6.1 California Telehealth Laws, Standards of Care & Out-of-State Practice
Key Takeaways
- Under California Business and Professions Code (BPC) § 2290.5 and Title 16 California Code of Regulations (16 CCR) § 1815.5, the standard of care for telehealth is identical to that of in-person psychotherapy.
- In California and interstate jurisprudence, clinical practice legally occurs at the physical location of the client at the time services are rendered; an LPCC or APCC must be licensed or authorized in the jurisdiction where the client is physically present.
- Prior to initiating telehealth and at the beginning of each subsequent session, the clinician must verify and document the client's identity and exact physical location, assess ongoing clinical suitability, and maintain contact details for local emergency response in the client's area.
- Clinicians delivering telehealth must establish a documented technology failure contingency protocol and utilize secure, encrypted, HIPAA-compliant communication platforms backed by a signed Business Associate Agreement (BAA).
6.1 California Telehealth Laws, Standards of Care & Out-of-State Practice
Exam Focus: Telehealth regulation is heavily tested on the California LPCC Law and Ethics Exam. Candidates must master California Business and Professions Code (BPC) § 2290.5 and Title 16 California Code of Regulations (16 CCR) § 1815.5. Crucial test concepts include the legal definition of clinical practice location (where the client sits), mandatory per-session identity and physical location verifications, telehealth-specific informed consent, emergency response planning, and HIPAA-compliant platform safeguards.
Statutory Framework & Definition of Telehealth
In California, telehealth delivery by mental health professionals is governed by California Business and Professions Code (BPC) § 2290.5 (the California Telehealth Development Act) and administrative regulations promulgated by the Board of Behavioral Sciences under Title 16 California Code of Regulations (16 CCR) § 1815.5.
Legal Definition of Telehealth (BPC § 2290.5(a)(6))
"Telehealth means the mode of delivering health care services and public health via
information and communication technologies to facilitate the diagnosis, consultation,
treatment, education, care management, and self-management of a patient's health care.
Telehealth facilitates patient self-management and caregiver support for patients and
includes synchronous interactions and asynchronous store-and-forward transfers."
Telehealth Delivery Modalities
California law recognizes two primary modalities of electronic clinical delivery:
- Synchronous Interaction: Real-time, interactive, two-way audio and video communication or live two-way telephone interaction between the client and the clinician.
- Asynchronous Interaction ("Store-and-Forward"): The electronic transmission of medical or clinical data, diagnostic images, digital assessments, or recorded audio/video from the client to the clinician for evaluation at a later time (BPC § 2290.5(a)(1)). In outpatient mental health counseling, synchronous videoconferencing is the predominant clinical modality.
The Fundamental Standard of Care Mandate
Under 16 CCR § 1815.5(a), a licensee or registrant of the BBS who delivers services via telehealth is held to the exact same legal, ethical, and clinical standard of care as an in-person practitioner:
+-------------------------------------------------------------------------+
| BBS TELEHEALTH STANDARD OF CARE |
| (16 CCR § 1815.5(a)) |
+-------------------------------------------------------------------------+
| "A licensee or registrant of the Board who provides clinical services |
| via telehealth shall provide those services in accordance with the |
| same standard of care as services provided in person." |
+-------------------------------------------------------------------------+
| • No reduction in assessment rigor or crisis intervention duty |
| • Mandatory full diagnostic evaluation and treatment planning |
| • Complete clinical documentation and recordkeeping compliance |
| • Identical statutory confidentiality, privilege, and reporting duties |
+-------------------------------------------------------------------------+
Telehealth is legally classified as a mode of service delivery, not a distinct clinical license or separate scope of practice. An LPCC or APCC cannot lower diagnostic standards, abbreviate clinical assessments, or omit crisis stabilization protocols simply because services are mediated through digital technology.
The Jurisdictional Licensing Rule ("Where the Client Sits")
A cornerstone principle of counseling jurisprudence is the Jurisdictional Rule: The legal practice of psychotherapy occurs at the physical location of the client at the exact moment services are rendered.
+-------------------------------------------------------------------------+
| INTERSTATE JURISDICTIONAL MATRIX |
+------------------------------------+------------------------------------+
| CLIENT'S LOCATION | CLINICIAN'S REQUIRED STATUS |
+------------------------------------+------------------------------------+
| Inside California | Must hold an active California |
| (e.g., San Francisco, Fresno) | license/registration (LPCC/APCC). |
+------------------------------------+------------------------------------+
| Outside California | Must comply with the laws of the |
| (e.g., Nevada, New York, Texas) | jurisdiction where CLIENT sits. |
| | California license alone does NOT |
| | authorize out-of-state practice. |
+------------------------------------+------------------------------------+
| International Location | Must comply with the legal and |
| (e.g., Europe, Canada, Mexico) | licensing mandates of the foreign |
| | nation where client is located. |
+------------------------------------+------------------------------------+
Clinical Applications of the Jurisdictional Rule
- Clients Temporarily Traveling Outside California: If an existing California client travels to another state for vacation, work, or university study, the California LPCC cannot automatically continue telehealth sessions. The LPCC must verify whether the destination state permits temporary practice, requires emergency temporary registration, or strictly forbids non-resident practice without full in-state licensure.
- Clients Physically in California: If an individual is physically situated within California's borders, any mental health professional providing psychotherapy to that individual—regardless of where the therapist's physical office or computer is located—must hold an active California license or BBS registration (or operate under a narrow statutory exemption).
- Therapist Traveling Outside California: If a California-licensed LPCC is temporarily traveling outside California but their client remains physically in California, the LPCC may continue providing telehealth to the California client, provided the state the therapist is visiting does not prohibit outbound electronic healthcare delivery.
Mandatory Telehealth Protocols under 16 CCR § 1815.5
California regulations impose rigorous procedural requirements that must be executed at the onset of treatment and during every individual telehealth session.
+-------------------------------------------------------------------------+
| 16 CCR § 1815.5 TELEHEALTH COMPLIANCE FLOW |
+-------------------------------------------------------------------------+
| AT ONSET OF TELEHEALTH SERVICES (Initial Intake) |
| • Provide full telehealth informed consent (risks, benefits, privacy) |
| • Obtain and document verbal or written client consent |
| • Provide BBS license/registration number and credentials |
| • Establish emergency contacts and local crisis resources |
| • Formulate technology failure contingency protocol |
| │ |
| ▼ |
| AT THE START OF EVERY TELEHEALTH SESSION (Ongoing Mandates) |
| 1. Verify and document CLIENT'S IDENTITY |
| 2. Verify and document CLIENT'S EXACT PHYSICAL LOCATION (Address) |
| 3. Assess CLIENT'S CONTINUING SUITABILITY for telehealth |
| 4. Confirm accessibility of local emergency resources |
| 5. Ensure client is in a private, confidential, safe environment |
+-------------------------------------------------------------------------+
1. Initial Telehealth Informed Consent (16 CCR § 1815.5(b))
Prior to delivering telehealth services, the clinician must:
- Inform the client about the use of telehealth, explaining the potential risks, clinical limitations, and benefits of remote care.
- Provide the client with their BBS license or registration type and number.
- Obtain and document the client's informed consent (verbal or written) in the clinical record.
- Establish an agreed-upon technology failure protocol specifying how communication will immediately resume (e.g., secure telephone backup) if the video connection fails during a session or psychiatric crisis.
2. Mandatory Per-Session Protocols (16 CCR § 1815.5(c))
At the beginning of each and every telehealth encounter, the LPCC or APCC must:
- Verify Client Identity: Confirm the identity of the client (and any other participants present on screen or audio).
- Verify Exact Physical Location: Determine and document the client's current physical address or specific geographic location (e.g., street address, room number, or cross streets) for that specific session.
- Assess Clinical Suitability: Continuously evaluate whether telehealth is clinically appropriate for the client's current psychological presentation, symptom severity, and environmental safety.
- Maintain Local Emergency Resources: Ensure access to contact information for local emergency response agencies (such as local municipal police dispatch, county mobile crisis teams, or nearby hospital emergency departments) situated in the client's immediate physical vicinity.
Assessing Telehealth Suitability & Contraindications
Not all clinical presentations are appropriate for remote treatment. Clinicians have a professional duty to assess suitability at intake and re-evaluate throughout treatment.
| Assessment Dimension | Clinically Suitable for Telehealth | Telehealth Contraindicated / Requires In-Person |
|---|---|---|
| Symptom Acuity | Mild to moderate anxiety, depression, adjustment issues, life transitions | Active psychosis, severe mania, acute dissociation, escalating crisis |
| Suicidality / Safety | Passive ideation with intact safety controls and strong support system | Imminent suicide risk, active intent, plan, access to lethal means |
| Substance Use | Stable recovery, mild substance use disorders, outpatient maintenance | Severe active intoxication, acute withdrawal risk, medical detox needed |
| Physical Environment | Private, secure room with assured confidentiality and safety | Shared space with abusers, domestic violence surveillance, public places |
| Technological Capacity | Access to stable broadband, secure device, adequate digital literacy | Severe cognitive impairment, lack of secure device or private setting |
If a client's condition deteriorates such that telehealth is no longer safe or effective, the LPCC must facilitate a transition to in-person psychotherapy, intensive outpatient programs (IOP), or higher levels of care, rather than continuing remote sessions in an unsafe environment.
Technology Security, Encryption & HIPAA Compliance
Under federal HIPAA Security Rule (45 CFR Part 164) and the California Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code § 56), electronic transmission of Protected Health Information (PHI) requires robust technical safeguards.
Key Security Requirements
- Business Associate Agreements (BAAs): Clinicians must execute a formal, written BAA with the telehealth platform vendor (e.g., Zoom for Healthcare, SimplePractice, Doxy.me). A BAA legally binds the vendor to comply with HIPAA privacy and data security standards. Standard consumer platforms without BAAs (such as public FaceTime, Skype, or consumer Google Meet) are non-compliant.
- End-to-End Encryption: Audio-video data streams must be encrypted using advanced encryption standards (AES-128 or AES-256) during transit and storage.
- Secure Workspace: Clinicians must conduct telehealth sessions from private, soundproof offices to prevent unauthorized third parties from overhearing confidential disclosures.
Clinical Exam Vignettes
Vignette 1: Out-of-State Vacation Crisis & The Jurisdictional Rule
Scenario: An LPCC in Los Angeles has been treating Maya for moderate depression for six months. Maya travels to Colorado for a four-week ski vacation and requests her regular weekly video session. The LPCC logs into the video platform, confirms Maya is in Aspen, Colorado, and conducts the session without checking Colorado licensing rules. Legal Analysis: The LPCC violated licensing jurisprudence. Because Maya was physically located in Colorado, psychotherapy legally occurred in Colorado. The LPCC cannot deliver psychotherapy to a person in Colorado without holding a Colorado counseling license or complying with Colorado's specific temporary practice statutes. The LPCC should have verified Colorado's interstate practice regulations prior to holding the session.
Vignette 2: Failure to Verify Physical Location During Acute Suicidality
Scenario: An APCC begins a telehealth session with an adult client who logs in from an unfamiliar room. The APCC dives into therapy without asking for the client's current address. Thirty minutes into the session, the client reveals they have ingested a lethal quantity of prescription sedatives and begins losing consciousness. The APCC attempts to call 911 in Los Angeles, but has no record of the client's current location, which turns out to be a hotel in San Diego. Legal Analysis: The APCC violated 16 CCR § 1815.5(c) by failing to determine and document the client's exact physical location at the start of the session. In telehealth emergencies, calling local 911 from the therapist's distant office is ineffective without the client's exact physical street address and contact details for the local dispatch authority in the client's municipality.
An LPCC licensed exclusively in California has been providing weekly telehealth therapy to an established client residing in San Francisco. The client temporarily relocates to Oregon for a four-month work assignment and requests to continue weekly telehealth sessions. How must the California LPCC respond under California law and interstate licensing standards?
Under Title 16 California Code of Regulations (16 CCR) § 1815.5, which procedural requirements must a California psychotherapist fulfill at the commencement of each and every telehealth session?
An LPCC is setting up a private telehealth practice in California and selecting electronic communication software. To comply with HIPAA Security Rule requirements and California CMIA confidentiality standards, what must the clinician execute with the video platform vendor?