Business Rules - Telemedicine Compliance

> Legal/medical note: This section is descriptive and informational. > It does not constitute operational medical advice, remote diagnosis, or legal advice. > Always consult a qualified professional before making operational decisions. > Governing reference: HIPAA Privacy Rule (45 CFR Part 164, 2023); Texas TRAIGA (eff. 2026); Ryan Haight Act (2008).

This document lists the invariant business rules of the telemedicine compliance domain, from the perspective of a telehealth platform builder. Each rule describes the compliance process (consent, license verification, audit, media privacy), not a clinical instruction. Identified with BR-NNN codes.

---

Code: BR-001 Name: Every remote consultation requires recorded consent Description: In the telemedicine domain, the platform must capture and track patient consent for telehealth services before the session starts. Many states require explicit consent separate from in-person visits. Motivation: Ensure transparency and validity of data processing and the session. Priority: CRITICAL Actors: Patient, Telehealth Platform, Attending Physician Traceability: 45 CFR § 164.508 (2023); glossary "Consent Management".

---

BR-002 - Cross-state physician license verification

Code: BR-002 Name: The physician must be licensed in the patient's state at the time of visit Description: The platform must capture the patient's location at session start, verify the physician's license in that jurisdiction, and block or alert if the physician is not licensed. This is a process description, not advice on a specific license. Motivation: Comply with state licensing requirements for remote delivery. Priority: CRITICAL Actors: Attending Physician, Telehealth Platform Traceability: state telehealth laws; glossary "Cross-State Licensing", "IMLC".

---

BR-003 - Media encryption in transit

Code: BR-003 Name: Audio/video streams are end-to-end encrypted in transit Description: The domain requires WebRTC media protected with DTLS-SRTP and signaling with TLS/WSS. Transmitting session content (PHI) unencrypted is described as a reportable incident. Motivation: Satisfy the HIPAA Technical Safeguard for PHI transmitted over networks. Priority: HIGH Actors: Telehealth Platform, Media Server Traceability: 45 CFR § 164.312(e) (2023); glossary "DTLS-SRTP", "WebRTC".

---

Code: BR-004 Name: No session is recorded without explicit patient consent Description: Audio/video recording is PHI: it must be preceded by explicit consent, stored encrypted with access controls, and retained per state medical-records law. Motivation: Protect patient privacy and retention compliance. Priority: HIGH Actors: Patient, Telehealth Platform Traceability: 45 CFR § 164.508 (2023); glossary "Session Recording".

---

BR-005 - Assessment gate for controlled-substance prescribing

Code: BR-005 Name: Telemedicine controlled-substance prescribing meets legal requirements Description: The process provides a gate enforcing the Ryan Haight Act in-person evaluation requirement, absent documented exceptions, and strong authentication (IAL2+, EPCS) where required. The description is not a clinical prescribing instruction. Motivation: Comply with DEA and controlled-substance legal requirements. Priority: CRITICAL Actors: Attending Physician, Telehealth Platform, PDMP Traceability: Ryan Haight Act (2008); 21 CFR Part 1311; glossary "Ryan Haight Act", "E-Prescribing", "IAL".

---

BR-006 - Append-only audit trail of session and PHI access

Code: BR-006 Name: Every session event and PHI access is logged immutably Description: The platform must log session lifecycle events, all PHI accesses (who/when/which record), and authentication events in an append-only audit trail. Motivation: Enable reconstruction and HIPAA compliance audits. Priority: HIGH Actors: Audit Logging System, Auditor Traceability: 45 CFR § 164.312(b) (2023); glossary "Audit Trail".

---

BR-007 - Patient identity verification at entry

Code: BR-007 Name: Participant identity is verified before granting session access Description: The process requires the session token to be bound to the scheduled patient identity; for high-assurance scenarios (controlled substances) IAL2 remote identity verification with document proofing is described. Motivation: Prevent unauthorized session and PHI access. Priority: HIGH Actors: Patient, Telehealth Platform Traceability: NIST SP 800-63A; glossary "Patient Identity Verification", "MFA".

---

BR-008 - Disclosure of AI use on session content

Code: BR-008 Name: AI processing of session content requires consent and disclosure Description: Ambient Clinical Intelligence tools processing audio/video handle PHI: the domain requires a BAA with the AI vendor, explicit patient consent, and physician review of generated notes before they enter the record. State law may mandate AI disclosure. Motivation: Transparency and patient protection in clinical AI use. Priority: MEDIUM Actors: Patient, Attending Physician, ACI Vendor Traceability: Texas TRAIGA (eff. 2026); FTC Act; glossary "Ambient Clinical Intelligence (ACI)".