Telehealth platforms sit at the intersection of two heavily regulated industries: healthcare and technology. Founders building in this space often focus on HIPAA compliance, and specifically on getting a Business Associate Agreement signed before launch. That’s necessary, but it is not sufficient. A HIPAA BAA governs your data handling relationship with covered entities. It does not cover what your users consent to, what services you are and are not providing, which state’s laws govern your platform, or how you limit liability when clinical outcomes are disputed.
The legal agreements a telehealth platform needs in 2026 go several layers deeper than most founders anticipate. This article covers the terms your platform must address beyond the HIPAA BAA, with particular attention to informed consent frameworks, state licensure disclosures, privacy obligations that extend beyond HIPAA, and the liability architecture that keeps your platform defensible when clinical outcomes are contested.
1. What Your HIPAA BAA Does and Does Not Cover
A HIPAA Business Associate Agreement establishes the legal relationship between a covered entity (such as a healthcare provider or health plan) and a business associate (your platform, if it stores, processes, or transmits protected health information on behalf of that covered entity). It imposes obligations on you regarding safeguarding PHI, reporting breaches, and using PHI only for permitted purposes.
Your HIPAA BAA does not address your relationship with end users. It does not govern what users consent to when they use your platform, what information your platform is required to disclose to them about how their health data is used, or how you limit your liability if a clinical decision made using your platform results in harm.
It also does not cover health data that HIPAA itself does not reach. HIPAA applies to covered entities and their business associates. If your platform collects health-related data directly from consumers and is not a business associate of a covered entity, HIPAA may not apply to that data at all. State privacy laws and the FTC Act fill the gap, and in some cases create stricter requirements.
2. Informed Consent: What Your Terms of Service Must Address
Informed consent in telehealth is a clinical and legal requirement. At the patient-provider level, state medical boards govern what informed consent for telehealth services must include. At the platform level, your terms of service must reflect those requirements and ensure users understand what they are and are not consenting to.
Your terms should clearly address:
- What your platform is and is not: If your platform facilitates provider-patient communication but does not employ the clinicians, your terms must make clear that the licensed providers are independent practitioners and that your platform is a technology intermediary, not a healthcare provider.
- Scope limitations: Telehealth has documented clinical limitations. Certain conditions cannot be adequately assessed remotely. Your terms should disclose the limitations of remote care and instruct users in what situations they should seek in-person care or emergency services.
- State availability: Provider licensure is state-specific. A physician licensed in California cannot legally provide medical services to a patient in Texas unless also licensed in Texas. Your terms must address which states your services are available in and what governs the encounter when provider and patient are in different states.
- Emergency situations: Your platform is not a substitute for emergency services. Your terms should explicitly direct users to call 911 or seek emergency care for urgent conditions, and your platform should not create any expectation that telehealth response times are appropriate for emergencies.
3. State Licensure and the Multi-State Problem
Telehealth operates across state lines by design, but medical and therapy licensure does not. Under the Ryan Haight Online Pharmacy Consumer Protection Act, controlled substance prescriptions via telehealth require specific prescriber conditions. State medical boards set their own telehealth practice standards, and the patchwork of rules across fifty states creates significant compliance complexity for platforms operating nationally.
Your terms of service need to address how your platform handles the state licensure problem. Options include:
- Limiting your platform to matching users with providers licensed in their specific state
- Requiring users to confirm their location at each session to verify provider eligibility
- Using the Interstate Medical Licensure Compact (IMLC) or Nurse Licensure Compact (NLC) frameworks to expand provider availability in participating states
Whatever approach you take, your terms must be transparent about it. A user in a non-participating state who cannot access services needs to know that before they create an account, not after they attempt to book an appointment.
4. Privacy Obligations That Extend Beyond HIPAA
HIPAA covers PHI in the hands of covered entities and business associates. A consumer-facing mental health app that collects health data directly from users, without a healthcare provider relationship, may not be processing PHI under HIPAA at all. But that data is health-related, sensitive, and increasingly regulated at the state level.
Washington state’s My Health MY Data Act (MHMD), which took effect in 2024, applies to any entity collecting health data about Washington consumers, regardless of HIPAA applicability. It requires specific consumer rights (access, deletion, withdrawal of consent) and restricts sharing health data for advertising purposes without explicit opt-in consent. Similar laws are being enacted in other states.
The FTC Act Section 5’s prohibition on unfair or deceptive practices also applies to health data. The FTC has taken enforcement action against companies that shared health data with advertisers after representing in their privacy policies that such data would not be shared. If your telehealth platform’s privacy policy says one thing and your data practices do something different, Section 5 exposure is real.
Your privacy policy must accurately describe every category of health data you collect, every purpose for which it is used, and every party to whom it is disclosed. Generic privacy policies that were written for SaaS platforms without health data components will not survive FTC scrutiny when applied to telehealth. See also the full picture of data privacy laws every startup must comply with.
5. Liability Limitation Clauses for Health Tech Platforms
Liability limitation in telehealth is more complex than in other SaaS categories because clinical harm is a foreseeable type of damage and courts treat certain health-related claims differently from pure economic loss claims.
Your limitation of liability clause for a telehealth platform should address:
- The platform/provider distinction: Your platform is a technology intermediary. The licensed clinicians using your platform are independent professionals. Your terms should make clear that clinical decisions, diagnoses, and treatment recommendations are the responsibility of the licensed provider, not the platform.
- Cap on damages: A standard SaaS liability cap tied to fees paid in the prior twelve months may be appropriate for business customers. For consumer-facing health platforms, the appropriate cap and the categories of damages excluded need careful drafting, particularly given that personal injury claims may be subject to different treatment in some jurisdictions.
- Exclusion of consequential damages: Your terms should exclude liability for indirect, incidental, or consequential damages, including damages arising from reliance on information provided through the platform. This exclusion needs to be conspicuous and clearly written to be enforceable.
- No warranty on clinical outcomes: Your platform does not guarantee clinical outcomes and cannot. Your terms should include a clear disclaimer that the platform makes no representations about the accuracy, completeness, or fitness for purpose of any clinical information provided through it.
6. Subscription and Payment Terms Specific to Telehealth
Telehealth platforms increasingly operate on subscription models, and your subscription terms need to address the particular dynamics of health service commitments. Specifically:
- What happens to unused sessions if a user’s provider leaves the platform or retires?
- What are your refund obligations if a user experiences a technical failure during a session?
- If your platform includes prescription services, what are the billing and refund rules for prescriptions that were filled but the clinical visit is disputed?
- How do your cancellation terms interact with state consumer protection laws, which in some states include specific health service cancellation rights?
These questions do not have universal answers, but your terms need to address them. Leaving subscription disputes to be resolved by general silence creates customer service and legal complexity that scales badly as your user base grows.
7. User-Generated Content and Reviews on Telehealth Platforms
Many telehealth platforms include provider ratings or patient reviews. This creates a layer of legal considerations most general tech platform terms do not anticipate. Provider reviews involve health-related speech that may intersect with state medical board regulations on advertising. Fake or incentivized reviews for healthcare providers carry FTC compliance implications.
If your platform includes a review or rating feature, your terms need to address what users can and cannot post, how you handle disputed reviews from providers, and how you comply with FTC guidance on endorsements in health contexts. Section 230 of the Communications Decency Act may provide some platform immunity for third-party content, but its scope in health contexts is actively litigated.
8. What a Technology Lawyer Does for Telehealth Platforms
The intersection of healthcare regulation, multi-state licensure, federal privacy law, and state consumer protection law makes telehealth one of the more legally complex product categories to build. A general-purpose terms generator or a standard SaaS agreement template will not address the specific risks your platform carries.
A terms of service lawyer with experience in digital health platforms can draft terms that cover the platform-provider-patient tripartite relationship accurately, build informed consent disclosures that satisfy state requirements, structure your liability limitations to be enforceable in health contexts, and align your privacy policy with both HIPAA and the state laws that apply to health data beyond HIPAA’s scope.
Frequently Asked Questions
Do I need HIPAA compliance if my platform does not employ doctors?
If your platform stores, processes, or transmits protected health information on behalf of covered entities (healthcare providers or health plans), you are a business associate under HIPAA and must comply. If you collect health-related data directly from consumers without a covered entity relationship, HIPAA may not apply, but state health data privacy laws (such as Washington’s My Health MY Data Act) and the FTC Act likely do.
What is the difference between a telehealth platform’s terms of service and a provider’s informed consent?
Your terms of service govern the user’s contractual relationship with your platform as a technology service. Provider informed consent is a clinical and legal requirement that governs the patient’s agreement to receive specific medical care from a specific licensed provider. Both are necessary. Your platform terms cannot substitute for provider-level informed consent, and your platform should support, not replace, the informed consent process.
Can my telehealth platform operate across all US states from day one?
Not practically, given state licensure requirements for clinicians. Your platform can be technically available in all states, but the clinical services delivered through it depend on providers being licensed in the patient’s state. Your terms should accurately reflect where services are available and ensure your platform’s matching logic enforces state licensure requirements.
Does Washington’s My Health MY Data Act apply to my app if I have no Washington office?
Yes, if you collect health data about Washington consumers. The MHMD applies based on the consumer’s location, not the company’s location, similar to GDPR’s territorial scope. If you have users in Washington and your app collects health-related data from them, the Act’s requirements for consumer rights and restrictions on sharing health data for advertising apply to you.
How should a telehealth platform handle a user who presents as a medical emergency?
Your terms and your platform’s user interface should clearly direct users to call 911 or go to an emergency room for any situation that may be a medical emergency. Your platform creates no duty of emergency care, and your terms should make this explicit. Many telehealth platforms also build in automated prompts during intake to screen for acute emergencies and redirect users appropriately.
Conclusion
Building a telehealth platform means building on top of one of the most heavily regulated industries in the US. Your HIPAA BAA is the foundation, not the finish line. The platform terms covering provider relationships, informed consent, state availability, health data privacy, and liability limitation are where the real legal architecture lives.
If you are launching or scaling a telehealth platform and your legal agreements have not been reviewed by a technology lawyer with digital health experience, contact Hansen Tong at TOSLawyer.com before your next round of user growth creates a compliance problem you cannot retroactively fix.