Telehealth payment compliance covers two separate problems. The first is getting paid correctly by Medicare, Medicaid and private insurers. The second is taking card payments from patients without violating card network rules, consumer protection law or your processor’s terms. Miss either one and you face denied claims, frozen funds or a terminated merchant account. This guide covers both, with the federal rules that apply as of October 2026.

Davincipay
Build Payment Processing for Telehealth
DavinciPay supports telehealth businesses with payment gateways, acquiring relationships, fraud prevention, chargeback mitigation, and underwriting support.
Explore payment solutions

TL;DR

  • Most Medicare telehealth flexibilities, including home as an originating site, run through December 31, 2027. Medicaid and private payers still differ state by state.
  • Claims fail most often on small details: missing modifiers and the wrong Place of Service code (POS 02 vs. POS 10).
  • If patients pay by card or subscribe to a recurring plan, you need a processor that understands telehealth, plus clear disclosure and easy cancellation.
  • Keep documentation to in-person standards, and answer records requests inside the 45-day window.
  • Choose your payment partner before you launch, not after your first freeze.

Table of Contents

Two kinds of telehealth payment compliance

Most search results focus on reimbursement. That makes sense if you bill insurance. But many telehealth companies are cash-pay or hybrid: weight management programs, men’s and women’s health, dermatology, mental wellness memberships, and prescription programs bundled with supplements. These businesses depend on card processing, and their compliance risk looks different.

Area Who sets the rules Typical failure
Insurance reimbursement CMS, state Medicaid agencies, private payers Wrong code, missing modifier, no documentation
Clinical and licensing State practice acts, boards Treating a patient in a state where the clinician is not licensed
Card acceptance Card networks, acquiring banks Chargebacks above thresholds, unclear billing descriptors
Recurring billing FTC, state auto-renewal laws Hard-to-cancel plans, unclear terms
Data security HIPAA, PCI DSS Card data or health data handled outside required controls

We cover each below, starting with the largest dollar exposure for most providers: Medicare.

Medicare telehealth rules in 2026 and 2027

Federal guidance treats telehealth as a delivery method, not a separate benefit. Services must still fit the clinician’s state practice act, especially for cross-state care and scope of practice, as HHS telehealth policy guidance notes.

Here is what is in force today:

  • Medicare patients can receive non-behavioral telehealth care at home through December 31, 2027.
  • Geographic restrictions on the originating site are lifted for non-behavioral services through the same date.
  • Audio-only is allowed for non-behavioral services under the extensions.
  • The in-person visit requirement for behavioral and mental health telehealth, within six months of the first service and annually after, is waived through December 31, 2027.

That end date matters for planning. Do not build a business model that only works if the flexibilities become permanent. Congress has extended them before, and the extension can lapse. Model your revenue both ways.

On facility fees: the Medicare originating site facility fee (HCPCS Q3014) for calendar year 2026 is $31.85, which is 80 percent of the lesser of the actual charge or the fee schedule amount. Patients remain responsible for any deductible and coinsurance. Check the CMS list of telehealth services each year, because covered codes change.

Billing details that cause denials

Compliance teams see the same errors again and again. They are small, and they are expensive.

Place of Service codes

POS 02 means the patient received telehealth somewhere other than home. POS 10 is for telehealth when the patient is at home. HHS billing guidance warns that using the wrong one can delay or deny payment. Build the patient’s location into your intake flow so billing staff never have to guess.

Modifiers

Audio-only visits need modifier 93. The same HHS page identifies missing modifiers and incorrect POS codes as common reasons for claim delays. Add a pre-submission check that blocks claims missing either one.

The 7-day rule

People search for the “7 day rule” because it trips up online-visit billing. For digital E/M codes 99421 to 99423, if the patient starts an online inquiry about the same or a related problem within 7 days of a previous E/M service, the digital visit is not separately reportable. The codes are also reported once per 7-day period, per the AMA coding handbook. Messaging-heavy programs should track this.

Seven-day timeline for digital E/M billing

Documentation and audits

Telehealth records must meet the same standard as in-person records. If a Medicare contractor sends an additional documentation request, you have 45 calendar days. Miss it and the claim is denied under 42 CFR § 405.930. The billing provider carries that responsibility even when records sit with a third party, according to the Medicare Program Integrity Manual. If your EHR, telehealth platform and billing company are separate vendors, write down who pulls which records and how fast.

Medicaid and private payers: verify state by state

Medicaid is far less uniform than Medicare. States have broad flexibility to set reimbursement methods, and federal Medicaid guidance requires that payment meet standards of efficiency, economy and quality of care. Unless a state chooses otherwise, telehealth may follow face-to-face rates. Specialized payment structures can need a State Plan Amendment, per the Medicaid Telehealth Toolkit.

Practical steps:

  1. List every state where you have patients.
  2. For each, confirm the Medicaid payment method and covered modalities with the state agency.
  3. Check private payer rules separately. Payment parity laws exist in some states and not others, and parity does not apply everywhere.
  4. Review your rules at least once a year and after every legislative session.

Never assume a policy in one state carries over to another.

Card payments: where telehealth merchants get into trouble

If patients pay you directly, your merchant account is your lifeline. Acquiring banks treat many telehealth models as higher risk. Reasons include recurring billing, prescription products, cross-border patients and elevated dispute rates. That does not mean you cannot get processing. It means the placement matters.

Common triggers for freezes, reserves and terminations:

  • Chargebacks. Patients dispute charges they do not recognize, or after a cancelled visit or a delayed prescription. Clear billing descriptors, itemized receipts and fast support cut disputes.
  • Unclear subscriptions. A membership that renews without a visible reminder invites disputes and regulator attention.
  • Mismatched business descriptions. The application says one thing, the website says another. Underwriters notice.
  • Unsupported claims. Marketing that promises medical outcomes can put a merchant account at risk.
  • Poor fraud controls. Card testing and stolen cards drive up dispute ratios.

Write down your refund policy, cancellation steps and visit terms before you apply for a merchant account. Underwriters ask for them, and so do chargeback reviewers.

Recurring billing and subscription rules

Many telehealth programs are memberships. The federal picture is less settled than you might expect. According to a 2026 summary of federal cancellation rules, the FTC’s click-to-cancel amendments were vacated by the Eighth Circuit in July 2025, and the FTC opened new rulemaking in March 2026. The Restore Online Shoppers’ Confidence Act (ROSCA) remains in force. It requires clear disclosure of terms before an online transaction, informed consent to the charge, and a simple way to stop recurring charges.

The safe approach is to meet the stricter standard regardless of what the rulemaking produces:

  • Disclose price, renewal frequency and cancellation terms before the patient enters card details.
  • Get express consent to recurring charges, separate from general terms.
  • Make cancellation as easy as sign-up, ideally online.
  • Send renewal reminders where state law or card network rules call for them.

Several states have their own automatic renewal laws. Ask your attorney which apply to your patient base.

Data security: HIPAA and PCI are not the same thing

HIPAA governs protected health information. PCI DSS governs cardholder data. A telehealth company usually handles both, and one does not satisfy the other. Keep health details out of payment records, billing descriptors and payment gateway metadata wherever possible. A descriptor that reveals a diagnosis or medication is a privacy problem.

If you are building your HIPAA program from scratch, this HIPAA compliance checklist for small businesses lays out an audit-ready sequence you can adapt. For payments, confirm that your processor and gateway are PCI compliant and that your own systems never store full card numbers.

A compliance checklist before you launch or scale

  1. Confirm clinician licensure in every patient state.
  2. Map each service to its payer: Medicare, Medicaid, commercial, or self-pay.
  3. Add POS and modifier checks to claim scrubbing.
  4. Set a documented audit response process with a 45-day internal deadline well inside the federal one.
  5. Publish clear pricing, refund and cancellation terms.
  6. Use clean billing descriptors with no health information.
  7. Choose a processor that underwrites telehealth and supports chargeback management.
  8. Monitor dispute ratios weekly, not monthly.
  9. Review state and federal rules every quarter. The Medicare end date of December 31, 2027 should be on your calendar now.

Our perspective: payments fail at the seams

We work with high-risk and regulated online merchants every day. Telehealth operators rarely lose a merchant account because of one big violation. They lose it because the seams do not line up: the website says one thing, the application says another, the cancellation flow is buried, and the first wave of disputes arrives before anyone is watching the ratio.

We understand how stressful it is to hear that funds are held or an account is closed. The fix starts before you process a dollar. Tell the underwriter exactly what you sell, how patients pay, how renewals work and how you handle refunds. Banks approve what they can understand. Surprises cause reserves and terminations.

Our advice is to treat payment compliance as part of your clinical operations. Give the person who owns billing the same authority as the person who owns clinical quality. Set dispute alerts. Keep records you can produce in days, not weeks. And pick a payments partner with real telehealth experience, one that can explain pricing and reserves in plain terms before you sign.

— Peter

Payment processing built for telehealth

If you take card payments for telehealth visits, memberships or prescription programs, we can help. Our telehealth payment processing comes with underwriting support, fraud prevention tools, chargeback mitigation, recurring billing management and PCI Level 1 certification. Approvals can take as little as 24 hours. If your program also sells supplements or nutraceuticals, see our nutraceuticals payment processing page. You can also review our full high-risk payment processing offering and talk to us about your model.

FAQ

Are Medicare telehealth flexibilities still in effect?

Yes. Most flexibilities, including home as an originating site and no geographic restrictions for non-behavioral services, are extended through December 31, 2027. That includes audio-only for non-behavioral services. Plan for a possible lapse after that date.

What is the 7-day rule for telehealth?

It applies to online digital E/M codes 99421 to 99423. If a patient raises the same or a related problem within 7 days of a previous E/M service, the digital visit is not separately reportable. The codes are also reported once per 7-day period.

Which Place of Service code should I use?

Use POS 10 when the patient receives telehealth at home. Use POS 02 when the patient is somewhere else. The wrong code can delay or deny payment, so capture patient location at every visit.

Do cash-pay telehealth companies need to worry about compliance?

Yes. You are outside insurer billing rules, but you still face state licensure rules, subscription disclosure requirements, card network dispute thresholds and data security obligations. Your processor will review all of these during underwriting.

Sources