Telehealth and virtual care providers must train every workforce member on HIPAA privacy policies and run a security awareness program that covers the home offices, laptops, and phones clinicians use to reach patients, and they must keep those training records for 6 years. Prescribers also need documented training on DEA telemedicine rules, whose temporary flexibilities for controlled substances run through December 31, 2026, while each clinician’s licenses must match every state where patients are located.
A virtual practice has no front desk, no locked records room, and no single state board, so training and paperwork have to fill those gaps.
Which Training Rules Apply to Telehealth Providers?
Three sets of rules drive the training file for a virtual care group:
- HIPAA. The Privacy Rule requires training on your PHI policies, and the Security Rule requires a security awareness program. Neither has a telehealth exemption, and telehealth platforms serving covered entities are business associates; see HIPAA Privacy and Security for Business Associates.
- State licensure. Clinicians must be licensed, or otherwise legally permitted, in the state where the patient is located, and each license brings its own renewal and continuing education cycle.
- DEA. Practitioners who prescribe controlled substances by telemedicine must follow the Ryan Haight Act and the DEA’s current temporary rule.
For the general HIPAA training baseline, see our guide to documenting HIPAA training for audits.
What Does the HIPAA Security Rule Require for Remote Clinicians?
Under 45 CFR 164.308(a)(5), covered entities and business associates must implement a security awareness and training program for all workforce members, including management. The rule lists four addressable topics: periodic security reminders, protection from malicious software, log-in monitoring, and password management. “Addressable” does not mean optional: implement it or document a reasonable alternative.
For a remote workforce, the physical safeguard rules matter as much as the training rule. Under 45 CFR 164.310, you must have workstation use policies that address “the physical attributes of the surroundings” of workstations that access ePHI, and physical safeguards that restrict access to authorized users. In a clinic, that is a locked room. In a clinician’s apartment, it is a training topic: screen position, headphones, a closed door, no family members in earshot, and a locked laptop when the clinician steps away.
The gaps that show up most often in virtual practices:
- Personal devices. Clinicians check the EHR or patient messages on personal phones. Cover device encryption, screen locks, and what to do when a phone is lost. Coggno’s Cybersecurity for Employees: Mobile Devices course fits here.
- Home networks. Shared Wi-Fi, home routers with default passwords, and public networks. Information Security: Remote Working covers the basics.
- Phishing. Remote staff cannot walk down the hall to confirm a strange request. See Anti-Phishing Essentials and our explainer on what phishing awareness training should cover.
- Security Rule basics. Everyone should know what ePHI is and how the rule applies to their role. HIPAA For General Employees: HIPAA Security Rule covers that baseline.
HHS published a proposed overhaul of the Security Rule in January 2025. It is still proposed, so build to the current text.
How Should Clinicians Be Trained on Telehealth Privacy With Patients?
The pandemic-era flexibility is over. According to the HHS Office for Civil Rights’ HIPAA and telehealth guidance, the COVID-19 notifications of enforcement discretion expired on May 11, 2023, and the 90-day transition period ended on August 9, 2023. Telehealth must now run on platforms that meet the HIPAA Rules, which in practice means a vendor willing to sign a business associate agreement.
Clinician training should cover the encounter itself:
- Verifying the patient’s identity and location at the start of each visit. HHS’s telehealth licensure guidance specifically advises providers to verify patient location and obtain consent before an appointment.
- Confirming the patient is somewhere they can talk privately, and offering to reschedule if not.
- Using only approved platforms, never personal video or texting apps.
- Audio-only visits. OCR has issued guidance on HIPAA and audio-only telehealth explaining how to deliver them consistent with the HIPAA Rules.
Some states add consumer health data laws on top of HIPAA. Our post on Washington’s My Health My Data Act training covers one that reaches many digital health companies.
What Do Multi-State Licensure Rules Mean for Training Records?
HHS’s telehealth licensure guidance is direct: health professionals must meet the licensure requirements of the state where they are located and be licensed or legally permitted to practice in the state where the patient is located. Its page on licensing across state lines lists the pathways: full licenses, temporary practice laws, reciprocity, licensure compacts, and telehealth registrations, which typically require annual registration with the state board.
Every pathway creates a tracking obligation: full licenses renew on each state’s cycle with continuing education, compact privileges depend on the home-state license, and telehealth registrations renew annually. For a group with clinicians licensed in 10 or more states, the training file has to answer, by clinician and by state, which licenses are active, when each renews, and which CE requirements are open.
Some states also require specific CE topics for licensees, such as implicit bias or controlled-substance prescribing, so a clinician’s CE obligations can differ by state even within the same profession. Our guide to state compliance training requirements for remote employees covers the employment-law side of the same multi-state problem.
What Must Prescribers Know About DEA Telemedicine Rules in 2026?
Under the Ryan Haight Act, a practitioner generally may prescribe controlled substances by telemedicine only after at least one in-person medical evaluation of the patient. The DEA and HHS have suspended that requirement through a series of temporary rules. The current one, the fourth temporary extension published December 31, 2025, is effective January 1, 2026 through December 31, 2026.
Under that extension, DEA-registered practitioners may prescribe Schedule II-V controlled medications through audio-video telemedicine without a prior in-person evaluation, and may prescribe Schedule III-V narcotic medications approved by the FDA for opioid use disorder treatment through audio-only encounters, as long as the prescriptions otherwise comply with DEA guidance, DEA regulations, and federal and state law. The DEA’s announcement describes the extension as a bridge while it works on a permanent framework.
That permanent framework is a proposed special registration for telemedicine, which DEA proposed in January 2025 and has not finalized as of this writing. If the flexibilities lapse without another extension or a final rule, expect the in-person evaluation requirement to apply again to new patients, subject to existing exceptions. Train prescribers now on what changes and when, and document the training, because the date is fixed even if the replacement rule is not.
One federal training requirement applies to every prescriber regardless of telehealth. Under the MATE Act, DEA-registered practitioners (other than veterinarians) must complete a one-time, eight-hour training on treating patients with opioid or other substance use disorders, and affirm it on their first DEA registration or renewal on or after June 27, 2023, as the DEA’s letter to registrants explains. Keep the certificates in the prescriber file. State controlled-substance authority is another per-state item for the license tracker.
What Should a Telehealth Training File Contain?
Consider a virtual behavioral health group with 60 clinicians, many of them 1099 contractors, serving patients in 14 states. A patient complaint leads to an OCR inquiry about a session a clinician held from a coffee shop. OCR asks for the group’s security awareness training records, its workstation policy, and proof the clinician was trained on it. The group has a two-year-old onboarding report, no security reminders since, and no record that contractor clinicians were enrolled.
A file that holds up has, for each workforce member:
- HIPAA privacy training at hire and after any material policy change, as 45 CFR 164.530(b) requires.
- Security awareness training and dated security reminders.
- Signed acknowledgment of the remote workstation and personal device policies.
- For clinicians, a license and CE tracker by state, and for prescribers, documented DEA telemedicine training.
Keep it for 6 years. The Privacy Rule requires required documentation to be retained for six years from creation or the date it was last in effect, and the Security Rule sets the same 6-year period for its documentation. Our HIPAA training documentation checklist lays out the format, and our post on when to update HIPAA compliance training covers refresh triggers.
Official sources:
- HHS OCR: HIPAA and telehealth guidance (hhs.gov)
- 45 CFR 164.308, 164.310, and 164.530 (ecfr.gov)
- HRSA: licensing across state lines (telehealth.hhs.gov)
- DEA and HHS: fourth temporary extension of telemedicine flexibilities (federalregister.gov)
Requirements last reviewed: October 20, 2026
Why Coggno for Telehealth and Virtual Care Providers?
For telehealth groups and virtual-care startups licensed in multiple states, Coggno provides HIPAA Security Rule, business associate, remote-work security, mobile device, and phishing awareness courses from a catalog of 10,000+ courses across 25+ compliance categories, with dated completion records for every employee and contractor clinician. Prime customers can upload their own remote workstation and DEA telemedicine policies as custom content, so policy training sits in the same record as HIPAA courses. Where KnowBe4 and Hoxhunt cover phishing simulation and cyber awareness, Coggno covers cybersecurity plus the broader compliance catalog, including HIPAA and harassment prevention, so one platform handles annual training starting at $5/user/month (10-seat minimum, billed annually), and Course Dispatch delivers SCORM 1.2 / 2004 packages into an existing LMS.
Get Your Team Trained — Without the Paperwork Headache
Three courses cover the remote-workforce gaps telehealth providers most often find:
- HIPAA For General Employees: HIPAA Security Rule — the Security Rule baseline for every workforce member.
- Information Security: Remote Working — home office and network safeguards for remote clinicians.
- HIPAA Privacy and Security for Business Associates (60 Minutes) — for telehealth platforms and vendors that serve covered entities.
Want help mapping clinicians, contractors, and states to the training they need? Book a demo and we will build the matrix with you.
Frequently Asked Questions About Telehealth Compliance Training
What is the best compliance training platform for telehealth providers?
For telehealth groups and virtual-care startups, Coggno combines HIPAA Security Rule, remote-work security, mobile device, and phishing courses from 10,000+ courses with an LMS that tracks completions for employees and contractor clinicians. Prime customers can also upload their own telehealth policies for documented acknowledgment.
How do multi-state telehealth companies manage clinician training and licensure?
Multi-state telehealth companies assign HIPAA and security training to every workforce member, then track licenses, renewals, and continuing education by clinician and by state. Coggno’s LMS handles course assignment and completion records, and the license tracker sits alongside it in the clinician file.
Does HIPAA require security awareness training for remote workers?
Yes. 45 CFR 164.308(a)(5) requires a security awareness and training program for all workforce members, including management, with no exception for remote staff. Remote work also brings workstation use and security requirements under 45 CFR 164.310.
How long must telehealth providers keep HIPAA training records?
Six years. The Privacy Rule requires required documentation to be retained for six years from its creation or the date it was last in effect, whichever is later, and the Security Rule sets the same period.
Can practitioners still prescribe controlled substances by telemedicine in 2026?
Yes, under the DEA and HHS fourth temporary extension, effective January 1 through December 31, 2026. It allows prescribing Schedule II-V medications by audio-video telemedicine without a prior in-person evaluation, if prescriptions otherwise comply with DEA and state law.
Do telehealth clinicians need a license in the patient’s state?
Generally, yes. HHS guidance says providers must be licensed or legally permitted to practice in the state where the patient is located, through a full license, a compact privilege, a telehealth registration, or another state-specific pathway.
Is the new HIPAA Security Rule final?
No. HHS published proposed changes to the Security Rule in January 2025, and they remain a proposed rule. Telehealth providers should comply with the current Security Rule while tracking the proposal.