Your Rights as a Telehealth Patient

Remote care does not reduce what you are owed as a patient. You are entitled to know who is treating you, where they are licensed, what is in your record and what happens to your data — and a practice that is awkward about any of those has told you something useful.

Most of these rights are not telehealth-specific. They apply in any setting and follow you online. What changes is that some are easier to quietly skip when the encounter is a video call with a company rather than a visit to a building.

Informed consent, and what telehealth adds to it

Ordinary informed consent means you understand what is proposed, the material risks, the alternatives including doing nothing, and the expected benefits. That does not change remotely.

Telehealth adds several things that many states require in their telemedicine rules, and that any decent practice covers whether required or not:

• That the encounter is happening by telehealth, with your agreement to that format.
• The limitations of the medium — no physical examination, no vitals unless you supply them, no imaging, and some conditions that cannot be assessed this way at all.
• What happens if the technology fails mid-consultation, and how contact is re-established.
• Whether the session is recorded, by whom, for how long, and your ability to object.
• Who else may be present, on their end and on yours.
• What to do in an emergency, given the clinician is not physically with you.
• How your information is stored and transmitted, and who it may be shared with.

Consent should be sought before the clinical part begins, and should be more than a checkbox on a signup form. If you were never told any of this, you were not properly consented, and you can ask for it now.

Knowing who is treating you

You have the right to your clinician's full name, their credentials — physician, nurse practitioner, physician assistant, and their specialty — and the states in which they hold a licence.

The licensure point is the one people miss. As a general rule, a clinician must be licensed in the state where the patient is physically located at the time of the consultation. Not where the clinician lives. Not where the company is registered. That is why a legitimate service asks where you are before booking you. Interstate compacts and state-specific exceptions exist, so verify anything that matters with the relevant state board.

Every state board publishes a free licence verification tool giving licence status, expiry and any public disciplinary action. A practice that names its clinicians is inviting that check. One that speaks only of "our medical team" has removed your ability to perform it — one of the signs discussed in how to spot a prescription mill.

Your medical records

Under the HIPAA Privacy Rule you have a right of access to your own protected health information held by a covered entity — the notes, test results, medication records and correspondence that make up your file. You can inspect it and obtain a copy, in the form and format you request where the provider can readily produce it, including electronically.

Practical points worth knowing:

• Providers must generally act within 30 days, with one permitted 30-day extension if they tell you why.
• They may charge a reasonable, cost-based fee for copies. They may not charge a search or retrieval fee, and they may not make payment of an outstanding bill a condition of access.
• You can direct a copy to a third party — another clinician, for instance — in writing.
• Psychotherapy notes kept separately by a mental health professional are treated differently and may be withheld. That is a narrow category and does not cover ordinary session records or medication notes.

The right to request an amendment

If something in your record is wrong or incomplete, you can request an amendment. The provider need not agree — they may decline if they did not create the record, or if they judge it accurate — but a refusal must be given in writing, and you may submit a statement of disagreement that becomes part of the record and travels with it.

This matters more than it sounds. Errors propagate: an incorrectly listed allergy, a diagnosis entered in error, a medication you never took. Reading your own file once is a worthwhile hour.

Privacy, and where to complain

A telehealth provider that is a HIPAA covered entity must protect your protected health information, give you a Notice of Privacy Practices describing how it uses and discloses that information, and limit disclosures to what is permitted or what you have authorised. Ours is set out in the privacy policy, alongside the terms and conditions.

Two limits are worth understanding. Not every health app or website is a covered entity — wellness apps, symptom checkers and some direct-to-consumer services fall outside HIPAA entirely, governed instead by their own privacy policy and by FTC authority over unfair or deceptive practices. "It's a health service" does not mean "HIPAA applies."

And the boundary of what counts as a disclosure is wider than people assume. Third-party analytics and advertising trackers embedded in a health website can transmit identifiers alongside the page you visited, and the page itself can reveal a condition. Regulators have treated that as a disclosure of health information — a serious and widespread problem, covered in telehealth privacy: what health websites do with your data.

How to raise a problem

The practice first. Every covered entity must have a designated privacy contact and a complaints process, described in its Notice of Privacy Practices. Put it in writing and keep a copy.

The state licensing board for clinical conduct, competence or professional behaviour. Boards investigate complaints against licence holders and this is the route with actual teeth.

HHS Office for Civil Rights for privacy and security matters, through its online portal, generally within 180 days of when you knew about the problem.

The FTC or your state attorney general for deceptive marketing, billing practices, or subscription traps.

A practice that responds to a records request or a privacy question with hostility has answered a different question than the one you asked.

The right to an in-person referral

Telehealth cannot examine you. It cannot palpate an abdomen, listen to a chest, look in an ear, or take a blood pressure without your equipment. Where remote care is not adequate you are entitled to be told, and to be pointed somewhere that can help.

Ask for a referral if a symptom is not improving, if something needs examination or imaging, if you want a second opinion, or if you simply want to be seen in person. A clinician who cannot say "this needs an in-person assessment" is one whose business model does not permit it. Where the line falls is set out in what telehealth is actually good for — and what it isn't.

The right to decline

You can refuse any treatment, at any stage, for any reason or none. You can end a consultation. You can decline a prescription after it has been written. You can choose not to proceed after paying for an assessment — the fee bought the clinician's time and opinion, not your agreement to act on it.

You can also decline parts of a service: recording, marketing communications, optional data sharing not necessary to your care. Marketing consent should be separately obtained and separately revocable, never bundled into consent for treatment.

And you can leave. A prescription written by one practice does not bind you to it. Request your records, take them elsewhere, continue care with someone you would rather see.

A short checklist before a first appointment

Who is my clinician, and in which states are they licensed? Is the consultation fee charged whether or not I am prescribed anything? How do I get a copy of my record? Who do I contact between appointments? What is your emergency policy? Does the site share information with advertising or analytics services?

Any practice worth using answers those without difficulty, because they are just descriptions of how it operates. Preparing properly for the appointment itself is the other half of getting value from it, and our own answers to most of the above are on the FAQ page.