for data in transit. Standard Zoom (the free consumer version) does not meet this requirement. Zoom for Healthcare, with a signed BAA, does.

3. Access Controls and Audit Logging. Your telehealth platform must support individual user authentication, role-based access, automatic session timeouts, and audit trails showing who accessed what, when. If your platform cannot produce these logs, you cannot demonstrate compliance during an OCR audit.

4. Breach Notification Readiness. You must have a documented process for identifying, containing, and reporting breaches involving PHI transmitted during telehealth sessions. Breaches affecting 500+ individuals require notification to OCR, affected individuals, and prominent media within 60 days.

Platforms That Do Not Meet HIPAA Requirements

To be explicit: FaceTime, standard Skype, WhatsApp, Facebook Messenger, Google Meet (free tier), and standard Zoom are not HIPAA compliant for clinical use. Even if a platform offers encryption, the absence of a signed BAA means any PHI passing through it constitutes a compliance violation.

Telehealth Compliance Checklist for Therapists

Use this checklist before your first virtual session or during an annual compliance review:

Technology Compliance

• Video platform vendor has signed a BAA with your practice
• Platform uses AES-256 encryption at rest and TLS 1.2+ in transit
• Automatic session timeout is configured (15 minutes or less of inactivity)
• Waiting room feature is enabled so clients do not enter sessions unattended
• Screen sharing is restricted to host-only by default
• Session recordings (if any) are stored in a HIPAA-compliant, encrypted environment
• Your EHR/practice management system has a signed BAA

Administrative Compliance

• Written telehealth policies and procedures are documented
• Telehealth-specific informed consent is obtained from every client before the first virtual session
• Consent form covers: risks of telehealth, emergency procedures, recording policies, technology failure protocols
• Staff have completed HIPAA training that includes telehealth-specific scenarios
• Annual risk assessment includes telehealth-specific threats (unsecured Wi-Fi, shared devices, screen visibility)
• Breach notification policy and contact list are current

Physical Environment

• Provider conducts sessions from a private space where conversations cannot be overheard
• Clients are advised (in writing) to participate from a private location
• Provider’s screen is not visible to others in the room
• Devices used for telehealth have up-to-date OS, antivirus, and firewall protections
• Work devices are separate from personal devices, or a HIPAA-compliant MDM policy is enforced

State-Specific Requirements

• Provider holds a valid license in the client’s state of residence at time of service
• Provider has verified their state board’s telehealth-specific regulations (some states require an initial in-person session)
• Applicable interstate compact membership (PSYPACT, ASWB Mobility, Counseling Compact) is active and current
• Telehealth services comply with the state’s definition of “originating site” if applicable

Cross-State Licensing: Navigating the Interstate Compact Landscape

One of the most operationally complex aspects of telehealth therapy is licensing. The foundational rule has not changed: you must hold a valid license in the state where your client is physically located at the time of the session, not where your office is.

Interstate Compacts as of 2026

Three compacts are reshaping cross-state telehealth therapy practice:

PSYPACT (Psychology Interjurisdictional Compact). As of early 2026, 42 states plus D.C. have enacted PSYPACT legislation. Psychologists who obtain an E.Passport or Interjurisdictional Practice Certificate (IPC) can practice telepsychology across all member states. Application is through the PSYPACT Commission, not individual state boards. Processing takes 4–6 weeks.

Counseling Compact. Enacted by 36 states as of January 2026. Enables LPCs, LCPCs, and equivalent titles to practice across member states under a privilege-to-practice model. Eligibility requires an unencumbered license in your home state, a qualifying graduate degree, and passing the NCE or NCMHCE.

ASWB Social Work Mobility Initiative. The Association of Social Work Boards has facilitated mobility agreements in over 30 states. Full interstate compact legislation for social workers remains in progress, with 18 states having enacted social work compact legislation by early 2026.

For Disciplines Without Compacts

Marriage and family therapists, psychiatric nurse practitioners, and other specialists without active compacts must apply for licensure in each state where they treat clients. Some states offer temporary telehealth permits or expedited applications for out-of-state providers.

Critical operational note: Even with compact membership, you must track where your clients are at the time of each session. A client who travels to a non-compact state for a week is not covered. Build a “location confirmation” step into your session-start workflow.

Choosing the Right Technology Stack for Online Therapy

Technology decisions for telehealth therapy should prioritize three things in this order: compliance, reliability, and clinical workflow integration.

Video Conferencing Platforms

The major HIPAA-compliant options for therapists fall into two categories:

Dedicated telehealth platforms (Doxy.me, SimplePractice Telehealth, TheraNest, Galenie) — These are purpose-built for clinical use, with features like virtual waiting rooms, session notes integration, consent management, and BAAs included by default. The advantage is reduced configuration burden; compliance features are on by default rather than requiring manual setup.

General platforms with healthcare tiers (Zoom for Healthcare, Microsoft Teams with Healthcare license, Google Meet with Workspace for Healthcare) — These offer HIPAA-compliant configurations but require manual setup of security controls, waiting rooms, and encryption policies. They also require separate BAA execution.

Minimum Technical Requirements

For providers:
- Computer or tablet with HD webcam (external recommended over built-in)
- Wired Ethernet or Wi-Fi with minimum 10 Mbps upload/download
- Backup internet plan (mobile hotspot) for connection failures
- Headset with noise-cancelling microphone
- Front-facing lighting so clients can read facial expressions

For clients (include in onboarding materials):
- Device with camera and microphone
- Stable internet connection (minimum 5 Mbps)
- Private, quiet location
- Platform app or browser access pre-tested before the first session

Practice Management Integration

A fragmented tech stack — one tool for video, another for scheduling, a third for notes, a fourth for billing — creates compliance gaps at every handoff. The most efficient telehealth therapy practices consolidate into a single platform that handles scheduling, video sessions, clinical notes, and client management under one BAA. This is the approach Galenie takes: a unified, HIPAA/GDPR-compliant environment where session scheduling, notes, client records, and AI-assisted documentation live in one system.

Clinical Best Practices for Virtual Therapy Sessions

Delivering effective therapy over video requires deliberate adaptation. A 2024 meta-analysis in the Journal of Clinical Psychology (78 studies) found no significant outcome difference between videoconference-delivered CBT, DBT, or psychodynamic therapy and their in-person equivalents — but effectiveness depends on provider technique.

Building Therapeutic Alliance Remotely

Camera positioning matters. Position your camera at eye level so your face fills roughly two-thirds of the frame. Looking at the camera lens (not the client’s video feed) creates the experience of eye contact.

Name the medium explicitly. At the start of treatment, acknowledge that telehealth is a different experience. Invite clients to share what feels different. This normalizes the adjustment and gives you clinical data.

Check in on the environment. Asking “Are you in a private space where you feel comfortable talking freely?” at session start is both a compliance measure and a clinical intervention. Clients in shared spaces will self-censor — knowing this lets you adjust session goals.

Compensate for reduced nonverbal data. You lose peripheral body language on video. Make more explicit verbal reflections: “I noticed your expression shifted when you mentioned your mother — can you tell me more?” Over video, you need to verbalize observations you might simply note internally during in-person work.

Managing Clinical Emergencies Remotely

Every telehealth practice needs a documented emergency protocol covering:

• Client’s physical location confirmed at session start (required to dispatch emergency services)
• Local emergency contacts — crisis center, 911 dispatch, and designated emergency contact documented in each client’s record
• A secondary communication channel — phone number to reach the client if the video connection drops during a crisis
• Clear criteria for when telehealth is no longer appropriate and in-person or higher-level-of-care referral is needed

Populations and Modalities That Require Special Consideration

Not every client or modality translates seamlessly to telehealth therapy:

• Young children (under 8): Play therapy and expressive modalities are significantly limited. Parent coaching models often work better via telehealth than direct child sessions.
• Severe psychosis or active suicidality: Most clinical guidelines recommend in-person care or a hybrid model with telehealth supplementing in-person sessions, not replacing them.
• EMDR: Telehealth-adapted EMDR protocols exist and have growing evidence support, but require specific platform features (bilateral stimulation tools) and additional informed consent about the adapted format.
• Group therapy: Group telehealth works but demands stricter facilitation — muting protocols, explicit turn-taking, and smaller group sizes (6–8 maximum vs. 8–12 in person) to maintain cohesion.
• Couples therapy: Requires that both partners are in the same room or on separate devices in separate rooms (the latter is sometimes clinically preferable). Clarify this in advance.

Insurance Reimbursement for Telehealth Therapy in 2026

Reimbursement is where many providers stumble — not because coverage is unavailable, but because coding and documentation requirements differ from in-person services.

Key Billing Codes

• CPT 90834 (45-minute individual psychotherapy) and 90837 (60-minute) remain the primary codes for telehealth therapy sessions. These are the same codes used for in-person sessions.
• Place of Service (POS) code 10 designates “Telehealth Provided in Patient’s Home,” which is the correct POS for most outpatient telehealth therapy. POS 02 (“Telehealth Provided Other than in Patient’s Home”) applies when the client is at another facility.
• Modifier 95 indicates synchronous telehealth service delivered via real-time audio-video. Some payers use modifier GT instead — verify with each payer.
• Audio-only sessions use modifier 93 (FQ for Medicare). Not all payers cover audio-only for behavioral health, and those that do often reimburse at a lower rate. Check each payer’s policy.

Medicare Telehealth Policy (Post-2024 Permanent Expansion)

The Consolidated Appropriations Act of 2024 and subsequent CMS rulemaking made several telehealth flexibilities permanent for Medicare:

• Geographic restrictions eliminated — clients can receive telehealth therapy from their homes regardless of whether they live in a rural or urban area
• The in-person visit requirement within 6 months of a telehealth mental health visit remains in effect but is waivable if the provider documents why an in-person visit is not feasible
• Licensed clinical social workers and licensed professional counselors can serve as distant site providers
• Audio-only behavioral health services remain covered under specific conditions (client lacks video capability, provider documents the reason)

Commercial Payers

Most commercial payers now reimburse telehealth therapy at parity with in-person rates, though “parity” definitions vary:

• Payment parity (same reimbursement rate) is mandated in approximately 28 states
• Coverage parity (must cover the same services) is mandated in all 50 states plus D.C., but this does not guarantee equal payment
• Prior authorization requirements for telehealth therapy have largely been eliminated by major payers, but verify with regional and smaller plans
• Frequency limits — some payers cap the number of telehealth sessions per month or require a ratio of in-person to virtual sessions

Document every session thoroughly using a structured format like SOAP notes. Include the technology used, the client’s location, the start and end times of the clinical service (distinct from total call time), and any technical disruptions. Payers audit telehealth claims at higher rates than in-person claims, and inadequate documentation is the most common denial reason.

Building a Hybrid Therapy Practice Model

A 2025 survey by Therapy Brands found that 58% of private practice therapists now operate hybrid models (up from 34% in 2022), maintaining physical office space while conducting a portion of their caseload virtually. If you are setting up a new practice, choosing your delivery model early is one of the most consequential decisions you will make.

Structuring Hybrid Schedules

The most effective hybrid models are not random mixes of in-person and virtual days. They follow deliberate patterns:

The Block Model: Designate specific days as in-person and others as telehealth. For example: Monday and Wednesday in-office, Tuesday and Thursday virtual, Friday administrative. This minimizes context-switching and allows you to optimize each environment (office setup vs. home office).

The Client-Choice Model: Let clients choose their modality session-by-session with guardrails. Require an initial in-person assessment, then allow virtual follow-ups unless clinical indicators suggest otherwise. This maximizes flexibility but requires a scheduling system that handles both modalities without double-booking physical space.

The Clinical Criteria Model: Assign modality based on clinical need. New intakes, crisis sessions, and specific modalities (EMDR, somatic work) happen in-person. Established CBT, check-ins, and medication management follow-ups happen via telehealth. This model is the most clinically rigorous but requires clear decision criteria and client buy-in.

Financial Considerations for Hybrid Practices

Running a hybrid practice changes your cost structure:

• Office space: You may be able to downsize or share office space if you only need it 2–3 days per week. Subleasing your office on telehealth days to another provider can offset costs.
• Technology investment: Budget $500–1,500 for a professional telehealth setup (quality webcam, ring light, acoustic panels, reliable headset, second monitor). This is a one-time investment that pays for itself within a few weeks of reduced overhead.
• Scheduling efficiency: Virtual sessions eliminate buffer time between clients (no hallway handoffs, no room transitions). You can ethically and sustainably schedule 10–15% more clients on telehealth days without reducing session quality.
• No-show reduction: Offering a telehealth option for clients who might otherwise cancel (mild illness, weather, childcare disruption) directly protects revenue.

Client Engagement and Retention in Telehealth Settings

Telehealth therapy reduces one barrier (physical access) but introduces others (screen fatigue, technical frustration, reduced sense of connection). Providers who maintain strong retention rates address these proactively.

Onboarding Practices That Reduce Early Dropout

Send a tech-check invitation before the first session. A 5-minute test call where the client verifies their camera, microphone, and internet connection prevents the first session from being consumed by troubleshooting.

Provide a one-page “How to Prepare for Your Virtual Session” guide. Cover: find a private space, close other tabs and applications, have water nearby, silence phone notifications.

Set expectations early. A brief, honest framing during intake — “Video therapy is effective for most of what we will work on, and I will let you know if I think we need to meet in person for something specific” — builds trust and prevents disappointment.

Reducing Screen Fatigue

• Offer a 5-minute break during 60-minute sessions (a practice that also benefits the provider)
• Use audio-only for portions of sessions where visual contact is not clinically necessary (some clients find closing their eyes during guided exercises more comfortable on a phone call than on video)
• Encourage clients to position their device at a comfortable distance rather than face-to-phone distance
• Consider 45-minute sessions as your default rather than 60-minute — research on “Zoom fatigue” from Stanford’s Virtual Human Interaction Lab suggests cognitive load increases significantly after 45 minutes of continuous video interaction

Measuring Engagement

Track these metrics to identify retention risks early:

• Late cancellation and no-show rates by modality (in-person vs. telehealth) — if telehealth no-shows spike, investigate whether it is a specific client population or a systemic issue
• Session completion rates — clients ending sessions early may indicate discomfort with the format
• Outcome measure trajectories — if a client’s PHQ-9 or GAD-7 scores plateau after switching to telehealth, the modality may not be working for them
• Rebooking patterns — clients who book one session at a time rather than recurring slots are at higher attrition risk regardless of modality

Telehealth Therapy Effectiveness: What the Research Shows

The telehealth therapy effectiveness literature is now substantial enough to draw condition-specific conclusions.

Depression and anxiety: A 2024 Cochrane systematic review of 53 RCTs found no clinically significant difference in PHQ-9 or GAD-7 score reductions between videoconference and face-to-face CBT.

PTSD: Telehealth-delivered CPT and PE therapy show comparable effectiveness to in-person delivery. VA implementation data suggests telehealth may improve completion rates by reducing avoidance-related dropout.

Substance use disorders: Telehealth is effective for counseling and behavioral interventions but must be paired with in-person monitoring for medication-assisted treatment requiring observed dosing.

Eating disorders: CBT-E via telehealth shows promise for bulimia nervosa, but anorexia nervosa treatment often requires in-person medical monitoring alongside psychological intervention.

Child and adolescent therapy: Parent-mediated interventions via telehealth are well-supported. Direct therapy with adolescents (12+) shows comparable outcomes to in-person. For younger children, the evidence favors in-person or hybrid approaches.

Therapeutic alliance: A 2024 meta-analysis in Psychotherapy Research covering 31 studies found no statistically significant difference in working alliance scores between video and in-person therapy when assessed by both client and therapist ratings.

Frequently Asked Questions

Is telehealth therapy as effective as in-person therapy?

For most common mental health conditions — depression, anxiety, PTSD, and adjustment disorders — peer-reviewed research shows no statistically significant difference in outcomes between telehealth therapy and in-person therapy when delivered via synchronous video. Specific populations (young children, severe psychosis, active suicidality) may benefit more from in-person or hybrid approaches.

What are the HIPAA requirements for telehealth therapy?

HIPAA requires four things for telehealth therapy: a signed Business Associate Agreement (BAA) with every technology vendor that handles PHI, end-to-end encryption (AES-256 at rest, TLS 1.2+ in transit), access controls with audit logging, and a documented breach notification process. Consumer-grade platforms like standard Zoom, FaceTime, and WhatsApp do not meet these requirements.

Can I provide telehealth therapy to clients in other states?

You must hold a valid license in the state where your client is physically located at the time of the session. Interstate compacts — PSYPACT for psychologists (42+ states), the Counseling Compact for LPCs (36+ states), and emerging social work compacts — allow multi-state practice under a single credential. Without compact membership, you need individual state licensure.

How do I bill insurance for telehealth therapy sessions?

Use your standard CPT psychotherapy codes (90834, 90837) with Place of Service code 10 (patient’s home) or 02 (other telehealth location) and modifier 95 (synchronous audio-video). Audio-only sessions use modifier 93. Most commercial payers reimburse telehealth therapy at the same rate as in-person sessions in states with payment parity laws.

What equipment do I need for telehealth therapy?

At minimum: a computer or tablet with an HD webcam, a wired internet connection or reliable Wi-Fi with 10+ Mbps speeds, a headset with a noise-cancelling microphone, front-facing lighting, and a HIPAA-compliant video platform with a signed BAA. Budget $500–1,500 for a professional-grade setup.

Do I need separate malpractice insurance for telehealth?

Most professional liability policies already cover telehealth services, but verify this with your carrier. Key questions: Does the policy cover telehealth across all states where you are licensed? Does it cover audio-only sessions? Are there exclusions for specific telehealth modalities? Request written confirmation and keep it on file.

What should my telehealth informed consent form include?

Your telehealth-specific informed consent should cover: the nature and limitations of telehealth therapy, risks (technology failure, privacy limitations, reduced nonverbal communication), emergency protocols, recording policies, the client’s responsibility to ensure a private environment, your technology failure plan, and the client’s right to discontinue telehealth and request in-person services.

How do I handle a client emergency during a telehealth session?

Confirm the client’s physical address at the start of every session. Maintain local emergency service numbers for each client’s area. Have a secondary communication method (phone number) documented. If a crisis occurs during session, stay on the line while a colleague or staff member contacts local emergency services. Document the incident thoroughly immediately after.