A denial lands on your biller's desk: place-of-service mismatch on a video visit. The same afternoon, your privacy officer discovers the behavioral health team has been using a scheduling-plus-video tool nobody put in the vendor inventory. Both problems trace back to the same root cause — your practice is running on at least three competing definitions of telemedicine at once, and nobody wrote down which one governs which workflow.

This guide is for the administrator who has to reconcile them. It covers how payer, state, and federal privacy rules each define the term differently, where those differences surface in coding and documentation workflow, and what the definition of telemedicine you adopt means for your Business Associate Agreements, your designated record set, and your breach exposure.

What Is the Definition of Telemedicine? (Short Answer for Administrators)

Telemedicine is the delivery of clinical services to a patient at a distance using telecommunications technology. There is no single legal definition. Three separate sources define it, and they do not agree:

  • Payers define it for reimbursement — Medicare's statutory telehealth benefit is narrower than most commercial plans, and it distinguishes telehealth services from separately paid communication technology–based services.
  • States define it for licensure, prescribing, informed consent, and payment parity. Some state statutes say "telemedicine" and mean physician services only; others use "telehealth" as the umbrella term.
  • HIPAA does not define it at all. The Privacy and Security Rules apply to protected health information regardless of the modality that carries it.

For operational purposes: treat "telemedicine" as the clinical encounter and "telehealth" as the broader category that also includes remote monitoring, store-and-forward, and non-clinical support. Then override that with whatever definition your specific payer contract or state statute uses, because those are the ones that generate denials and complaints.

Three Definitions of Telemedicine Live in Your Practice Simultaneously

The reason this matters is that each definition attaches to a different obligation, and your staff hit them in different order.

The payer definition drives the claim

CMS maintains the authoritative reference for what Medicare treats as a covered telehealth service, including the list of eligible codes and the statutory conditions attached to them. Review the current CMS telehealth coverage page before your billing lead builds a payer grid — the geographic, originating-site, and modality conditions have been extended and modified by Congress repeatedly, and the applicable window changes.

Commercial payers write their own definitions into contract language. Some require real-time audio and video. Some pay audio-only encounters at parity, some at a reduced rate, some not at all. Some require the patient to be established. Your grid needs a row per payer, not a single house rule.

State medical boards define telemedicine to determine when a valid patient relationship exists and where the clinician must be licensed. The operative rule is almost always that the patient's physical location at the time of the encounter determines which state's license applies. That is a front-desk problem before it is a legal problem — if your intake script does not capture the patient's location at the start of each virtual visit, you cannot demonstrate compliance after the fact.

Many states also require a separate, documented telemedicine consent distinct from your general treatment consent. Some require it once; some require it per encounter. Assign one person to maintain that matrix and re-verify it annually.

The HIPAA position drives everything else

HIPAA's silence on the term is the point. OCR's enforcement discretion for telehealth platforms during the COVID-19 public health emergency ended after a 90-day transition period that closed on August 9, 2023. Since then, every telemedicine modality you run must meet the Security Rule on its own merits — access controls, audit controls, transmission security, and a signed BAA with the platform vendor. OCR's guidance on using remote communication technologies for audio-only telehealth spells out how the rules apply when there is no video component at all.

Where the Coding Definition Bites: Place of Service and Modifiers

This is administrative guidance about process, not a statement that any code fits any clinical situation. Your clinicians document the encounter; your coders apply payer policy to what was documented. Keep that boundary clean in writing.

The mechanics your billing staff work with:

  • Place of service codes distinguish telehealth furnished in the patient's home from telehealth furnished elsewhere. Payers use these to apply different facility and non-facility rates.
  • Modifiers signal the modality — one set for synchronous audio-and-video, another for synchronous audio-only. Payers differ on which they require and whether they accept both a POS code and a modifier.
  • Communication technology–based services — brief virtual check-ins, remote evaluation of patient-submitted media, digital online assessments through a portal — are separately defined and are not the same thing as a telehealth visit under most payer rules.

Build the selection logic as a documented policy, not tribal knowledge. The policy should say: what the clinician must record in the note (modality used, patient location, clinician location, start and stop time, consent verification, and whether the encounter was converted mid-visit from video to audio-only), and how the coder maps those documented facts to the payer's published policy. When an auditor asks why a claim carried a particular POS, the answer should be a paper trail, not a person's memory.

The mid-visit conversion problem

Video drops. The clinician finishes by phone. If the note does not capture that, the claim and the record disagree — and that is the kind of discrepancy that turns a routine payer audit into a refund demand. Add a required field to the telemedicine note template that forces an answer.

Your Telemedicine Vendor List Is Longer Than You Think

Ask your IT lead to name every vendor that touches a virtual encounter. You will get three names. The real count is usually eight to twelve.

Walk the workflow end to end and inventory each handoff:

  1. The scheduling tool that sends the appointment link
  2. The SMS or email gateway that delivers it
  3. The identity verification or patient check-in module
  4. The video platform itself
  5. Any cloud recording or transcription service
  6. The ambient documentation or AI scribe tool, if clinicians use one
  7. Interpretation services joined into the call
  8. The EHR integration layer or middleware
  9. Remote monitoring device vendors and their data platforms
  10. The e-prescribing and pharmacy routing service
  11. Your clearinghouse
  12. Any patient-satisfaction survey tool triggered post-visit

Every one of those that creates, receives, maintains, or transmits PHI on your behalf is a business associate and needs a signed agreement before it goes live. HHS publishes the required BAA provisions, and "we're HIPAA compliant" in a vendor's marketing copy is not one of them.

If your BAA file has gaps — and after three years of telehealth expansion, most do — you can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export. It is a one-time purchase, which matters when you need to paper six vendors this quarter and none of them warrant a subscription line item.

Two clauses to negotiate specifically for telemedicine vendors

Recording and retention. Does the platform retain session recordings, and for how long? Where? Can you disable retention entirely? A vendor holding video of your patients is holding PHI on your behalf, and you inherit the consequences of their retention default.

Breach notification timing. The regulation permits a business associate up to 60 days from discovery to notify you. That leaves you nothing. Negotiate for notice within 5 to 10 business days, and require the vendor to supply the affected-individual list in a usable format.

Records Requests Now Include Video Artifacts

A patient requests their complete record. Your release-of-information staff pull the chart notes. Do they pull the in-session chat transcript? The AI scribe's raw output? The recording, if one exists?

The designated record set is defined by function, not format — records used to make decisions about the individual. If a clinician relied on the chat log or the transcript, it is arguably in scope. You have 30 days from the request, with one permitted 30-day extension. Decide the scope question now, in writing, and train ROI staff to it. Deciding it under a 30-day clock while a patient escalates is how complaints get filed.

Related: if you use ambient AI documentation, know whether the vendor retains audio, whether it uses your data for model training, and whether that use is permitted by your BAA. "De-identified for product improvement" is a contractual question with a specific standard behind it, not a courtesy disclosure.

A Practical Assignment Grid

Definitions become operational when a named person owns each piece.

  • Billing lead — maintains the payer definition grid; reviews policy bulletins quarterly; owns the POS/modifier policy document.
  • Privacy officer — owns the vendor inventory and BAA file; reviews new modality requests before go-live; owns the designated record set scope decision.
  • Clinical lead — owns the note template and the modality documentation fields.
  • Front-desk supervisor — owns the intake script capturing patient location and consent verification.
  • IT lead — owns the risk analysis entry for each telemedicine platform, including encryption in transit and at rest.

Every new telemedicine modality — a new platform, a new remote monitoring program, a new asynchronous intake form — should trigger a documented risk analysis update before the first patient uses it. NIST's telehealth remote patient monitoring guidance is a workable reference architecture if you are standing up an RPM program and need something more concrete than "conduct a risk assessment."

What to sample quarterly

Pull ten telemedicine encounters at random. Verify each one has: documented patient location, documented modality, documented consent, a claim whose POS and modifier match the documented modality, and a platform that appears in your BAA file. Five minutes per chart. Log the results. That log is your evidence of ongoing oversight when someone asks.

Controlled Substances and Behavioral Health Deserve Their Own Row

DEA's telemedicine prescribing flexibilities for controlled substances have been extended by temporary rule more than once. Do not let clinicians operate on last year's expiration date — verify the current status before renewal season, and have a documented fallback if an in-person evaluation requirement returns.

Substance use disorder records carry an additional layer under 42 CFR Part 2, which imposes consent and redisclosure requirements beyond HIPAA. If your telemedicine program includes SUD treatment, your platform selection and your BAA both need to account for it. HealthIT.gov's telemedicine resources are a reasonable starting point for the technology-side requirements.

Write the Definition Down and Date It

The most useful artifact you can produce this month is a one-page internal document that states, explicitly, which definition of telemedicine your practice uses for each purpose: this one for coding, this one for licensure, this one for privacy scoping. Date it. Assign an owner. Review it when a payer bulletin or state rule changes.

That single page prevents the two failures this article opened with — the denied claim and the unpapered vendor — because it forces the question of who decides and on what basis.

If your vendor file has telemedicine platforms without executed agreements, close that gap first: generate the BAAs you're missing and get them signed before your next audit sample. If the broader documentation set — risk analysis, policies, workforce training records — is also thin, automated HIPAA compliance documentation will get you to a defensible baseline faster than rebuilding it in a word processor.