Telehealth went from a marginal modality in 2019 to a permanent feature of medical practice by 2023, and by 2026 it’s a normalised part of how most practices deliver care. The professional liability policy on the wall of the practice administrator’s office, however, was often written for a pre-telehealth model — in-person care, single-state licensure, traditional standards of care.
Most practices haven’t updated the policy alongside the practice. The malpractice form they’re carrying may not cleanly respond to a telehealth-specific claim, and the gap doesn’t show up until a claim arrives.
Here’s what changed and what to check.
What telehealth changes about malpractice exposure
Three structural shifts:
1. Multi-state licensure and jurisdiction
A telehealth practice in California treating a patient who happens to be travelling in Florida raises a jurisdiction question: where did the care occur? Where can the claim be brought? Which state’s standard of care applies? Most malpractice forms were drafted assuming care happens in the state where the provider is licensed; cross-state telehealth blurs that assumption.
The Interstate Medical Licensure Compact has streamlined multi-state licensure for many physicians, but the insurance form often hasn’t caught up. Some forms exclude or limit coverage for care delivered outside the provider’s primary state of licensure; others handle it silently.
2. Modality-specific standard of care
Telehealth has its own emerging standard of care — when is it appropriate to use video vs phone, when must a patient be referred for in-person evaluation, what diagnostics require physical examination, how must telehealth visits be documented. The professional standards have evolved through 2022–2026; the insurance underwriting of those standards has been less synchronised.
A claim alleging that a telehealth visit should have been an in-person referral raises a standard-of-care question that the older malpractice form may not be primed for.
3. Cyber overlap with PHI
Telehealth visits generate video recordings, chat transcripts, and electronic health record entries that didn’t exist in the in-person model. The cyber exposure of telehealth is meaningfully higher than in-person practice — more digital touchpoints, more data, more attack surface.
The cyber and malpractice forms have to overlap correctly. A breach of telehealth platform credentials could trigger cyber (data breach) and malpractice (compromise of the standard of care) simultaneously. Forms that don’t coordinate leave the practice arguing with two carriers about whose claim it is.
What to check on the current form
Four questions for any practice doing more than incidental telehealth:
1. Does the policy cover care delivered across state lines?
If you’re licensed in CA and your patient is in NV during a session, what does the policy say? Some forms exclude care outside the primary licensure state; others extend automatically; others extend only with notice to the carrier. The default isn’t always favourable.
2. Is telehealth specifically endorsed?
Many modern malpractice forms now have an affirmative telehealth endorsement that defines telehealth, addresses jurisdiction, and confirms coverage for it. If your form is silent on telehealth, that’s not the same as covering it.
3. How is consent and documentation handled?
Carriers increasingly expect specific telehealth informed-consent processes, modality decision documentation (why this visit was appropriate for telehealth), and platform-specific privacy practices. If your practice isn’t documenting these, claim defensibility weakens.
4. Cyber form coordination
Read the cyber form against the malpractice form. Specifically: when a telehealth platform breach occurs, which form responds to what? If neither form clearly takes the breach-of-standard-of-care claim, that’s a gap to close.
What to do at the next renewal
Three concrete moves:
- Disclose the telehealth volume and modality. Carriers underwrite based on what they know. If telehealth is now 30%+ of visits, that’s information the underwriter needs.
- Add a telehealth endorsement if one isn’t on the form. Most specialty medical malpractice carriers offer one; pricing impact is modest.
- Coordinate cyber and malpractice review at the same renewal. Same broker reading both forms together catches gaps that separate reviews miss.
Telehealth isn’t going away. The form questions it raises aren’t theoretical — they’re going to be tested in litigation through 2026 and beyond. Practices that updated their forms alongside their care model are positioned defensibly. Practices that didn’t are quietly exposed.
