8 Top Legal Risks in Telehealth That Many Georgia Providers Overlook

Telehealth has gone from novelty to normalcy. Once the domain of rural providers and forward-thinking practices, virtual care is now an everyday part of medicine for Georgia physicians.

But with new technology comes new complexities—and significant legal risks. As convenient as telehealth can be for doctors and patients, it also poses many of the same pitfalls as in-person practice, if not more.

Even experienced Georgia physicians may not be aware of how telehealth can lead to board complaints, licensing issues, and even criminal investigations. Here’s what you should know about the most common legal traps for telehealth providers in Georgia.

8 Common Telehealth Legal Traps for Georgia Providers

Failure to Properly Establish the Physician-Patient Relationship

As in traditional medical practice, a physician-patient relationship must be formed before treatment can be given or a diagnosis made. In telemedicine, that relationship cannot be created on an online questionnaire or chat exchange alone.

Georgia law allows “telemedicine” (or “telehealth”) in certain circumstances, including real-time audiovisual communication where the patient is informed about the medical risks of the treatment and consents to proceed.

The standard of care also applies to virtual encounters, according to the Georgia Composite Medical Board (GCMB): “The same standard of care applies to a medical care visit conducted via telemedicine as would apply to an office visit.”

This leads us to the issue: Providers often overlook the requirement for a prior in-person office visit for every telehealth service.

Fact: Georgia law states that physicians must have met the patient in person before, unless otherwise noted by law or exception.

In practice, this means that a prior office visit is required for medical services provided via telehealth in Georgia. While limited exceptions have existed in the past, telehealth simply cannot be the first contact a patient has with your practice for the doctor-patient relationship to form and be defensible in a future complaint or board proceeding.

Exceptions may apply in specific cases for the prescribing of controlled substances or mental health services, which have their respective standards. If in doubt, assume a prior in-person visit is necessary.

Improper Prescribing of Controlled Substances

Telemedicine and controlled substances continue to evolve, especially since the COVID pandemic and public health emergency (PHE). The federal government relaxed certain prescribing restrictions, but those requirements have tightened again recently.

Georgia law follows federal Ryan Haight Act requirements, which generally prohibit the prescribing of controlled substances without an in-person medical evaluation or an exception.

Many Georgia physicians have been surprised to learn of this requirement after treating patients and prescribing ADHD medications, anxiety medications, and opioids by telemedicine without an in-person visit.

Before prescribing a controlled substance in Georgia by telehealth, you should:

• Have met the in-person visit requirement, or a narrow exception applies
• Be properly registered with the DEA and state board

Follow both federal and Georgia state standards, which are sometimes stricter than national rules.

Inadequate Informed Consent Procedures

Informed consent is a cornerstone of telehealth, but it encompasses more than just the clinical procedure. Georgia law also requires physicians to inform patients about the technology, potential privacy issues, and contingency plans in the event of technical failure.

The problem is that consent obtained online is not always legally obtained or documented. Most telehealth platforms or EHRs lack automatic informed consent workflows, and simply having patients “agree” to privacy and security policies is not enough.

You should also inform patients:

• About telehealth in general (what it is, how it’s different from office-based care, etc.)
• The potential diagnostic limitations of virtual visits
• Technical failure protocols
• Recording and privacy policies

Remember, many states, including Georgia, are looking at consent documentation as part of good telemedicine care. Failure to document it (even if you actually obtained it) can open the door to a later patient complaint that alleges misdiagnosis, misunderstanding, or inappropriate use of their data.

Crossing State Lines—Even by Accident

Telehealth can ultimately eliminate state boundaries for patients, but not for healthcare providers in Georgia. The law is clear on this point—if the patient is physically located outside the state at the time of a telehealth visit, you must be licensed in that state to treat them.

This is one of the most common mistakes made by Georgia providers—and a straightforward one to commit if you have patients who travel or have multiple residences.

Georgia physicians may unknowingly break licensing laws by:

• Continuing care with a patient on vacation in another state
• Following up with a college student who has moved away
• Retaining a patient who moves out of state and “just calls in” occasionally

To stay on the right side of the law, it’s essential to build a verification process into your scheduling and intake systems to document the patient’s physical location at the time of the telehealth visit. If your practice serves a large out-of-state population, consider applying to the Interstate Medical Licensure Compact to make multiple-state licensing easier. Georgia participates in the compact.

Security and HIPAA Violations

HIPAA compliance is just as crucial for telemedicine as office-based care. In fact, using a “secure platform” isn’t enough to ensure HIPAA compliance. Providers must also take reasonable steps to:

• Securely store and protect patient data and health information from unauthorized use
• Use HIPAA-compliant video software with an encryption feature and BAA
• Avoid using personal electronic devices and unsecured Wi-Fi networks
• Maintain the privacy of notes, chat logs, and any recordings
• Train staff on security and privacy for telemedicine

The OCR relaxed some of its enforcement on HIPAA violations at the onset of the COVID-19 pandemic. However, that grace period has now expired. Georgia physicians who continue to use common platforms like FaceTime, Skype, or Zoom without written agreements are at increased risk of enforcement actions.

Neglecting Documentation Standards

Telemedicine does not reduce the need for good documentation. It increases the need. With a virtual visit, you may not have the benefit of a hands-on exam or in-office support, meaning your notes must clearly indicate:

• Why was telehealth used
• Patient consent
• Discussion of history and findings
• Limitations of a virtual exam
• Advice or recommendations
• Referral to in-person follow-up as medically necessary

The downside of treating patients in this manner is that the documentation must be both sufficient and timely, and accessible. Failure to document a “virtual” visit is a top board investigation trigger if a patient later files a complaint.

Unclear Emergency Protocols

What happens when a patient has a medical emergency during a virtual visit? What if a heart attack occurs, or you see signs of a stroke or suicidal ideations? Few physicians have a clear plan to address medical emergencies that may arise during a telehealth encounter.

Don’t assume you’ll be able to just call 911. You need a documented plan that covers at least the following elements:

• Location of the patient during a telemedicine visit
• Protocol to verify local emergency contacts
• Staff training on emergency escalation during virtual care
• Documentation of any attempt to coordinate with in-person emergency medical services

Lack of an emergency plan is not just a risk—it could be considered negligent if the patient’s outcome is poor.

Overreliance on Telehealth Without In-Person Support

Telemedicine is great for certain services, but exclusively relying on remote care, especially for complex or chronic conditions, can lead to standard-of-care violations. The GCMB expects Georgia physicians to know when an in-person examination is medically necessary.

If the medical standard of care for the condition is an in-person visit, and you treat the patient virtually without offering an in-person alternative, you could be at risk for failure to diagnose, delayed care, or improper treatment, as you would be in your regular medical practice.

A rule of thumb for Georgia physicians is to have a hybrid model that includes in-person options for telehealth, as well as always offering patients an option for in-person care when warranted.

Virtual Care, Real-World Consequences

Telehealth is here to stay, and that’s a great thing for providers and patients. However, as telemedicine continues to evolve, so does its legal aspect. Georgia providers who treat telehealth as a “lite” or less formal version of traditional office-based care risk serious consequences.

Avoiding these pitfalls begins with a deeper understanding of the laws governing telehealth in Georgia and other jurisdictions, as well as a commitment to updating your practice’s compliance, documentation, and licensing requirements.

If you’re not sure whether your telemedicine protocols are up to legal standards, or if you’re already facing a patient complaint or an investigation, it’s time to get legal help. At Little Health Law, we help Georgia physicians with the legal side of modern medicine so you can focus on patient care. Contact our office as soon as possible to ensure you are abiding by the state’s rules and regulations in this regard.