Every US telemedicine encounter — whether a video consult with your primary care physician or a same-day prescription request through a direct-to-consumer telehealth company — typically requires you to consent to a patient agreement that combines the elements of an informed consent, a HIPAA notice, a service agreement, and (in many cases) a binding arbitration clause. These documents are presented as a formality but contain provisions with significant clinical, financial, and legal consequences. The scope of what your consent covers varies sharply by state and by service type. Some states require a pre-existing in-person doctor-patient relationship before a prescription can be issued by telemedicine; others permit prescribing without prior in-person contact. The Ryan Haight Online Pharmacy Consumer Protection Act (21 U.S.C. § 829) imposes federal restrictions on prescribing controlled substances by telemedicine. Your consent form should clearly state the scope of services and the limits.
What is a Patient Consent?
A US telemedicine patient consent form is a written agreement between a patient and a healthcare provider (or telehealth platform) covering: informed consent for telehealth services, HIPAA notice of privacy practices, financial responsibility, communication consent (text, email), arbitration provisions, and limits of telehealth (when in-person evaluation is required). It is governed by state medical practice acts, state telehealth-specific statutes (e.g., California Business and Professions Code § 2290.5; Texas Occupations Code Chapter 111; Florida Statutes § 456.47), the Federal Health Insurance Portability and Accountability Act (HIPAA, 42 U.S.C. § 1320d, 45 C.F.R. Parts 160 and 164), and the Ryan Haight Act (21 U.S.C. § 829) for controlled substance prescribing.
Red flags to watch for
Many telemedicine consents include arbitration clauses that prevent patients from suing in court and waive class action rights. Some state courts (e.g., California under Iskanian; Massachusetts) have struck these down as unconscionable in healthcare contexts; others (e.g., Texas, Florida) routinely enforce them. Patients should be aware of the impact before signing.
Telemedicine licensure follows the patient's location — the provider must be licensed in the state where the patient is at the time of the consultation. A consent form that does not address state licensure (or that purports to waive it) may indicate practice outside the provider's licensed scope, with potential implications for the validity of any prescriptions or treatment plans.
The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 generally requires an in-person medical evaluation before prescribing controlled substances by telemedicine, with limited exceptions (e.g., the COVID-era flexibilities, telemedicine waivers). A consent form that promises broad controlled-substance prescribing without addressing Ryan Haight requirements may be inviting compliance issues.
Some telehealth platforms use patient data for AI training, product development, or research without specific consent. While de-identification is permitted under HIPAA, broad blanket consents can extend further than patients realise. Specific opt-in for non-treatment uses is the better practice.
Many consents bundle treatment communication (appointment reminders) with marketing communication (promotional offers). HIPAA permits treatment-related communication without specific authorisation but requires authorisation for marketing. Bundled consent without an opt-out can result in unwanted communication and potentially violate the Telephone Consumer Protection Act (47 U.S.C. § 227).
Telemedicine cannot replace emergency care. The consent should clearly state that telehealth is not for emergencies and direct the patient to call 911 or go to an emergency room. Consents that downplay these limitations create patient safety risk and potential liability.
Your legal rights
US telemedicine patients are protected by: state medical practice acts and telemedicine-specific statutes (each state regulates differently); federal HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E) and Security Rule (45 C.F.R. Part 164, Subpart C); the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (21 U.S.C. § 829); the Federal Trade Commission Act (15 U.S.C. § 45) for unfair or deceptive practices; the Telephone Consumer Protection Act (47 U.S.C. § 227); the Federal Arbitration Act (9 U.S.C. § 1 et seq.) and state-specific arbitration limitations; and state malpractice laws. Complaints can be filed with state medical boards, the HHS Office for Civil Rights (HIPAA complaints), the DEA (controlled-substance issues), and the FTC.
Questions to ask before you sign
- 1Is the provider licensed in the state where I am physically located during the consultation?
- 2Does this consent waive my right to sue in court or to participate in a class action?
- 3What is the scope of prescribing offered, and how does it comply with the Ryan Haight Act for controlled substances?
- 4How will my health information be used beyond direct treatment — for product development, research, or marketing?
- 5What are the limitations of this service, and what should I do in an emergency?
- 6How is my health information stored and shared, and what is the breach notification process?
Disclaimer: This guide is for educational purposes only and does not constitute legal advice. Contract law varies by jurisdiction and individual circumstances. Always consult a qualified legal professional before making decisions based on this information.