Georgia Telemedicine Laws: Licensing, Prescribing, and HIPAA

Georgia telemedicine laws sit on two main pillars: the Georgia Telehealth Act at O.C.G.A. § 33-24-56.4, which forces private insurers to cover remote care on par with in-person visits, and Georgia Composite Medical Board Rule 360-3-.07, which holds telemedicine providers to the same standard of care as an office visit.¹² Around those two anchors sit rules on licensing, prescribing, patient consent, technology, privacy, and malpractice coverage. If you treat Georgia patients remotely, all of them apply.

Who Needs a License and Which One

The Georgia Composite Medical Board licenses physicians and other medical professionals practicing in the state, including anyone delivering care by telemedicine.³ Physicians have two options.

A full Georgia medical license covers every form of practice, telemedicine included. Application costs $500 and requires graduation from an accredited medical school, completed residency, a passing USMLE score or equivalent, and a background check.⁴ Maintaining the license takes at least 40 hours of board-approved CME every two years.⁵

Out-of-state physicians can instead pursue a telemedicine-specific license under O.C.G.A. § 43-34-31.1, provided they hold a full, unrestricted license in another state.⁶ Telemedicine licensees answer to the same practice standards, including Rule 360-3-.07, that apply to fully licensed Georgia physicians.⁷

Nurse practitioners and physician assistants can deliver telemedicine, but only within a supervisory or delegation framework. The delegating physician must document to the Board that telemedicine is within the provider’s scope of practice and that the NP or PA has demonstrated competence to deliver remote care.² APRNs need a protocol agreement on file, and both delegating and designated physicians must hold an active Georgia license and practice inside the state or within 50 miles of where the patient receives services.⁸ The 50-mile rule is easy to miss when the whole model is virtual.

Georgia is a member of the Interstate Medical Licensure Compact, which streamlines the process of obtaining licenses in multiple member states.⁹ The Compact does not substitute for individual state licenses; it just makes them faster to secure. Once licensed in each state, physicians still follow that state’s practice standards.

Standard of Care and Informed Consent

Rule 360-3-.07 sets the baseline: a telemedicine encounter must meet the same standard of care as an in-person visit, and the Board can discipline unprofessional conduct in a virtual visit the same way it would in an office.² The provider must have the patient’s medical history available at the encounter and must make diligent efforts to have the patient seen in person by a Georgia-licensed physician, PA, or NP at least once a year.

Informed consent has to be obtained before any telemedicine visit. For Georgia Medicaid patients, consent must be written, signed before the first telehealth encounter, and describe the risks, benefits, and consequences of telehealth. It must also tell the patient they have the right to see an in-person provider immediately if an urgent need arises during or after the consultation, and that in-person alternatives are available.¹⁰ Outside Medicaid, documented consent is best practice and the kind of record any malpractice defense will want.

Prescribing Through a Telemedicine Visit

This is where Georgia providers get in trouble fastest. Board rules generally require an in-person examination before an initial prescription for controlled substances or dangerous drugs.¹¹ After that first in-person visit, follow-up prescriptions can go through telemedicine, with the annual in-person visit expectation still in force. Prescribing controlled substances for pain or chronic pain through telemedicine is flatly prohibited; chronic pain treatment has to comply with Board Rule 360-3-.06.

Every prescriber with an active Georgia license and DEA number must register with the Georgia Prescription Drug Monitoring Program. The PDMP has to be checked before writing a first-time prescription for Schedule II opiates, cocaine derivatives, or benzodiazepines, and at least every 90 days if the prescription continues.¹² Exceptions apply for prescriptions of three days or fewer (up to 26 pills), patients in inpatient facilities, post-outpatient-surgery prescriptions of ten days or fewer (up to 40 pills), terminally ill patients, and patients receiving cancer treatment.

At the federal level, the Ryan Haight Act normally requires an in-person evaluation before prescribing Schedule II through V controlled substances by telemedicine, but DEA and HHS have extended COVID-era flexibilities through December 31, 2026, permitting prescriptions without a prior in-person visit when issued for a legitimate medical purpose by a DEA-registered practitioner.¹³ Don’t rely on that federal window. Georgia’s rules are stricter, and when state and federal rules conflict, the stricter one controls. Georgia’s in-person examination requirement and chronic pain prohibition still apply.

Starting the Patient-Provider Relationship

Rule 360-3-.07 also governs when a valid patient-provider relationship begins. A Georgia-licensed provider must either have personally seen and examined the patient before, or meet specific conditions for initiating care remotely, and the annual in-person visit expectation means a purely virtual relationship has limits.² Direct-to-consumer platforms that connect a patient with a provider for a single virtual visit sit right at the edge of this rule. Prescribing a dangerous drug at a first telehealth encounter with no prior in-person examination is the kind of pattern the Board can treat as falling below the minimum standards of practice. Building in-person touchpoints into the care model, whether through your own office or a referral arrangement, is the safer path.

Technology and Platform Requirements

Georgia’s rules consistently call for secure, HIPAA-compliant technology. Medicaid-covered services must run on a platform supporting real-time interactive audio and video; equipment costs and failed transmissions are not reimbursable.¹⁰ Excluded modalities include standard telephone calls, faxes, plain email, video cell phone calls, and unsecured web-based platforms such as consumer video-chat apps. Store-and-forward (asynchronous) care is generally not covered by Medicaid. Audio-only visits can be billed with CPT modifier 93 for certain services, with the specifics varying by service category. Providers using audio-only technology where permitted still owe HIPAA compliance when the phone system uses electronic transmission like Voice over Internet Protocol; a traditional landline is outside the HIPAA Security Rule because it does not transmit electronic data.

Privacy, HIPAA, and Penalties

HIPAA’s Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, meaning encryption in transit and at rest, access controls, audit logging, and workforce training.¹⁴ Rule 360-3-.07 reinforces the point by requiring telemedicine practitioners to keep records to Board standards and use communication channels that meet HIPAA requirements.²

Federal penalties under 45 C.F.R. § 160.404 are tiered by culpability, running from a floor of $100 per violation for unknowing violations to a minimum of $50,000 per violation for willful neglect that goes uncorrected, with calendar-year caps at the statutory base level reaching $1.5 million per violation category.¹⁵ Those amounts are adjusted upward each year for inflation; the 2026 figures are higher than the base statutory amounts. State attorneys general can impose their own fines up to $25,000 per violation category per year. Regular risk assessments and updated security protocols are the most practical defense.

Insurance Coverage and Reimbursement

The Georgia Telehealth Act requires every health benefit policy issued, amended, or renewed in the state to cover services delivered by telemedicine if the same services would be covered in person.¹ The statute defines telemedicine as healthcare delivered through audio, video, or data communications during a medical visit and explicitly excludes standard telephone calls, faxes, and unsecured email. Private insurers must cover qualifying telemedicine on the same terms as in-person care, so long as the services are medically necessary and the provider is acting within scope.

Georgia Medicaid reimburses telehealth using real-time interactive audio and video between provider and patient. Synchronous communication is required; telephone conversations, plain email, faxes, video cell phone calls, and unsecured web-based platforms do not qualify.¹⁰

Medicare beneficiaries can receive telehealth from anywhere in the United States through December 31, 2027, without the older rural-area or qualifying-facility requirement. On January 1, 2028, geographic and originating-site restrictions return for most services, though behavioral health telehealth remains exempt.¹⁶ Practices that see Medicare patients remotely should mark that 2028 date now.

Malpractice Coverage

Georgia requires healthcare providers in certain programs to carry professional liability insurance at minimum levels. Physicians must carry $1 million per occurrence and $3 million in aggregate, with limits that may not be shared across practitioners. Nurse practitioners, physician assistants, and other mid-level providers must carry the same per-occurrence minimum, though their aggregate limits may be shared. Allied health professionals such as physical therapists and occupational therapists are not required to carry malpractice coverage.¹⁷

Confirm in writing that your policy covers telemedicine encounters. Remote care carries risks a standard office policy may not contemplate: a dropped video connection during a critical assessment, a misdiagnosis where hands-on examination wasn’t possible, a technology failure that delays care. Not every policy responds to these scenarios without an endorsement, and adding one is often free or a modest premium change. It is much cheaper to confirm coverage before your first virtual patient than after a claim.

1
Justia. Georgia Code 33-24-56.4 – Short Title; Definitions
2
Legal Information Institute (LII). Georgia Comp. R. and Regs. R. 360-3-.07 – Practice Through Electronic or Other Such Means
3
Georgia Composite Medical Board. Georgia Composite Medical Board
4
Georgia Composite Medical Board. Fee Schedule
5
Georgia Composite Medical Board. Continuing Education and Other Required Training for Physicians
6
Justia. Georgia Code 43-34-31.1 – Licensing of Telemedicine Practitioners
7
Legal Information Institute (LII). Georgia Comp. R. and Regs. R. 360-2-.17 – Requirements for Telemedicine Licensure
8
Georgia Composite Medical Board. APRN Protocol Registration
9
Justia. Georgia Code 43-34-301 – Enactment; Text of Compact
10
Georgia Department of Community Health. Telehealth Guidance Q1 – January 2026
11
Georgia Composite Medical Board. Board Extends Tele-Prescribing Flexibility Until May 1
12
Georgia Department of Public Health. Prescription Drug Monitoring Program
13
Federal Register. Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Substances
14
HHS.gov. The Security Rule
15
eCFR. 45 CFR Part 160 Subpart D – Imposition of Civil Money Penalties
16
CMS. Telehealth FAQ – Updated 02-26-2026
17
Georgia MMIS. CVO Professional Liability Insurance (PLI) Policy