Telehealth consent form: What to include and when to send

Key takeaways

A telehealth consent form is the document a patient signs before a remote visit, covering the benefits, limits, and risks of virtual care.

State law and professional standards are what require informed consent for telehealth, while CMS separately requires it to be documented for Medicare billing.

Eight elements belong in every form: services offered, technology risks, privacy limits, patient rights, alternatives, emergency steps, prescribing limits, and record storage.

Sending the form 24 to 48 hours ahead and confirming understanding on the call beats chasing a signature mid-appointment.

Practice management software like Pabau sends the form before the visit, captures the signature, and files it against the patient record.

A telehealth consent form is the document a patient signs before a virtual visit begins. Most practices credit HIPAA for that requirement. The duty comes from state law and professional standards instead, and CMS layers on a separate rule for Medicare billing.

Below you get a free template plus the eight elements every form should carry. There is also a workflow for collecting consent before the visit, not during it.

What a telehealth consent form does for you and the patient

The form records that a patient understood the benefits, limits, and risks of a remote visit before it went ahead. Virtual care carries risks an in-person appointment does not. Video freezes, home WiFi is rarely secure, and no clinician can palpate an abdomen through a screen.

Signed properly, the form does three jobs at once:

• It documents that the patient agreed voluntarily, with full information in front of them.
• It gives you evidence if a patient later says nobody warned them about a limitation.
• It leaves an audit trail a payer or a regulator can follow.

Where the form lives matters as much as what it says. Attach it to the appointment inside your telehealth software and the signature travels with the visit record. Keep it in a shared drive and somebody has to go hunting during an audit.

Which rules require consent, and which ones do not

State law requires informed consent for a telehealth visit, backed by the professional standards your license sits under. HIPAA does not create that duty.

HIPAA governs how you protect and disclose protected health information, known as PHI, which is a separate obligation.

CMS sits in a third place. For Medicare telehealth claims, consent has to be obtained and documented, so the requirement attaches to payment rather than to treatment. Miss that step and the claim is exposed, even where your state board would have been satisfied.

The table below sorts out which rulebook asks for what.

HHS puts it plainly: most states want a patient’s official informed consent before you treat them remotely. Its guidance on obtaining informed consent is the clearest federal summary available, and it is free to read.

Eight elements every form has to carry

Whatever your specialty, the same eight items belong in the document. Leave one out and you have paperwork that will not hold up in an audit.

• What telehealth covers here: the care you deliver remotely, and the care you do not, such as physical exams and emergencies.
• Technology risks: dropped connections, poor video quality, breach exposure, and what happens if a session fails partway through.
• Privacy limits: how data is encrypted and stored, who can see it, and a plain warning that a home network may not be secure.
• Patient rights: the right to withdraw consent, refuse recording, ask for an in-person appointment, and raise a complaint.
• Alternatives: confirmation that the patient can switch to an in-person visit or move their care elsewhere at any point.
• Emergency steps: what a patient should do if something goes wrong mid-session, and when to call 911 rather than you.
• Prescribing limits: which medications you can and cannot prescribe remotely under your state’s rules.
• Records and storage: consent to hold the record electronically, with a pointer to your privacy notice.

The privacy item usually needs a second document behind it. A signed HIPAA authorization form covers disclosures that consent alone does not, so most practices keep both on file.

For care delivered in the room, a general medical consent form handles the same ground without the technology clauses.

State rules decide the format, so check yours first

No two states run consent the same way. Some want a signed document. Others accept verbal consent as long as you note it in the chart. A few dictate exact wording, and most leave the drafting to you.

California, Texas, Florida, and New York sit at the stricter end. Treating patients across state lines leaves you two options. Build a version per state, or build one master form that meets the toughest rule you are exposed to.

Where the patient sits during the call is usually what decides the rules, not where you sit. Confirm the detail with your state board or a healthcare attorney before you finalize the wording. Thirty minutes of legal review costs less than a board complaint.

How to collect and document consent before the visit

Send the form ahead of the appointment, then confirm understanding at the start of the call. A signature on its own is thin evidence. What protects you is a record that the patient read the form, understood it, and had a chance to ask questions.

1. Send it 24 to 48 hours ahead by email, patient portal, or text, so patients have time to read it properly.
2. Ask for the signature before the appointment window opens. Chasing it during the consult burns clinical time.
3. Use teach-back on the call. Ask the patient to repeat one limitation back, such as what happens if the video drops.
4. Log the date, time, method, and what the patient acknowledged in the record, with a timestamp.
5. File the signed form with the clinical note so an auditor finds both in one place.

That last step is the one practices skip. A signature sitting in an inbox is not documentation, and it is the first item an auditor asks to see.

Before you send it, run this quick check

Consent forms usually come back for small errors rather than for legal substance. Run this check before the template reaches a patient:

• Your practice name, address, and license details replace the template’s placeholder text.
• The platform named in the form is the one you use on the call.
• Care you never deliver remotely appears in the excluded list.
• The emergency instructions give a number the patient can reach outside your hours.
• The signature block has room for a parent or guardian when the patient is a minor.
• The reading level sits around eighth grade. Read it aloud and rewrite any line you stumble over.
• You hold a version in each language your patients speak.

Two mistakes turn up more than any others. First, a form that still names the telehealth platform a practice dropped a year ago. Second, consent collected once and never renewed, which some states and payers will not accept.

Therapy and behavioral health need extra clauses

Confidentiality carries more weight in therapy and psychiatry, so those forms run longer. Three additions matter most.

• Limits of confidentiality: when you are obliged to break it, such as a risk of harm or a mandated report.
• 42 CFR Part 2: the separate federal rule that protects substance use disorder treatment records.
• Recording: an explicit no, or an explicit yes with terms, because sessions are easy to record at home.

Many behavioral health forms also fold in session frequency, cancellation terms, and after-hours crisis instructions. One document is easier for a patient to absorb than four.

Write it so patients can read it in one pass

Legal phrasing is what makes consent forms fail. A patient who signs without understanding has not given informed consent, whatever the signature block says.

AHRQ published an easy-to-understand telehealth consent form built on plain language rules: short sentences, everyday words, worked examples. The swap looks like this.

Rather than “technological infrastructure vulnerabilities may result in data breach incidents”, write “your home WiFi may not be encrypted, so we cannot promise complete privacy”.

Then translate the form into the languages your patients speak. Have a native speaker or a professional service check the result. A machine translation of a legal document is a liability rather than a shortcut.

How to adapt the template to your practice

The template above is a starting point, not a finished document. Six changes turn it into yours:

1. Confirm your state’s rules with your medical board or a healthcare attorney.
2. Add your practice name, logo, and contact details so patients know who they are consenting to.
3. Name the platforms you use, such as Zoom or Pabau’s telehealth software, along with the security each one provides.
4. Rewrite the excluded services list to match your scope. A psychiatry practice may exclude medication inductions, for example.
5. Have legal counsel read it once before you use it with a patient.
6. Diary a review each January, because state and federal rules move most years.

Then store the approved version in one place and train reception on the workflow. The habits that get forms completed before appointments apply here too: send early, chase once, and make the document signable on a phone.

How Pabau sends, signs, and files consent forms

A PDF consent form means printing, emailing, chasing, and filing by hand. Practice management software like Pabau folds all of that into one automated step. The patient gets a notification before the appointment, opens the form on their phone, and signs it there.

The signed document then attaches itself to the patient record with a timestamp and an audit trail. Pabau’s patient intake software collects consent alongside medical history and insurance details, so a new patient completes one flow instead of three.

Reminders go out on whatever schedule you set, and any form left unsigned gets flagged to reception before the visit. So the “lost form” phone call on the morning of the appointment stops happening.

For practices running consultations remotely, the consent form, the video visit, and the clinical note all sit in one record. There is no export step and no second filing job.

Send, sign, and file telehealth consent automatically

Pabau sends the consent form before the appointment, captures the e-signature, and files it against the patient record with a timestamp. Reception stops chasing paperwork on the morning of the visit.

Book a demo

Conclusion

Getting a telehealth consent form right starts with knowing who is asking for it. Draft to your state board and your professional standards first. Add the CMS documentation step if you bill Medicare, and treat HIPAA as the privacy layer underneath.

The template above gets you most of the way. What it cannot do is chase signatures, and that is where consent usually breaks down in practice. A form the patient never opened protects neither of you.

Fix the delivery and the paperwork stops being a problem worth thinking about. Book a demo to see how Pabau sends, signs, and files telehealth consent forms without anyone chasing them.

Continue your research

Treating a patient under 18 remotely? Consent to treat minor form sets out who can sign and what a guardian has to acknowledge.

Need to release records to another provider? Authorization for release of confidential information covers the disclosure paperwork consent forms leave out.

Moving intake off paper? Best patient intake software for private practices compares the tools that collect consent and history in one flow.

Rebuilding your documentation stack? Best clinical documentation software for practices looks at where notes, forms, and consent records live together.

Frequently asked questions