2026 State Telehealth Compliance Report: All 50 States + DC

Here is the 2026 compliance map for a virtual clinic, in four numbers. 44 states plus the District of Columbia issue physician licenses through the Interstate Medical Licensure Compact, leaving six states (California, Massachusetts, New York, Oregon, South Carolina and Virginia) where every physician still applies the long way. Only 14 states offer an out-of-state physician a telehealth registration, permit or telemedicine license short of full licensure; 13 more allow narrow exceptions such as follow-up care for an established patient. 27 states plus DC give nurse practitioners full practice authority, which is where most virtual clinics find their fastest-to-credential clinical capacity. And 12 states enforce a strong corporate practice of medicine doctrine, with 16 more applying a moderate version, which is why a non-clinician founder almost always needs a management services organization paired with a physician-owned professional entity. This report puts all 51 jurisdictions in one table, built from primary sources checked on October 5, 2026, with a downloadable CSV that carries a source URL for every value. It is a map, not a legal opinion.

This is general information, not legal advice.

Key takeaways

• 45 of 51 jurisdictions (44 states plus DC) are Interstate Medical Licensure Compact members as of October 2026; California, Massachusetts, New York, Oregon, South Carolina and Virginia still require a standard full-license application.
• 14 states let an out-of-state physician treat residents under a telehealth registration, waiver, permit or telemedicine license; 13 allow only limited exceptions, 23 require a full license, and DC could not be verified against two conflicting sources.
• 27 states plus DC classify nurse practitioners as full practice, 12 as reduced and 11 as restricted, per the AANP map dated May 2026; the restricted group includes California, Texas, Florida, Georgia, North Carolina and Michigan.
• 12 jurisdictions enforce a strong corporate practice of medicine doctrine, 16 a moderate one, 9 are limited or unsettled and 14 have no general prohibition, so an MSO with a friendly professional corporation remains the conservative national structure.
• The DEA's fourth temporary extension keeps telemedicine prescribing of controlled substances available through December 31, 2026 (90 FR 61301); the proposed special registration rule was still pending when we checked.

Who this is for

• Founders and operators deciding which states to open first, and what each will cost in licensing time and clinical staffing.
• Med spa owners and practice managers adding virtual programs across state lines who need to know where an NP can run the program without a supervising physician.
• Product, compliance and legal leads who need a sourced dataset they can verify line by line rather than a secondhand chart.

Key findings

Interstate licensure is nearly universal for physicians, with a six-state gap. The six non-members matter more than their count suggests: California and New York alone are a large slice of any national brand's demand, and both also sit in the strong-CPOM column.

Registration pathways remain the exception, and the list is not only growing. Colorado's registration is new in 2026, but Texas closed its telemedicine license to new applicants in 2022, Indiana ended its telehealth certification in 2024, and Connecticut's temporary registration expired in June 2025.

NP practice authority splits the country almost in half. The 11 restricted states require career-long physician supervision or delegation, so an NP-led program there needs a physician arrangement before the first visit.

The hardest overlap is a short list. California, Massachusetts and New York combine no compact pathway, no telehealth registration and strong CPOM. South Carolina and Virginia lack a compact pathway and restrict NPs. Plan these states last, or with physician-heavy staffing.

State-by-state telehealth compliance table (2026)

Columns: IMLC membership per the IMLC Commission; out-of-state telehealth registration per CCHP state pages (updated April to September 2026) cross-checked against FSMB's board-by-board overview; NP practice authority per AANP (May 2026); CPOM per our reading of two public 50-state summaries (see methodology). In the registration column, "No" means a full license is required beyond consultation exceptions; "Limited" means a narrow exception exists but no general registration.

Totals: IMLC 45 yes, 6 no. Registration 14 yes, 13 limited, 23 no, 1 unverified. NP 28 full, 12 reduced, 11 restricted. CPOM 12 strong, 16 moderate, 9 limited or unsettled, 14 none.

How does interstate licensure work for telehealth in 2026?

The rule has not changed: the practice of medicine happens where the patient is, so the treating clinician needs authority in the patient's state at the time of the visit. What changed in 2026 is how much of the map the Interstate Medical Licensure Compact covers.

The IMLC is an expedited application, not a national license. A qualifying physician designates a state of principal licensure, obtains a letter of qualification, then requests full licenses from any member board and pays each state's fee. North Carolina began issuing compact licenses on January 1, 2026, Connecticut went live as a state of principal licensure in March 2026, and Alaska enacted its compact law in June 2026, taking the count to 44 states plus DC and Guam. The Commission's map still distinguishes fully participating boards from boards still implementing, so confirm operational status before assuming a fast turnaround.

Three consequences. Physician breadth is cheap to add, except in the six non-member states, where each license is a standard endorsement application measured in months. Nurse practitioners do not get this: the APRN Compact had been enacted by four states (Delaware, North Dakota, South Dakota and Utah) in NCSBN's most recent enactment release and needs seven to activate, so an NP needs a license in every state she treats patients in. And coverage is a per-clinician, per-state matrix that routing has to read at the moment of the visit. Our narrative map is in telehealth licensing by state; this report is the data layer underneath it.

Which states offer out-of-state telehealth registration?

Fourteen, as of our October 2026 check, and they are not interchangeable:

• Registration with the applicable board (Arizona, Colorado, Delaware, Florida, Minnesota, Vermont, West Virginia). The physician keeps her home-state license, registers with the patient state, agrees to its jurisdiction and standard of care, and in every case we read is barred from opening an office or seeing patients in person there.
• Telemedicine license or permit (Georgia, Louisiana, Mississippi, Nevada, New Mexico, Oregon). A limited license from the medical board, for telemedicine only. Georgia's statute says the out-of-state practitioner may not have ultimate authority over the care or primary diagnosis of a Georgia patient, which narrows it for a direct-to-consumer model.
• Waiver (Kansas). The Board of Healing Arts must issue a telemedicine waiver within 15 days of a complete application, for a fee of no more than $100.

The thirteen "limited" states are frequently misreported as registration states. Alaska, Idaho, North Dakota, Ohio, South Carolina and Washington allow follow-up or continuity care for a relationship established elsewhere, which does not help a brand acquiring new patients. Illinois and Wisconsin have temporary permits tied to a sponsor or employer, Pennsylvania's license is for border physicians, and Maine's registration covers consultation only. None of these is a business model.

Three states went backwards: Texas stopped issuing its out-of-state telemedicine license to new applicants on September 1, 2022; Indiana terminated its telehealth certificates on July 1, 2024; Connecticut's behavioral-health registration expired June 30, 2025. DC is the one cell we left unverified: FSMB's 2024 overview marks it as a registration jurisdiction, while CCHP's August 2026 page shows only limited-period and consultation exceptions.

Treat registration as a way to extend an existing physician's footprint to a few extra states, not as a substitute for a licensed roster. Check any state's live status with our state legality checker before you turn marketing on.

Which states enforce the corporate practice of medicine, and what does it mean for an MSO?

The corporate practice of medicine doctrine says a non-physician (a corporation, an investor, a founder without a license) may not practice medicine, employ physicians to practice on its behalf, or control clinical judgment. States express and enforce it with very different energy. Our classification:

• Strong (12): California, Colorado, Illinois, Massachusetts, Michigan, Nevada, New Jersey, New York, North Carolina, North Dakota, Oregon, Texas. An explicit prohibition, documented active enforcement, or both. Oregon's 2025 statute goes furthest, directly restricting MSO ownership and control of professional entities.
• Moderate (16): Arizona, Arkansas, Connecticut, Indiana, Iowa, Kansas, Maryland, Minnesota, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Washington, West Virginia, Wisconsin. A recognized doctrine with a less aggressive enforcement history.
• Limited or unsettled (9): DC, Georgia, Hawaii, Idaho, Kentucky, Louisiana, Mississippi, Montana, Ohio. The doctrine exists in some form but is lightly enforced or contested.
• None (14): Alabama, Alaska, Delaware, Florida, Maine, Missouri, Nebraska, New Hampshire, New Mexico, Oklahoma, Utah, Vermont, Virginia, Wyoming. Florida instead requires a Health Care Clinic license for non-physician-owned clinics.

In the 28 strong and moderate jurisdictions a founder-owned company cannot employ the clinicians or own the practice. The standard structure is a physician-owned professional corporation that employs the clinicians and holds the patient relationship, plus a founder-owned management services organization that provides everything non-clinical for a management fee, without setting clinical protocols, controlling prescribing or splitting professional fees. The mechanics are in our MSO model guide.

Two warnings. The trend is toward stricter enforcement, led by Oregon's law and a wave of bills aimed at private equity in healthcare, so build for the strictest state you plan to serve. And CPOM classifications are interpretive; our sources disagree on a handful of states. The column is a prioritization tool for counsel, not a conclusion.

Where can nurse practitioners practice independently, and why does it matter for staffing?

AANP's May 2026 map puts 27 states plus DC in full practice, where an NP can evaluate, diagnose, order tests and prescribe, including controlled substances, under the nursing board's authority alone. Twelve states are reduced practice (Alabama, Arkansas, Illinois, Indiana, Kentucky, Louisiana, Mississippi, New Jersey, Ohio, Pennsylvania, West Virginia, Wisconsin), meaning a career-long collaborative agreement with a physician. Eleven are restricted (California, Florida, Georgia, Michigan, Missouri, North Carolina, Oklahoma, South Carolina, Tennessee, Texas, Virginia), meaning career-long supervision or delegation by another provider.

Why this is the most important column for a virtual clinic's economics:

• NPs are the backbone of most telehealth rosters. They are faster to credential in many states, more available for high-volume asynchronous and video work, and cost less per encounter. A program that routes most visits to NPs in full-practice states and reserves physicians for restricted states and escalations runs at a different cost per visit than one that is physician-only everywhere.
• Restricted states need a physician arrangement before launch. In Texas, Florida, California and Georgia the NP needs a supervising or delegating physician with state-specific paperwork in place, and some states cap how many NPs one physician can supervise. See our guide to the collaborating physician role.
• No NP compact yet. An NP-heavy roster needs more applications per clinician than a physician-heavy one, which is why provider network versus hiring is usually a question of who already holds the licenses.

The rule of thumb: overlap full-practice NP, IMLC and no-or-moderate CPOM, and you get the cheapest states to open. Overlap restricted-NP, strong-CPOM and non-compact, and you get California, Texas, North Carolina and Michigan: large, lucrative, and expensive to serve correctly.

What do HIPAA and the FTC Health Breach Notification Rule require of telehealth platforms?

A virtual clinic sits under two breach regimes, and which applies depends on what the entity is.

HIPAA Breach Notification Rule, 45 CFR 164.400 to 164.414. Applies to covered entities (the medical practice, the pharmacy, the lab) and their business associates (the platform, the intake tool, the messaging provider). After a breach of unsecured protected health information, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. If more than 500 residents of a state are affected, prominent media in that state and HHS must be notified contemporaneously; smaller breaches are logged and reported to HHS annually. A business associate must notify the covered entity, which starts the clock. For a white-label brand, the professional entity is the covered entity and the platform is a business associate, so a BAA is not optional; MyOrbitHealth includes one in every contract. The founder-level walkthrough is in HIPAA for founders.

FTC Health Breach Notification Rule, 16 CFR Part 318. Covers vendors of personal health records, PHR-related entities and their service providers that fall outside HIPAA. The FTC's amendment finalized May 30, 2024 clarified that the rule reaches health apps and that a "breach of security" includes unauthorized disclosures, not just hacks. Timing mirrors HIPAA: consumers within 60 calendar days; the FTC within 10 business days if 500 or more people are affected; media for 500 or more residents of a state. A wellness app or storefront quiz that collects health information outside the clinical record may be an FTC-regulated PHR even though the clinic side is HIPAA-regulated. State breach statutes layer on top. Build one incident process that satisfies the strictest of the three and run it everywhere.

What is the DEA telemedicine prescribing status in 2026?

For non-controlled medications (GLP-1s, finasteride, most dermatology and women's health) the DEA is not the constraint; state law and the standard of care are. For controlled substances such as testosterone, the Ryan Haight Act's in-person evaluation requirement still exists in statute, and what keeps telemedicine prescribing open is a series of temporary extensions.

The current one is the Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, published by DEA and HHS at 90 FR 61301 on December 31, 2025, effective January 1 through December 31, 2026. It lets DEA-registered practitioners continue prescribing Schedule II through V controlled medications via audio-video telemedicine without a prior in-person evaluation, subject to state law. The document references the January 2025 proposed rule for Special Registrations for Telemedicine, which would create a permanent framework; it had not been finalized when we checked.

What we will not say: that the extension will be renewed, or what form the special registration will take. Build the controlled-substance layer as a per-state, per-schedule configuration that can be turned down without a rebuild, because several states also impose their own in-person or synchronous requirements on top of the federal floor. Our dated walkthrough is in telehealth prescribing rules 2026; check DEA's own guidance before relying on anything undated.

How does MyOrbitHealth cover all 50 states?

MyOrbitHealth is B2B white-label telehealth infrastructure: the brand owns its customers, records and data, and MyOrbitHealth supplies the medical, regulatory and pharmacy layer through licensed providers under an MSO and friendly-PC structure. MyOrbitHealth itself does not practice medicine. What a partner inherits rather than builds:

• Provider Network: 2,400+ board-certified MD, DO, NP and PA providers across 38+ specialties and all 50 states, NCQA-standard credentialing with monthly OIG and SAM exclusion screening, average response under six minutes during business hours and 24-hour visit availability. Bring-your-own providers are supported.
• State-aware routing: OrbitOS routes each encounter to a clinician with authority in the patient's state, the operational answer to the IMLC, registration and NP columns above. Orbit Intake captures location and runs adaptive intake with severity scoring and red-flag escalation.
• Prescribing and fulfillment: OrbitRx is EPCS-ready e-prescribing with two-factor identity proofing, routed via Surescripts to a LegitScript-certified pharmacy network (503A compounding and retail), DEA-registered partner pharmacies where applicable, cold-chain shipping to all 50 states and 0% medication markup.
• Compliance posture: HIPAA compliant with a BAA in every contract, SOC 2 Type II, HITRUST-aligned architecture, US-region encrypted PHI and a full HIPAA audit trail. Details are on the compliance page.
• Structure: the brand is merchant of record and pays a flat platform fee scoped at onboarding, with no revenue share, no exit or termination fee, and month-to-month terms after onboarding.

The partner still owns its entity structure, counsel review and honest state-by-state marketing. 50+ digital clinics run on MyOrbitHealth today, and brands go live in days.

How was this report compiled, and what are its limits?

Dates checked. All sources were accessed on October 5, 2026.

IMLC column. Membership per the IMLC Commission's participating-states map and its June 26, 2026 release announcing Alaska as the 44th member state, cross-checked against the compact listings on each state's CCHP page. We counted states the Commission counts as members, including any still completing implementation, consistent with its 44-state figure.

Registration column. Primary basis is the Center for Connected Health Policy's state pages (cross-state licensing section, updated April to September 2026), which quote the governing statute or board rule, cross-checked against FSMB's Telemedicine Policies Board-by-Board Overview (September 2024). "Yes" means a general telehealth-specific registration, waiver, permit or telemedicine license open to new applicants; "Limited" means narrow exceptions only; "No" means a full license is required beyond consultation exceptions. DC is Unverified because the two sources conflict.

NP column. AANP's State Practice Environment map, data file dated May 2026, read directly from the map's published data.

CPOM column. There is no governmental primary source for CPOM classification; it is a legal reading. We used two public, sourced 50-state summaries (MedPath Compliance, reviewed June 20, 2026, and Permit Health, December 23, 2025) and one rule: Strong if either labels the state strict or most actively enforced; Moderate if both recognize a general doctrine without that flag; Limited or unsettled if either calls it nuanced, weak, lightly enforced or evolving; None if neither finds a general prohibition. Where the sources disagreed we chose the more cautious label.

Limits. This is a snapshot of a moving target: registration statutes are amended most sessions, CPOM enforcement is shifting, the IMLC keeps adding members, and the DEA extension expires at the end of 2026. Nothing here is a legal opinion on your structure or state list. Verify with the cited source and your healthcare counsel before acting.

Dataset. Download the full 51-row dataset with a source URL for every value at /data/state-compliance-2026.csv. You may reuse it with attribution to MyOrbitHealth and a link to this report.

Frequently asked questions

Which states are not in the Interstate Medical Licensure Compact in 2026?

As of October 2026, six states are not members: California, Massachusetts, New York, Oregon, South Carolina and Virginia. The other 44 states plus DC and Guam are members, after North Carolina went live in January 2026 and Alaska enacted its compact law in June 2026. Massachusetts had compact legislation introduced but not enacted when we checked.

Which states let an out-of-state doctor treat patients by telehealth without a full license?

Fourteen states issue a telehealth-specific registration, waiver, permit or telemedicine license: Arizona, Colorado, Delaware, Florida, Georgia, Kansas, Louisiana, Minnesota, Mississippi, Nevada, New Mexico, Oregon, Vermont and West Virginia. Each carries conditions, usually no in-person care or office in the state. Thirteen more states allow only narrow exceptions such as follow-up with an established patient.

How many states give nurse practitioners full practice authority?

Twenty-seven states plus the District of Columbia, per AANP's map dated May 2026. Twelve states are reduced practice and eleven are restricted, including California, Texas, Florida, Georgia, North Carolina and Michigan. In restricted states an NP needs a supervising or delegating physician arrangement before treating patients.

Do I need an MSO to run a telehealth brand if I am not a physician?

In the 28 jurisdictions we classify as strong or moderate CPOM, a non-physician cannot own the medical practice or employ the clinicians, so the standard structure is a physician-owned professional entity plus a founder-owned management services organization. In the 14 states with no general prohibition you have more flexibility, but most national brands adopt the MSO structure everywhere so that one model satisfies the strictest state. Have counsel review the arrangement for each state you serve.

What is the difference between HIPAA breach notification and the FTC Health Breach Notification Rule?

HIPAA's rule at 45 CFR 164.400 to 164.414 applies to covered entities and business associates and requires individual notice within 60 days, media notice for breaches affecting more than 500 residents of a state, and HHS notice. The FTC's rule at 16 CFR Part 318 applies to personal health record vendors and related entities outside HIPAA, such as many health apps, with similar timing and FTC notice within 10 business days for breaches affecting 500 or more people. A brand with both a clinical service and a consumer app can be subject to both.

Can clinicians still prescribe controlled substances by telehealth in 2026?

Yes, under the DEA and HHS fourth temporary extension published at 90 FR 61301, effective January 1 through December 31, 2026, which allows DEA-registered practitioners to prescribe Schedule II through V controlled medications via audio-video telemedicine without a prior in-person evaluation, subject to state law. The proposed special registration rule had not been finalized when we checked. Do not assume a further extension; confirm current status with DEA before planning a controlled-substance program.

Which states are hardest for a new virtual clinic to enter?

California, Massachusetts and New York combine no compact pathway, no telehealth registration and strong CPOM enforcement; California also restricts NPs. Texas, North Carolina and Michigan pair strong CPOM with restricted NP practice. South Carolina and Virginia lack a compact pathway and restrict NPs. These states are worth entering because of their size, but plan physician-heavy staffing and counsel review before launch.

Sources

• Interstate Medical Licensure Compact Commission, Participating States map and June 26, 2026 information release on Alaska joining as the 44th member state
• FSMB, Telemedicine Policies: Board-by-Board Overview (last updated September 2024)
• Center for Connected Health Policy, Cross-State Licensing (state pages updated April to September 2026)
• AANP, State Practice Environment map (data dated May 2026)
• NCSBN, South Dakota Enacts APRN Compact (February 9, 2024)
• MedPath Compliance, Corporate Practice of Medicine Across the 50 States and D.C. (reviewed June 20, 2026) and Permit Health, The Corporate Practice of Medicine 50-State Guide (December 23, 2025)
• DEA and HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, 90 FR 61301 (December 31, 2025)
• 45 CFR Part 164, Subpart D, Notification in the Case of Breach of Unsecured Protected Health Information and 16 CFR Part 318, Health Breach Notification Rule

Launch with the compliance map already colored in

Every column in this report is a problem MyOrbitHealth's network and MSO structure already solve for 50+ brands: 2,400+ licensed providers across all 50 states, state-aware routing, EPCS-ready prescribing through a LegitScript-certified pharmacy network, and SOC 2 Type II behind it. Check any state's live status with the state legality checker, read the compliance page, and book a demo to walk through your launch-state sequence.