2026 Telehealth Regulations Update: Key Changes, Deadlines, and Compliance Tips

Medicare Telehealth Extensions

What changed in 2026

Congress extended many Medicare telehealth flexibilities through December 31, 2027. Through that date, originating site restrictions are broadly waived for non-behavioral services, beneficiaries may receive care from home, and eligible distant site providers include FQHCs and RHCs. Audio-only remains allowed for many services when video isn’t feasible or the patient declines it. CMS also simplified how services are added to the Medicare Telehealth List beginning in 2026. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

Key deadlines and dates

• January 1, 2026: CY 2026 PFS policies effective (including streamlined Telehealth List process). ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))
• December 31, 2027: End of current statutory Medicare telehealth flexibilities for non-behavioral services (home as an eligible site, no geographic limits, audio-only options). ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

Compliance tips

• Document patient location at each visit to support waived originating site restrictions and proper coding.
• When using audio-only, record why video wasn’t possible or was declined and append the correct modifier (see “Place of Service Coding”). ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

Behavioral Health Telehealth Provisions

Coverage and access

Medicare beneficiaries can permanently receive behavioral/mental health telehealth from home with no geographic restrictions. Audio-only is permanently permissible for behavioral health when clinically appropriate, with additional temporary flexibilities through December 31, 2027 for certain in‑person visit requirements. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

In-person requirement status

The statutory in‑person visit requirement for mental health telehealth remains waived through December 31, 2027; RHCs/FQHCs may continue billing telehealth encounters (G2025), including audio‑only, under this extension window. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

Practical steps

• Ensure clinical protocols define when audio-only is appropriate and how to capture consent or patient limitations.
• Confirm your behavioral health providers are enrolled to bill as distant site providers under current Medicare telehealth flexibilities. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

Remote Therapeutic Monitoring Codes

What’s new for 2026

CMS finalized new RTM codes and clarified device-supply time bands. New CPT 98979 captures the first 10–19 minutes of monthly RTM treatment management (requires at least one real‑time patient/caregiver interaction). New device codes 98984 (respiratory) and 98985 (musculoskeletal) cover 2–15 days of data in a 30‑day period; existing 98976 and 98977 were revised to represent 16–30 days. These codes were designated “sometimes therapy” for Medicare claims-processing. ([cms.gov](https://www.cms.gov/medicare/coding-billing/therapy-services))

Additional code notes

• CPT also introduced 98986 (CBT/digital therapeutic device supply, 2–15 days). Confirm Medicare coverage and pricing status with your MAC, as coverage may vary. ([aapc.com](https://www.aapc.com/codes/cpt-codes/98986?utm_source=openai))
• RTM management codes (98979, 98980, 98981) require documented cumulative time and at least one interactive communication in the month. ([cms.gov](https://www.cms.gov/medicare/coding-billing/therapy-services))
• CMS indicated it may use OPPS cost data for some remote monitoring rate‑setting beginning in 2026. ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))

Operational compliance checklist

• Define 30‑day device windows (2–15 vs 16–30) and monthly time tracking for management; avoid overlapping or double-counting.
• Apply therapy modifiers (GP/GO) and assistant modifiers (CQ/CO) when RTM is furnished under therapy plans of care, per “sometimes therapy” rules. ([cms.gov](https://www.cms.gov/medicare/coding-billing/therapy-services))

HIPAA Compliance Updates

Where HIPAA stands as of June 18, 2026

OCR’s pandemic-era enforcement discretion for telehealth ended August 9, 2023; telehealth must fully meet the HIPAA Privacy, Security, and Breach Notification Rules. HHS proposed Security Rule updates on January 6, 2025 (including requirements often summarized as encryption-at-rest HIPAA and multi-factor authentication for systems accessing PHI), but as of spring 2026 those proposals have not been finalized. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html?utm_source=openai))

Actionable security steps for telehealth

• Implement encryption for PHI in transit and at rest and enforce multi-factor authentication (MFA) for all remote and privileged access while monitoring for the final rule. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-january-2026/index.html?utm_source=openai))
• Complete and document an annual security risk analysis; maintain BAAs with platform vendors; log access and audit trails for telehealth sessions.
• For audio-only services, follow OCR’s guidance on compliant technologies and documentation. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html?utm_source=openai))

Place of Service Coding

Place of Service 02 and 10

Use Place of Service 10 when the beneficiary is at home; use Place of Service 02 when the beneficiary is in a non‑home location (for example, a clinic or SNF). These definitions are unchanged in 2026. ([cms.gov](https://www.cms.gov/medicare/coding-billing/place-of-service-codes/code-sets?utm_source=openai))

Payment impact and modifiers

• Medicare pays the non‑facility PFS rate for eligible home‑based telehealth billed with POS 10. ([cms.gov](https://www.cms.gov/medicare/regulations-guidance/transmittals/2024-transmittals/R12671CP?utm_source=openai))
• Append modifier 95 for real‑time audio‑video telehealth and modifier 93 for audio‑only where covered. ([medicare.fcso.com](https://medicare.fcso.com/coding/telehealth-service-modifiers?utm_source=openai))

Originating site facility fee

Facilities hosting the patient may bill Q3014; the 2026 originating site facility fee is $31.85. Coordinate with partner sites to avoid billing conflicts. ([cms.gov](https://www.cms.gov/medicare/coverage/telehealth/list-services?utm_source=openai))

Teaching Physician Virtual Supervision

Virtual direct supervision guidelines (non‑teaching)

Effective January 1, 2026, CMS permanently allows direct supervision to be met via real‑time audio‑video for incident‑to services, diagnostic tests, and cardiac/pulmonary rehab—except for services with 10‑ or 90‑day global surgery indicators. Audio-only does not qualify. ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))

Teaching physician presence for resident services

Starting in 2026, teaching physicians may satisfy the presence requirement via real‑time audio‑video only when the underlying service is itself a Medicare telehealth service (for example, a three‑way visit with patient, resident, and teaching physician in different locations). This policy is now permanent for all teaching settings; audio‑only does not meet the standard. ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))

Frequency Limits Removal

What changed

CMS permanently removed prior telehealth frequency limits for subsequent inpatient visits, subsequent nursing facility visits, and critical care consultations beginning January 1, 2026. You may now schedule medically necessary follow‑ups without those legacy caps. ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))

Documentation and auditing

• Continue to document medical necessity, visit content, and patient location; “no frequency cap” does not waive coverage criteria.

Conclusion

For 2026, center your workflows on three pillars: (1) Medicare telehealth flexibilities through December 31, 2027, (2) precise coding—especially RTM device codes and Place of Service 02 and 10 with the right modifiers, and (3) a hardened HIPAA posture with encryption at rest and MFA while OCR’s proposals advance. Align supervision policies to the new virtual direct supervision and teaching‑physician rules, and capitalize on the removal of frequency limits to deliver timely, appropriate care. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

FAQs

What are the new Medicare telehealth flexibilities for 2026?

Key flexibilities remain in place through December 31, 2027: patients can receive non‑behavioral telehealth from home nationwide; audio‑only is allowed in defined circumstances; and FQHCs/RHCs can act as distant sites. CMS also made the Telehealth List process simpler in 2026 and permanently removed frequency limits for certain inpatient, SNF, and critical care telehealth visits. ([telehealth.hhs.gov](https://telehealth.hhs.gov/providers/billing-and-reimbursement/medicare-payment-policies))

How has HIPAA compliance changed for telehealth services?

OCR’s enforcement discretion ended on August 9, 2023, so you must use HIPAA‑compliant platforms, BAAs, access controls, and audit logs. HHS proposed—but has not finalized—Security Rule updates that would effectively require encryption at rest and multi‑factor authentication for systems handling PHI; adopt these controls now to reduce risk and be ready for finalization. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html?utm_source=openai))

What are the updated coding requirements for Remote Therapeutic Monitoring?

For dates of service on or after January 1, 2026, use 98979 for the first 10–19 minutes of monthly management (with at least one live interaction). Use 98984/98985 for 2–15 days of device‑supported monitoring in a 30‑day period (respiratory/MSK), and 98976/98977 for 16–30 days. Apply therapy and assistant modifiers when RTM is part of a therapy plan of care. Verify local coverage for 98986 (CBT, 2–15 days). ([cms.gov](https://www.cms.gov/medicare/coding-billing/therapy-services))

What are the rules for teaching physician virtual supervision starting 2026?

Virtual direct supervision (real‑time audio‑video) is now permanent for many non‑teaching services, excluding 10‑ or 90‑day global procedures. For resident‑involved services, teaching physicians may be virtually present only when the service itself is a Medicare telehealth service (e.g., a three‑way video visit). Audio‑only does not meet either standard. ([cms.gov](https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f))