Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer for 2026
If you run a behavioral health treatment center, three federal deadlines control your 2026 telehealth planning: DEA controlled-substance prescribing flexibilities run through December 31, 2026; Medicare telehealth flexibilities were extended through December 31, 2027; and the Medicare in-person visit requirement for home-based behavioral telehealth is delayed until January 1, 2028. Behavioral health telehealth is the most stable piece of the virtual care map heading into the second half of 2026, but the pieces around it keep shifting quarterly.
On December 31, 2025, DEA and HHS issued the Fourth Temporary Extension. Per the Federal Register, the rule is effective January 1, 2026 through December 31, 2026. On the Medicare side, KFF confirms the Congressional Budget Office scored the extension of current telehealth flexibilities through December 2027 under the Consolidated Appropriations Act of 2026 as costing $3.8 billion from 2026 to 2028.
Operators running programs in Florida, Texas, Arizona, and every other state we work in should build 2026 planning around those anchor dates. Stop treating telehealth as a permanent status quo. It is not.
What the DEA actually extended, and what it did not
The Fourth Temporary Extension is narrow. It keeps the COVID-era prescribing rules alive for one more year while DEA and HHS finalize permanent regulations. Under the extension, clinicians can continue prescribing Schedule II–V controlled substances via telehealth without an initial in-person evaluation for the entire year of 2026, and audio-only telehealth remains permitted for opioid use disorder treatment.
DEA leadership put the intent bluntly in the agency’s own announcement. The Alliance for Connected Care reports that over 40,000 Americans provided comments on the Special Registration proposal, and Frier Levitt notes the DEA received 6,475 comments in response to its Notice of Proposed Rulemaking. The shape of the permanent rule is still contested.
Two things to remember. First, the Ryan Haight Act still sits underneath all of this; the extension is a temporary carveout, not a repeal. Second, the DEA prescribing rule and the Medicare in-person requirement for behavioral health are separate policies. Operators confuse them constantly on intake calls and in policy manuals, which is exactly the confusion Northwest AHEC warned about when it noted the DEA’s rules apply nationwide and are separate from state requirements and Medicare reimbursement rules.
Medicare behavioral telehealth: what is permanent, what expires, what to document
Congress made the behavioral piece durable. The Consolidated Appropriations Act of 2021 permanently removed geographic and originating site restrictions for any telehealth service used to diagnose, evaluate, or treat a mental health disorder (restrictions had already been lifted for treatment of substance use disorders and co-occurring mental health disorders in 2018). Medicare beneficiaries may continue to receive behavioral health services from their homes, in both urban and rural areas, via audio-only platforms when they cannot access video, and FQHCs and RHCs are permanently allowed to serve as “distant site” telehealth providers for behavioral health services.
The in-person visit requirement is the trap. The Consolidated Appropriations Act of 2021 included a provision that beneficiaries must have an in-person visit with their behavioral health provider no more than six months before their initial telehealth appointment and annually thereafter; subsequent legislation has delayed this requirement, which is currently due to take effect in January 2028. If your MAT clinic in Florida starts a new Medicare patient on telehealth in January 2028 without documenting a prior in-person visit within the six-month window, you have a clean audit finding waiting.
A few ancillary points that trip up compliance leadership:
- Under Section 6209, Medicare telehealth policies that lapsed during the 2025 shutdown were extended by almost two years through Dec. 31, 2027.
- Medicare permanently removed frequency limits for subsequent inpatient visits, nursing facility visits, and critical care consultations furnished via telehealth beginning January 1, 2026.
- Covid-era telehealth flexibilities lapsed September 30, 2025 and again on January 30, 2026, wreaking havoc on both beneficiaries and providers, exactly the kind of disruption operators cannot absorb twice.
State licensure and payer audit exposure: the two things nobody wants to track
Federal timelines get the headlines. State licensure and payer audits are where operators actually lose money.
On licensure: the state where the patient sits during the encounter is the state that governs it. Compacts help but do not solve it. As of June 2026, 42 jurisdictions are full participating members where PSYPACT authorizations are valid: 40 states, the District of Columbia, and the Commonwealth of the Northern Mariana Islands. Montana became an active member in October 2025, and the PSYPACT Commission updated its rulebook on November 18, 2025. If your Florida-based IOP serves a snowbird who flies to Michigan mid-episode, your clinician needs Michigan authority the moment that patient logs in from Grand Rapids.
On audit exposure: the HHS Office of Inspector General has been building telehealth cases for years, and the behavioral health angle is now front and center. In June 2024, Supportive Care Holdings, LLC and its CEO paid $4,595,739 to resolve allegations that they fraudulently and improperly submitted claims to Medicare and Connecticut Medicaid related to telehealth services provided to nursing home residents. HCPCS code Q3014 should only be billed by the originating site when the facility provides administrative and clinical support for a patient receiving services via telehealth.
HHS-OIG Special Agent in Charge Roberto Coviello framed the priority in the DOJ press release: schemes that undermine legitimate telehealth delivery will keep drawing federal attention.
The pattern did not stop there. In June 2026, Aptihealth, Inc. And Aptihealth Medical, PLLC, a behavioral health provider operating a telehealth platform, agreed to pay $300,000 to resolve False Claims Act allegations concerning its Medicare and Medicaid billing practices as part of the Department of Justice’s 2026 National Health Care Fraud Takedown. First Assistant U.S. Attorney Sarcone said “Aptihealth submitted claims to Medicare and Medicaid that did not comply with program requirements” and “the integrity of these programs depends on accurate billing and adherence to established rules”. The admitted conduct included billing for patient appointments that did not occur because the patient was a “no-show,” billing for responses to patient messages without regard to whether such communications involved billable clinical content, and billing for psychological testing services that were not sufficiently documented.
The 2026 Takedown was not a one-off. The Justice Department charged 455 defendants, including 90 doctors and other licensed medical professionals, for their alleged participation in health care fraud and opioid abuse schemes involving over $6.5 billion in false claims. Every one of those cases is a data point your SIU auditor can pull from a claims extract in an afternoon.
What operators should actually do in the next 90 days
Six items belong on the executive dashboard right now.
- Map every patient by state of physical presence at the time of encounter. Not billing address. Not residency. Physical location at session time. This is your licensure exposure map.
- Build a Ryan Haight tickler. The DEA extension ends December 31, 2026. If permanent rules land midyear, your prescribers will need workflows for special registration, recordkeeping, and technology attestations. Do not wait for the final rule to draft SOPs.
- Audit your Medicare behavioral in-person visit documentation now. The six-month prior visit and the annual follow-up visit belong in the chart with a clear timestamp. Missing documentation is the finding a payer auditor writes up first.
- Reconcile POS 02 vs POS 10. Providers should use POS 02 for telehealth outside the patient’s home and POS 10 for telehealth in the patient’s home. Consistent errors here draw SIU attention.
- Review your originating-site billing. The Supportive Care settlement is the template for what happens when Q3014 facility fees are billed by an entity that did not provide administrative and clinical support.
- Confirm state Medicaid parity independently. Medicare rule changes do not automatically flow to Medicaid or commercial payers. Your Texas Medicaid MCO contract, your Florida AHCA rules, and your Arizona AHCCCS bulletins each need their own review cycle.
Telehealth is not going away. The regulatory scaffolding around it is still being poured. Operators who treat 2026 as a compliance planning year, not a coasting year, will not be the ones writing settlement checks in 2027.
Frequently asked questions
When do the DEA telehealth prescribing flexibilities expire?
The Fourth Temporary Extension is effective January 1, 2026 through December 31, 2026, per the Federal Register rule published on December 31, 2025. It permits DEA-registered practitioners to prescribe Schedule II–V controlled substances via audio-video telemedicine, and audio-only telehealth is permitted for opioid use disorder treatment, without a prior in-person evaluation. DEA and HHS intend to finalize permanent rules before the deadline.
Does a Medicare behavioral health patient still need an in-person visit when using telehealth from home?
Not yet. KFF confirms Congress has repeatedly delayed the Section 1834(m) requirement that a beneficiary have an in-person, non-telehealth visit with their behavioral health provider no more than six months before their initial telehealth appointment and annually thereafter. That requirement is currently due to take effect in January 2028. Providers should still document any in-person contact to prepare for the effective date.
How long have Medicare’s broader telehealth flexibilities been extended?
H.R. 7148, the Consolidated Appropriations Act of 2026, was signed into law on February 3, 2026 and extends key Medicare telehealth flexibilities through December 31, 2027 (Section 6209). The Congressional Budget Office scored the extension at $3.8 billion from 2026 to 2028, according to KFF. The extension followed telehealth coverage lapses during the 2025 shutdown and again on January 30, 2026.
What are the biggest telehealth compliance exposures for behavioral health operators in 2026?
Three areas draw the most enforcement attention. First, originating-site facility fee billing under HCPCS Q3014, which drove the $4,595,739 Supportive Care Holdings settlement with DOJ and HHS-OIG in June 2024. Second, documentation and billing integrity at telehealth platforms, illustrated by the June 2026 Aptihealth $300,000 False Claims Act settlement, part of a DOJ takedown that charged 455 defendants in over $6.5 billion in alleged fraud. Third, cross-state licensure gaps when patients move or travel mid-treatment, since PSYPACT covers only 42 jurisdictions as of June 2026 and other behavioral health compacts are still building out.
References
- Federal Register: Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications (DEA / HHS, Dec. 31, 2025)
- DEA Press Release: DEA Extends Telemedicine Flexibilities to Ensure Continued Access to Care (Dec. 31, 2025)
- KFF: What to Know About Medicare Coverage of Telehealth
- HHS Telehealth.gov: Telehealth Policy Updates
- HHS-OIG: Behavioral Health Companies, CEO, Pay Nearly $4.6 Million to Settle Telehealth Allegations (Supportive Care Holdings)
- DOJ USAO-NDNY: Clifton Park Telehealth Company (Aptihealth) to Pay $300,000 (June 23, 2026)
- DOJ: 2026 National Health Care Fraud Takedown Results
- PSYPACT Official Map and Participating Jurisdictions