Summary Points

. A provider’s license and associated jurisdiction should be considered when offering videoconferencing, especially if one is to practice across state lines. Depending on jurisdiction, a provider may be liable in both locations should an issue or emergency arise.

. While varying by state, cross-state practice is often possible through temporary provisions (i.e., < 30 days).

. Ongoing cross-state practice is possible through a provider becoming licensed in each state of practice, or enrolling in an interjurisdiction compact (e.g., PSYPACT) that makes them eligible to practice in any state entered into the compact without the need for additional licenses. . Prior to the onset of videoconferencing, providers should critically evaluate patients for appropriateness. Particular consideration should be given to the patient’s medical and mental health histories, diagnostic presentation, technical ability, technology availability, current levels of motivation, financial factors, and both location and transportation issues.

. Videoconferencing-specific informed consent should be secured both verbally and in writing above and beyond any standard informed consent process for F2F services. The process should detail aspects of practice, including standards of care, strengths and limitations, differences from F2F care, and administrative differences related to scheduling, communication, and billing.

. Prior to the onset of treatment, the provider should create a safety plan that includes a list of emergency contact information (e.g., names, addresses, emails, phone numbers) for both the patient and alternative individuals (e.g., spouse, family, friends, community members). Emergency contact information should also include the names, addresses, and phone numbers for the nearest medical center and law enforcement offices.

. Related to HI PA A, the provider should take care to ensure data security of any PHI, whether physical and electronic. For e-PHI, a provider should enact physical, technical, and administrative safeguards, including at least 128-bit encryption for data, training for anyone coming into contact with the information, appointment of a privacy official, and BAAs for any third-party vendors who will have access to the e-PHI.

. Should a data breach occur, the provider should critically evaluate the situation to determine the types and amounts of data breached, who the breach could affect, and how the breach was mitigated. The provider should then inform the patient(s) in plain language with detail of what occurred and what was done. Finally, the same information should be provided to HHS.

. At the onset of each session, the provider should verify the identity and location of the patient.