Guide

Every visit: who they are and where they are

Summary

Yes — confirm both the patient's identity and their physical location at the start of every telehealth visit, not only at intake. Location determines which state's license you need and where emergency help would go; identity confirms you are treating the right person and charting to the right record. A quick verbal check — name, date of birth, and where they are sitting today — satisfies it in seconds, and you note it in each encounter.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

The short answer: yes, and here's why

Confirm the patient's identity and physical location at the start of every telehealth visit, not just at the first one. Two separate obligations ride on it. Location determines which state's license you must hold, because telehealth is governed by where the patient is located at the time of service 1Ref 1U.S. Department of Health and Human Services (2026).Licensure — Telehealth policy.That telehealth is governed by the state where the patient is located at the time of service, so confirming patient location sets which license the clinician needs., and it determines where emergency help would go if the session went wrong. Identity confirms you are treating the right person and documenting to the right chart.

HHS's provider guidance frames verifying who the patient is and where they are as ordinary telehealth practice, not an extra step for special cases 2Ref 2U.S. Department of Health and Human Services (2026).Telehealth for providers.HHS/HRSA provider guidance framing verification of patient identity and location as ordinary telehealth practice.. The reason it is every visit and not once is simple: both facts change. A patient signs on from a different room, a different city, or a different state than last week, and a household member occasionally sits down at the same laptop. The check is cheap; the assumption that nothing moved is what gets expensive.

Confirming location: it sets your license and your emergency plan

Location is the fact under everything, so ask it plainly: where are you physically sitting right now? The answer settles whether you are licensed to deliver this visit, because your authority follows the patient's state, not your office 1Ref 1U.S. Department of Health and Human Services (2026).Licensure — Telehealth policy.That telehealth is governed by the state where the patient is located at the time of service, so confirming patient location sets which license the clinician needs.. It also settles where a dispatcher would send help, since your own 911 routes to your area rather than theirs. One question resolves both the legal and the safety question at once.

Most telehealth happens at home — Medicare permanently treats the patient's home as an originating site for behavioral telehealth 3Ref 3Centers for Medicare & Medicaid Services (2025).Telehealth Services.That Medicare permanently allows the patient's home as an originating site for behavioral-health telehealth, so the confirmed location is usually a private residence. — so the location you confirm is usually a private residence that can change without notice. Build the habit around the traveling patient especially: someone who logs in from a hotel in another state has quietly moved the visit into a jurisdiction where you may not be licensed, and only the location question surfaces it before it becomes a problem. If the answer is a state where you hold no license, the defensible move is to stop and reschedule for when the patient is back in a state you are licensed in, or to arrange a referral — not to proceed because the visit was already on the calendar.

Confirming identity: right person, right chart

Identity verification protects against the mundane failures that do real harm: charting to the wrong record, discussing protected information with someone who is not your patient, and billing for a service the named patient did not receive. At the first visit, verify identity against a government photo ID and record that you did. At each subsequent visit, a quick match of name and date of birth against the chart is usually enough for an established patient you recognize on camera.

Run the visit on a platform that supports this securely. Since the pandemic-era enforcement discretion ended, telehealth must operate on HIPAA-compliant arrangements with the appropriate agreements in place 4Ref 4HHS Office for Civil Rights (2026).HIPAA and Telehealth.That telehealth must run on HIPAA-compliant arrangements now that the COVID enforcement discretion has ended, which is also what allows secure patient authentication., and a compliant platform is also what lets you authenticate the patient and keep the encounter private. The same pre-visit verification checklist you use to confirm eligibility is the natural place to confirm identity, so the two happen together rather than as separate interruptions.

How to do it without making it awkward

The whole check should take a few seconds and feel like a routine greeting, not an interrogation. A simple script works: greet the patient, confirm their name and date of birth, and ask where they are located today and whether anyone else is present. Framing it as safety — "I check this each time so I can get help to you if we ever need it" — turns a compliance step into evidence that you are paying attention to them.

Build it into the opening of the session so it is automatic. Even asynchronous work carries a version of this: when you bill a portal-based service such as an e-visit under 99421–99423, you still need confidence that the person messaging is your established patient. The verification is not a video-only ritual; it is a habit of knowing, on every contact, who you are treating and from where.

The higher bar when you prescribe

If your practice includes prescribing controlled substances by telemedicine, identity and location verification stop being good habits and become part of a heavier regulatory regime. The current DEA and HHS posture extends telemedicine prescribing flexibilities while rulemaking continues, and that framework is explicit about verifying the patient's identity and location for these prescriptions — this is an extension regime, so treat it as volatile and check the source before relying on any specific rule, as of July 2026 5Ref 5U.S. Department of Health and Human Services (2026).Prescribing controlled substances via telehealth.That the current DEA/HHS extension regime for telemedicine controlled-substance prescribing expects documented identity and location verification, carried with its as-of-July-2026 date.. Do not extrapolate a proposed rule into a current one.

Practically, that means a documented identity check and a confirmed physical location for every controlled-substance encounter, because the patient's state also governs your prescribing authority there. The safest posture is to verify at the same rigor you would in person, record it each time, and re-confirm the source's current status periodically, since this area has changed repeatedly.

Document it every time

Verification you cannot show is verification you did not do, so make the record automatic. In each encounter note, capture that you confirmed the patient's identity, the method for a first visit versus an established one, the patient's stated physical location, and whether anyone else was present. A short, consistent line in every note is worth more than an elaborate intake form you fill out once and never revisit.

The documentation does triple duty: it supports the claim you submit, it demonstrates you were licensed to treat where the patient sat, and it shows an emergency plan was in place if the visit ever required one. Keep the phrasing consistent across notes so an auditor or reviewer can see the habit, not a one-off. Consistency is what makes the record persuasive.

Common questions

Yes. A patient's location can change between sessions — a different room, city, or state — and each change can move the visit into a jurisdiction where you are not licensed, or change where emergency help would go. Confirming the physical location at the start of every visit is a few seconds of work that resolves both the licensure and the safety question, and it belongs in each encounter note.

For an established patient you recognize on camera, a quick verbal match of name and date of birth against the chart is usually sufficient. You verified against a government photo ID at the first visit and recorded it; subsequent visits confirm you are still speaking with the same person and charting to the right record. Keep the confirmation brief, consistent, and noted each time.

At the first visit, verify the patient's identity against a government-issued photo ID and document that you did. This establishes the baseline for the relationship and supports later, lighter confirmations. Run the session on a HIPAA-compliant platform so the encounter is private and the patient can be authenticated. Pair the identity check with your eligibility verification so both are handled before care begins.

It is stricter. Telemedicine prescribing of controlled substances sits under an evolving DEA and HHS framework that expects documented identity and location verification for each prescription, and the patient's state governs your prescribing authority there. Because this is an extension regime that has changed repeatedly, verify at in-person rigor, document every time, and check the current rule directly rather than relying on memory, as of July 2026.

In each encounter note. Record that you confirmed identity, the method used, the patient's stated physical location, and whether anyone else was present. A short, consistent line per note supports the claim, demonstrates you were licensed to treat where the patient was, and shows an emergency plan existed. Consistent phrasing across notes makes the habit visible to an auditor and easy to defend.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.U.S. Department of Health and Human Services (2026). Licensure — Telehealth policy. Telehealth.HHS.gov. linkThat telehealth is governed by the state where the patient is located at the time of service, so confirming patient location sets which license the clinician needs.
2.U.S. Department of Health and Human Services (2026). Telehealth for providers. Telehealth.HHS.gov. linkHHS/HRSA provider guidance framing verification of patient identity and location as ordinary telehealth practice.
3.Centers for Medicare & Medicaid Services (2025). Telehealth Services. CMS Medicare Learning Network (MLN901705). link ✓That Medicare permanently allows the patient's home as an originating site for behavioral-health telehealth, so the confirmed location is usually a private residence.
4.HHS Office for Civil Rights (2026). HIPAA and Telehealth. U.S. Department of Health and Human Services. linkThat telehealth must run on HIPAA-compliant arrangements now that the COVID enforcement discretion has ended, which is also what allows secure patient authentication.
5.U.S. Department of Health and Human Services (2026). Prescribing controlled substances via telehealth. Telehealth.HHS.gov. linkThat the current DEA/HHS extension regime for telemedicine controlled-substance prescribing expects documented identity and location verification, carried with its as-of-July-2026 date.

https://www.gale.care/for-providers/th-identity-location-verification · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers