by Ann L. McNary, JD

Ms. McNary is Senior Risk Manager at Professional Risk Management Services (PRMS).

Funding: No funding was provided for the preparation of this article.

Disclosures: The author is an employee of PRMS. PRMS manages a professional liability insurance program for psychiatrists.

Innov Clin Neurosci
. 2022;19(4–6):87–89.

This ongoing column is dedicated to providing information to our readers on managing legal risks associated with medical practice. We invite questions from our readers. The answers are provided by PRMS (, a manager of medical professional liability insurance programs with services that include risk management consultation and other resources offered to health care providers to help improve patient outcomes and reduce professional liability risk. The answers published in this column represent those of only one risk management consulting company. Other risk management consulting companies or insurance carriers might provide different advice, and readers should take this into consideration. The information in this column does not constitute legal advice. For legal advice, contact your personal attorney. Note: The information and recommendations in this article are applicable to physicians and other health care professionals so “clinician” is used to indicate all treatment team members.


Prior to the COVID-19 pandemic, I prided myself on having an extremely organized and well-run practice, but I have to confess, during the last two years, I have let a few things slide. Now that we’re finally seeing light at the end of the tunnel, I would like to get back to my previous good habits. Any suggestions for accomplishing this? 


In the past two years, clinicians have had to completely rethink the way they practice. They’ve learned, or become more proficient in, different technologies. They’ve navigated changes in licensure and other regulatory requirements. They’ve dealt with heartbreaking losses in their lives and those of their patients. In short, they’ve done whatever needed to be done to adapt and keep going in unprecedented times. 

For some, this meant deciding to give up the expense and hassle of working in an office in favor of practicing telehealth from their home. Others have elected to cut back on their hours or to close their practices entirely and join a group. Still others have realized that there are particular conditions they have a special interest in treating or types of patients/situations that they want to avoid going forward. Even if you haven’t made dramatic changes yourself, you’ve no doubt been reminded of the unpredictability of life and practice.

While we are not out of the woods, as you said, there does appear to be light at the end of the tunnel. As you look forward to the rest of 2022 and think about preparing for your post-COVID-19 clinical practice, here are a few suggestions for getting back on track.

1. Get control of your charts. Those of you who have temporarily given up office space or relocated completely may have been forced to make hasty arrangements for your charts. If you’ve left part of them behind as you work out of a temporary space or have boxes stuck in your basement, now is the time to organize them. Make sure you know where all the charts are located, determine whether older charts may be destroyed, and ensure everything you keep is securely stored. Your state will likely have laws specifying the minimum amount of time for record retention. You should also check with your malpractice carrier, as they may recommend a longer retention period than that which is required under state law. If you will be storing charts in your home, you should take steps to ensure their security and integrity. Ideally, charts should be maintained in a locked cabinet in a locked room and protected from flooding, placed off the floor and away from water pipes. If you need to move records to off-site storage, look for a company that has experience in storing medical records. If you are a Health Insurance Portability and Accountability Act of 1996 (HIPAA)-covered entity, you must have a business associate agreement in place with the record storage company. For additional information, see “Maintenance and Destruction of Treatment Records.”1

2. Determine who your active patients are. Since the onset of the pandemic, a number of your patients have likely fallen out of treatment due to relocation or changes to their financial situations or health insurance plans. You’ve likely also had a few patients who saw you remotely for a visit or two who didn’t follow through with treatment. In order to ensure that there is a clear understanding between yourself and the patient as to the status of your relationship, consider sending them a letter to either confirm their decision to end treatment or make them aware that their chart will be closed if you do not hear from them within a given timeframe. As clinicians are required to give patients notice (typically 30 days) prior to terminating a treatment relationship and provide them with suggestions for finding follow-up treatment, it is important to distinguish this letter from a termination later. Here, it would not be you terminating treatment, but rather you expressing your understanding of the status of the relationship and asking the patient to notify you if you are incorrect. For example, you might say, “Your last appointment was on X-date. As you have not scheduled a follow-up appointment or responded to my attempts to reach you, it is my assumption that you have elected not to continue our treatment relationship. If this is not correct, please contact me by Y-date, otherwise, I will close your file.” Check with your malpractice carrier for further guidance and to see if they have sample letters for you to use.

3. Provide notification of your change of address. If you have permanently relocated, make certain all necessary parties are made aware of your new practice address. It is not enough to change your address at the post office; there are certain entities that you must notify directly, for example, your state licensing board, the United States (US) Drug Enforcement Administration (DEA), health insurance plans, and your malpractice carrier. Those who are now practicing out of their homes may be reluctant to have their home address listed as their practice address and instead may want to list PO boxes or utilize entities, such as a United Parcel Service (UPS) store, that allow small businesses to have a real street address. Be aware that this may not be acceptable. The DEA, for one, requires that a registered address be the physical location of your principal place of business or professional practice. A PO box alone is not allowed as a registered address.2 Also, don’t forget to change your address on sites you use for professional advertising. We are aware of a situation where a former landlord attempted to file suit against a physician who moved from the building but did not change his address with Psychology Today, the medical board, and others. The landlord claimed that the doctor had benefitted financially from being attached to such a prestigious address and as such owed him back rent!

4. Organize your workspace. Get your remote practice set up for the long haul if you haven’t already done so. If you are working from home, find space set off from your main family areas to protect patient privacy. Ensure that you have a place with good lighting and minimal background noise. During the public health emergency (PHE), the US Department of Health and Human Services (HHS) has waived the requirement that telehealth platforms be HIPAA-compliant. It is expected, however, that this requirement will be re-instated once the PHE has expired. If you have not already done so, and you anticipate continuing to treat via telehealth, invest in a system that meets HIPAA requirements. (Note, no matter what the vendor tells you, if they do not offer a business associate agreement, they are not HIPAA-compliant.) Consider what other equipment may be useful, such as headphones, a webcam, a printer/scanner, or a separate monitor to view records during sessions.

5. Plan for in-person appointments. If you are unable to see patients in person at your current practice location, make arrangements to borrow space from a colleague in the event a face-to-face visit is needed at some point in the future. During the PHE, the DEA has waived the requirement of the Ryan Haight Act for an in-person visit prior to prescribing a controlled substance; however, it is anticipated that this requirement will be reinstated once the PHE has expired. Many individual states follow this rule as well. Beyond the need to satisfy prescribing requirements, there may also be other patients for whom you believe an occasional face-to-face appointment would be beneficial. If you do not have a colleague with extra space, consider seeing if your local hospital can accommodate you. 

6. Review your practice forms. Make sure your practice forms are up-to-date, and include a consent for telehealth if you are seeing patients remotely. In some states, a specific consent for telehealth treatment is required. Even in those states where it is not, it is still useful to alert patients to both the benefits and limitations of telehealth and to manage expectations; for example, the potentiality that an in-person visit may be required to comply with state and/or federal prescribing requirements or to appropriately manage their particular condition. 

7. Determine licensure rules for other states. If your patient population includes those who live in other states whom you will be treating remotely, make sure you meet the legal requirements for treating patients via telehealth in each patient’s state. Depending upon the state, this may mean a full license or a telehealth certificate, or there may be statutory provisions that allow the limited practice of telehealth without a license or certificate. Although most states had some type of licensure waiver during the height of the PHE, the majority of these waivers have either ended or are ending soon. To determine what is required, contact the licensing board in each state in which you will be treating patients outside of your home state. It is a good idea to communicate with them via email, as this will provide you with written documentation of what information you were given and by whom. Written communication also helps to ensure that there is no misunderstanding regarding what you are asking to do and what you are being told is permissible.

8. Get up to speed on state laws governing clinical practice. Along these same lines, make sure you know the laws and regulations governing clinical practice in each state in which you will be seeing patients. Individual state licensing boards typically have this information on their websites. What laws you are subject to will likely be tied to licensure status. For example, someone practicing telehealth with a full license will typically be required to comply with all state laws as they would do were they physically located in the state, while someone practicing under a telehealth certificate or a statutory exception would likely have fewer requirements. Laws you may be required to comply with include those relating to:

  • Prescribing of controlled substances
  • Accessing the state’s prescription monitoring program
  • Reporting requirements
  • Responding to subpoenas
  • Continuing Medical Education (CME) requirements
  • Documentation standards
  • Record retention rules

9. Don’t forget about the DEA. Make sure you are compliant with DEA regulations regarding the prescribing of controlled substances in all states in which you are practicing. As stated previously, during the PHE, the DEA has waived the requirement of the Ryan-Haight Act that there be one in-person visit prior to prescribing controlled substances, but it is likely that this rule will be re-instated post-PHE. There is also the question of whether there will be a need for separate DEA registrations in each state, which the DEA has yet to answer.

10. Have a contingency plan. The pandemic has taught us that we need to be prepared for the unexpected. To this end, think about developing a contingency plan to allow someone to either take over your practice during your unexpected absence or shut it down completely in the event you are not able to return. At minimum, you should ensure that someone else would know how to access your system to find your calendar and the information to notify patients of your absence, and also to provide records as needed for subsequent treatment. If this individual is not another clinician or trained staff member, they may not appreciate the need for confidentiality, so as part of their instructions, make certain they have the phone number for your malpractice carrier, who can assist them. Your patients, staff, and family will appreciate any advanced planning you can do. For more information see “Exit Strategy: Planning for the Unexpected Closure of Your Practice.”3

 11. Take care of you. Finally, make it a point to tend to your own health and wellbeing. It’s been a long two-plus years, and mental health practitioners have had a particularly tough time of it. So, schedule those doctor’s appointments you’ve been putting off, and if you’re able, take a break from your practice, give yourself a chance to recharge, and get ready for better times ahead.


  1. McNary AL. Maintenance and destruction of treatment records. Innov Clin Neurosci. 2021;18(4–6):44–47. 
  2. United States Drug Enforcement Administration. Registration Q&A. Accessed 12 May 2022.
  3. McNary AL. Exit strategy: planning for the unexpected closure of your practice. Innov Clin Neurosci. 2016;13(5–6):81–82.