A California clinician must hold an active California license to treat any client physically located in the state, and must obtain telehealth-specific informed consent, verify the client's identity and present address at each session, and document reasonable efforts to identify local emergency resources. These obligations sit alongside HIPAA, the Confidentiality of Medical Information Act, and payer-specific billing rules that govern how session details get recorded and reimbursed.
TL;DR:
- California licensees must document identity, current location, clinical appropriateness, and reasonable efforts to identify nearby emergency resources at every session starting January 1, 2026.
- Consent may be verbal, but clinicians should record its scope and cover privacy risks, technology failures, insurance limits, office visit rights, and confidentiality protections.
- A clinician treating someone physically in California needs an active California license; when clients travel, verify their current state and any narrow temporary practice exception.
- Acute suicidality, significant dissociation, or an unsafe setting or lack of privacy can make telehealth inappropriate; coordinate emergency response where the client is physically located.
- California Medicaid covers video, audio sessions under specific conditions, and limited store and forward services; confirm enrollment, notices, modifiers, and payer rules before billing.
Table of Contents
- Quick compliance checklist clinicians can use now
- Statutes and regulations that control telehealth practice in California
- Licensure, jurisdiction, and temporary practice rules clinicians must know
- Telehealth-informed consent and required documentation
- Clinical appropriateness and safety planning
- Privacy, security and platform selection: HIPAA, CMIA and BAAs
- Billing, reimbursement and parity obligations
- Practical session compliance checklist and mini-templates
- Penalties, complaints and enforcement: how regulators act
- How we help clinicians operationalize these requirements at Kin Wellness
- What Dakota wants every California clinician to fix first
- Virtual, licensed care that keeps compliance built in
- FAQ
- Sources
Quick compliance checklist clinicians can use now
Before another telehealth session goes on the calendar, run through these five checkpoints. They cover the areas regulators and payers scrutinize most often.
- License: confirm your California license is active and unrestricted before treating anyone physically in the state; trainees working under supervision have narrower exceptions that your supervisor should confirm in writing.
- Consent: your telehealth consent form should name the privacy risks of remote sessions, the possibility of technology failure, the limits of insurance coverage for telehealth, and the client's right to request in-person care instead.
- Session start: state your license number, verify the client's name and current physical address out loud, and note any change in location since the last visit.
- Tech: confirm your platform is encrypted end to end, that a signed business associate agreement is on file if the vendor touches protected health information, and that staff have been trained on the platform's privacy settings.
- Billing: check Medi-Cal provider enrollment status and payer-specific telehealth modifiers before submitting claims, since missing documentation is a common cause of denial.
Pro Tip: Keep a single dated log of license renewals, signed consent forms, and BAAs in one shared folder so an audit request never turns into a scramble.
Treat this list as a floor, not a ceiling. The sections below unpack the statutory language behind each item and show where clinicians most often fall short.
Statutes and regulations that control telehealth practice in California
Two legal sources anchor telehealth practice for California therapists. The first is statutory: Business and Professions Code §2290.5 defines telehealth for the state, requires verbal or written consent before any telehealth service begins, and states plainly that existing confidentiality laws apply in full to telehealth interactions. It does not create a separate, lighter standard for remote care. A session delivered over video carries the same confidentiality duties as one delivered in person.
The second source is regulatory. The Board of Behavioral Sciences approved amendments to its telehealth standards under 16 CCR §1815.5, effective January 1, 2026, after approval by the Office of Administrative Law. These amendments require licensees to obtain telehealth-specific informed consent, document reasonable efforts to identify emergency resources near the client's location, verify the client's identity and location at each session, assess whether telehealth remains clinically appropriate on an ongoing basis, and apply industry-standard practices for confidentiality and data security.
The regulatory shift worth flagging: the amended standards put the burden of identifying local emergency resources on the clinician, not the client, which means a one-line verification step belongs in nearly every session note.
In practice, these two legal layers convert into specific recordkeeping habits. A record should show when consent was obtained, what it covered, and that identity and location were confirmed that day. Records that omit this information do not automatically prove misconduct, but they remove the clinician's best evidence that the standard was met. Board of Behavioral Sciences guidance treats a documentation gap on these points as the kind of lapse that can support a finding of unprofessional conduct if a complaint is ever filed.
Licensure, jurisdiction, and temporary practice rules clinicians must know
The controlling rule is simple to state and easy to get wrong in practice: treating a client who is physically located in California requires a California license, regardless of where the clinician sits during the session. Location of the client, not the clinician, triggers the licensure requirement. A therapist licensed in another state cannot treat a California resident over video without either holding a California license or qualifying for a narrow temporary practice exception.
Temporary practice provisions exist for limited situations, such as a California client traveling briefly out of state or a clinician relocating temporarily, and they typically require advance notice to the relevant board and a defined time limit on the arrangement. The Board of Psychology's telehealth guidance notes that practitioners may also become subject to another jurisdiction's laws when either party is temporarily outside California, so confirming the client's current state before a session is not a formality. It determines which licensing board has authority.
Clinicians who serve clients who travel should build a short jurisdiction check into intake and periodic review:
- Ask where the client will be located at the start of every session, not just at intake, since travel changes the applicable law.
- Confirm whether the destination state recognizes any telehealth practice exception for an out-of-state licensed clinician.
- Document the specific exception relied upon, including any time limit, rather than assuming "telehealth is telehealth everywhere."
- Store any temporary practice approval or attestation in the client's file alongside the session note for that date.
Our cross-state practice checklist walks through this verification process in more detail for clinicians who regularly see clients who travel for work or family obligations.
Telehealth-informed consent and required documentation
Consent under BPC §2290.5 can be verbal or written, but the amended Board of Behavioral Sciences standards favor documentation that survives an audit. A verbal consent conversation still needs a contemporaneous note describing what was covered; a written form filed in the chart is the more defensible option and takes little extra time to implement.
The consent conversation, whichever format you choose, should cover:
- Privacy risks specific to remote sessions, including the possibility that household members or shared devices could expose session content.
- The chance of technology failure mid-session and the backup plan, such as a phone number to call if video drops.
- Insurance and billing limits that apply to telehealth versus in-person visits, since coverage can differ by payer.
- The client's right to request in-person care instead of continuing by telehealth.
- Confirmation that standard confidentiality protections apply, consistent with the statutory language in BPC §2290.5.
Session-level documentation sits on top of that initial consent. Each note should reflect that you verified the client's identity, confirmed their present address, and made a clinical judgment that telehealth remained appropriate that day. This does not need to be lengthy. A single sentence, something like "identity and current address confirmed, telehealth appropriate given stable presentation," satisfies the spirit of the requirement without turning notes into a compliance exercise.
Pro Tip: Build the consent and verification language into your EHR's session template so the fields appear automatically instead of relying on memory each time.
Retain consent forms and session notes according to your license type's standard retention period, and keep a running log of when consent was last renewed if a client's circumstances or your technology stack change.
Clinical appropriateness and safety planning
Telehealth is not clinically appropriate for every client on every day, and the amended Board of Behavioral Sciences standards expect an ongoing appropriateness assessment rather than a one-time determination made at intake. Factors to weigh at each session include current risk level, diagnosis and symptom severity, the client's physical environment and privacy, and whether the client has reasonable access to local crisis services if something goes wrong mid-session.
Documenting reasonable efforts to identify local emergency resources is now an explicit expectation, not a best practice suggestion. A workable approach:
- Ask the client's county or city at intake and confirm it has not changed before each session.
- Identify the nearest crisis line or emergency department for that location and note it in the chart.
- Re-verify this information whenever a client mentions travel, a move, or an extended stay elsewhere.
- Record the verification in a short, standardized phrase so it is easy to locate later.
Telehealth becomes contraindicated when a client presents with acute suicidality, significant dissociation, or an environment that compromises privacy or safety, at which point escalation to in-person care or a higher level of service is the clinically and legally safer path. If a client remote from your location meets criteria for an involuntary hold under California's 5150 provisions, coordinate with local emergency services in the client's actual location, since you likely cannot initiate the hold yourself from a different county. Mandated reporting obligations do not change because the session happened by video. They follow the same statutory triggers and timelines as in-person care.
Privacy, security and platform selection: HIPAA, CMIA and BAAs
Two privacy frameworks apply to every California teletherapy session at once. HIPAA, under 45 CFR parts 160 and 164, sets the federal floor for protecting health information, while the Confidentiality of Medical Information Act adds state-level confidentiality requirements that apply specifically to California providers and often extend further than HIPAA's minimums. The Board of Behavioral Sciences telehealth standards reference this combined framework directly, which means a platform or workflow that satisfies HIPAA alone may still fall short of CMIA.
Practical vendor diligence should include:
- Confirming the platform offers a signed business associate agreement, since a vendor that refuses one is not usable for clinical sessions involving protected health information.
- Checking that video and messaging are encrypted in transit and at rest, not just password protected.
- Reviewing who has administrative access to session recordings or chat logs, and limiting that access to the minimum necessary staff.
- Verifying the vendor's logging and audit trail capabilities, since you will need them if a breach investigation ever occurs.
- Confirming the vendor's data storage location and retention policy before sessions begin, not after a problem surfaces.
Pro Tip: Ask every telehealth vendor for their BAA template before you sign a service contract, not after, since some platforms marketed to therapists do not actually offer one.
If protected health information is compromised, both HIPAA and CMIA impose notification obligations with defined timelines that depend on the scope of the breach. A documented incident response plan, including who to notify and when, turns a stressful event into a manageable checklist rather than an improvised scramble. Our privacy research summary reviews common exposure points clinicians overlook when choosing a telehealth platform.
Billing, reimbursement and parity obligations
Medi-Cal telehealth billing has its own documentation layer on top of clinical requirements. DHCS guidance confirms that Medi-Cal covers synchronous video visits, audio-only sessions under specific caveats, and store-and-forward modalities in limited settings, but providers must be properly enrolled as Medi-Cal providers and must give beneficiaries required notices about their telehealth options before billing for the service.
AB-2339 broadened the Medi-Cal telehealth modalities available for designated services and added reimbursement parity language, though implementation details remain subject to department rulemaking. A practical takeaway: Medi-Cal's framework favors offering video when it is available, with audio-only permitted but expected to be documented as a deliberate choice rather than a default.
Parity obligations layer on top of Medi-Cal-specific rules. The Department of Managed Health Care enforces parity requirements, including amendments under SB 855, that require health plans to apply comparable financial and treatment limitations to mental health benefits as they do to medical benefits, and to document compliance with non-quantitative treatment limitations. For clinicians, this mostly affects how claims get coded and appealed rather than the clinical work itself, but understanding the framework helps when a client's telehealth claim gets an unexpected denial.
To reduce denials:
- Verify Medi-Cal or payer enrollment status before scheduling a new telehealth client, not after the first claim bounces.
- Document that video was offered when required, even if the client chose audio-only.
- Use the correct telehealth modifier and place-of-service code for each payer, since these vary.
- Keep a record of any beneficiary notice given, especially for Medi-Cal clients.
Billing teams juggling denials across multiple payers may find value in a dedicated operational review of common behavioral health billing fixes, and our own breakdown of telehealth claims fields covers the documentation details that most often trigger a rejection.
Practical session compliance checklist and mini-templates
A consistent session structure turns scattered compliance requirements into a repeatable habit. The sequence below fits into most EHR templates with minimal customization.
- Before the session: confirm consent is on file and current, check that the client's location has not changed, and verify the platform connection works.
- At session start: verify the client's name and present physical address out loud, state your license number if this is a new client relationship, and confirm the client's current emotional state supports telehealth that day.
- During the session: note any change in risk level, environment, or appropriateness that would affect the ongoing telehealth determination.
- At session end: confirm the client knows how to reach emergency services locally if needed before the next scheduled contact.
- After the session: complete coding and billing notes, document the identity and location verification in one line, and file any new consent or jurisdiction attestation.
| Session phase | Required action | Where it gets recorded |
|---|---|---|
| Pre-session | Confirm consent on file | Client chart, consent section |
| Session start | Verify identity and present address | Progress note |
| During session | Reassess telehealth appropriateness | Progress note |
| Post-session | Apply correct billing code/modifier | Billing record |
This structure satisfies the Board of Behavioral Sciences expectation that identity, location, and appropriateness get confirmed each session without adding meaningful time to clinical work.
Penalties, complaints and enforcement: how regulators act
Common triggers for a complaint or board inquiry include practicing without the required California license, missing or incomplete telehealth consent, session notes that lack identity or location verification, and data breaches involving unsecured platforms. Boards and payers investigating a complaint typically request the consent form, session notes for the relevant period, and any vendor agreements covering the platform used.
If you receive a complaint or an audit request:
- Preserve all records related to the client and time period in question without alteration.
- Notify your malpractice carrier and, where appropriate, legal counsel before responding substantively.
- Review your own documentation against the current Board of Behavioral Sciences telehealth standards to identify gaps proactively.
- Avoid discussing the specifics of an open complaint with anyone outside your legal and insurance representatives.
The most effective prevention remains unglamorous: consistent consent documentation, a repeatable session-start verification habit, and a vendor stack with signed BAAs in place before the first session, not after a problem arises.
How we help clinicians operationalize these requirements at Kin Wellness
We built our virtual outpatient and intensive outpatient programs around the same session-level checks outlined above: identity and location verification, telehealth-specific consent on file before the first visit, and documented appropriateness review at each touchpoint. Every session is delivered by a licensed clinician using a platform selected for its encryption standards and signed business associate agreement.
Our billing workflows are designed to address current Medi-Cal and private payer telehealth requirements, aiming to reduce documentation gaps that cause denials. We also maintain internal resources, including the cross-state practice guidance and parity breakdown referenced above, for clinicians who want a closer look at how these rules apply day to day.
What Dakota wants every California clinician to fix first
Three things first: confirm your license covers where your client actually sits today, refresh your consent form for the 2026 Board of Behavioral Sciences standards, and verify local emergency resources before, not during, a crisis. The most common mistake is treating consent as paperwork instead of a documented habit.
— Dakota
Virtual, licensed care that keeps compliance built in
Running a telehealth practice in California means juggling consent forms, jurisdiction checks, and payer rules on top of actual clinical work, and that administrative load is exactly what pulls attention away from clients. Our virtual Intensive Outpatient Program pairs licensed clinicians with structured group, individual, and family therapy, medication management, and aftercare planning, all delivered under the same documentation standards covered above.
- Sessions are delivered by licensed clinicians, so consent, identity verification, and appropriateness review happen as a matter of course.
- We accept insurance plans and handle the payer documentation that telehealth billing requires.
- EMDR therapy is available in-person or via telehealth for clients who need trauma-focused treatment.
If you are a working professional, parent, executive, or healthcare worker in California weighing a higher level of outpatient support, you can review our services and current program options or explore individual, group, and family therapy to find the right starting point.
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
FAQ
What are the new telehealth guidelines for 2026?
Beginning January 1, 2026, amended Board of Behavioral Sciences standards require California licensees to obtain telehealth-specific informed consent, verify client identity and location each session, document reasonable efforts to identify local emergency resources, and apply industry-standard confidentiality and security practices. These standards fall under 16 CCR §1815.5 and apply to licensed therapists delivering care via telehealth.
What is the 7 day rule for telehealth?
California's governing telehealth statutes and the amended Board of Behavioral Sciences standards do not define a "7 day rule" for therapy specifically; that term more commonly appears in other states' or payers' telehealth policies. California clinicians should instead focus on the identity, location, and appropriateness verification required at each individual session under BPC §2290.5.
What is the 5150 law in California?
California's 5150 provisions allow a qualified professional to place a person on an involuntary psychiatric hold when they pose a danger to themselves or others or are gravely disabled due to a mental health condition. For a client receiving telehealth who meets this criteria, the clinician typically needs to coordinate with emergency services physically present in the client's actual location, since the clinician often cannot initiate the hold remotely.
Is telehealth therapy ending?
No statute or regulation points to telehealth therapy ending in California. The Board of Behavioral Sciences amended its telehealth standards effective 2026 rather than restricting the practice, and Medi-Cal guidance continues to cover multiple telehealth modalities for designated services.
Do I need a California license to treat a client temporarily out of state?
Generally yes, because the client's physical location at the time of the session determines which state's licensure law applies, not the clinician's location. Temporary practice exceptions exist in limited circumstances, and the Board of Psychology's telehealth guidance recommends confirming the client's current state before each session rather than assuming the original license is sufficient.
Sources
- Notice of Approval of Regulatory Action — Board of Behavioral Sciences (telehealth)
- Telehealth frequently asked questions — California Department of Health Care Services (DHCS)
- Behavioral health care and parity — Department of Managed Health Care (DMHC)