Telehealth for Post-Op Follow-Up: Compliance and Reimbursement Rules
Telehealth post-operative follow-up visits became standard practice during COVID-19 and have continued under evolving CMS and state regulations. Providers conducting virtual post-op visits must navigate reimbursement codes, documentation requirements, state licensure rules, and HIPAA-compliant technology mandates. This guide covers the current regulatory framework for telehealth-based surgical follow-up as of 2026.
CMS Reimbursement for Telehealth Post-Op Visits
CMS reimburses telehealth post-operative visits under the same E/M codes (99212 to 99215) as in-person visits when conducted via real-time audio-video technology. Place of service (POS) code 10 (telehealth provided in patient's home) applies for most post-surgical follow-ups. The Consolidated Appropriations Act of 2023 (Section 4113) extended Medicare telehealth flexibilities through December 31, 2024, and the CMS CY2025 Physician Fee Schedule Final Rule further extended many of these provisions.
Post-operative visits within the global surgical period (10-day or 90-day) are bundled into the surgical payment and are not separately billable, whether conducted in person or via telehealth. However, if a post-op complication requires evaluation beyond the scope of the original procedure, modifier 24 (unrelated E/M during the post-op period) allows separate billing. Document the distinct clinical reason thoroughly.
Audio-only telephone visits (CPT 99441 to 99443) are reimbursed by Medicare when audio-video is not feasible for the patient. CMS requires documentation of why audio-video was not available (patient lacks device, broadband, or digital literacy). Audio-only visits are reimbursed at approximately 85% to 90% of the audio-video rate. Many commercial payers now also cover audio-only post-op follow-ups, though policies vary.
Remote patient monitoring (RPM) codes 99453, 99454, 99457, and 99458 can supplement telehealth visits for post-surgical patients using connected devices (blood pressure cuffs, pulse oximeters, wound cameras). RPM requires at least 16 days of data collection within a 30-day period and 20 minutes of clinical staff time reviewing and responding to data per month.
State Licensing and Telehealth Prescribing Rules
Surgeons must hold an active medical license in the state where the patient is physically located at the time of the telehealth visit, not where the surgeon's office is located. The Interstate Medical Licensure Compact (IMLC) allows expedited licensure across 42 member states and territories as of 2025, but it does not create a single multistate license. Each participating state issues its own license through the compact.
Prescribing controlled substances via telehealth requires compliance with both the Ryan Haight Act (21 USC 831) and the DEA's post-PHE telehealth prescribing rules. The DEA's final rule effective November 2025 allows initial prescribing of Schedule III through V controlled substances via telehealth without an in-person exam, but Schedule II medications (oxycodone, hydromorphone) require an in-person evaluation or a referral from a DEA-registered provider who examined the patient in person.
State-specific telehealth consent requirements vary. At least 37 states require documented informed consent for telehealth, with some mandating written consent and others accepting verbal consent documented in the medical record. The American Medical Association recommends obtaining and documenting consent before the first telehealth encounter, including an explanation that the visit is being conducted remotely, potential limitations, and the patient's right to request an in-person visit.
Several states (Texas, Georgia, Arkansas) maintain restrictions on establishing a new patient-provider relationship via telehealth alone. Surgeons should verify whether their state allows telehealth-only relationships or requires at least one in-person visit. Post-operative follow-ups for established surgical patients are broadly permitted across all states.
Documentation and HIPAA Requirements
Telehealth post-op visit documentation must include: the patient's location (city and state), the technology platform used, confirmation that audio-video (or audio-only with justification) was used, the clinical assessment performed, and the plan of care. CMS audits require the same level of documentation as in-person visits. Missing location documentation is the most common telehealth billing deficiency identified in OIG audits.
The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires that telehealth platforms used for post-operative visits include end-to-end encryption, access controls, and audit logging. The platform vendor must sign a Business Associate Agreement (BAA). Consumer video tools (FaceTime, regular Zoom, Google Hangouts) do not meet HIPAA requirements. HIPAA-compliant options include Zoom for Healthcare, Doxy.me, Doximity Video, and Teladoc.
Wound assessment via telehealth requires adequate image quality. The American Telemedicine Association's dermatology practice guidelines recommend minimum 12-megapixel images with consistent lighting for wound evaluation. Instruct patients to photograph the wound with a ruler or coin for scale, in natural light, from a distance of 6 to 12 inches. Document the image quality and any limitations noted during visual assessment.
Store telehealth session recordings only if your organization's policy requires it. Many states have wiretapping and recording consent laws that apply to telehealth (for example, California Penal Code Section 632 requires all-party consent). If recordings are stored, they become part of the medical record and must meet the same retention requirements as in-person visit documentation.
Clinical Best Practices for Virtual Post-Op Visits
Pre-visit preparation improves telehealth efficiency. Send patients a checklist 24 hours before the visit: take and upload wound photos, record temperature and pain level, list current medications and any new symptoms, and confirm their device and internet connection. The American College of Surgeons recommends structured pre-visit questionnaires that allow the surgeon to review patient-reported outcomes before the video call begins.
Establish clear criteria for when a telehealth post-op visit must convert to in-person evaluation. Red flags include: wound dehiscence or signs of deep infection (patient reports increasing redness, swelling, warmth, or purulent drainage), unexplained fever above 101.5 F (38.6 C), new neurological deficits after spine or brain surgery, and any complication that requires physical examination or procedural intervention.
Patient satisfaction with telehealth post-op visits is consistently high. A 2023 study in the Journal of the American College of Surgeons (JACS) analyzing over 40,000 surgical follow-up encounters found no significant difference in 30-day complication detection rates between telehealth and in-person post-operative visits across general surgery, orthopedics, and urology. Patient no-show rates were 50% lower for telehealth appointments.
For practices new to telehealth post-op visits, the American College of Surgeons' Return to Work After Surgery guidelines recommend starting with low-risk follow-ups (suture removal assessment, wound checks, activity clearance) and expanding to complex visits as the team builds workflow proficiency. Designate one staff member as the telehealth coordinator to manage technology setup, patient instructions, and documentation compliance.
Can I bill separately for a telehealth post-op visit during the global surgical period?
No. Post-operative visits included in the 10-day or 90-day global surgical period are not separately billable regardless of whether they occur in person or via telehealth. The visit format does not change the global period bundling rules. The exception is if the visit addresses a problem unrelated to the original surgery (use modifier 24) or if a complication requires a return to the operating room (use modifier 78 or 79). Document the distinct clinical reason clearly to support the modifier.
Is FaceTime HIPAA-compliant for post-op telehealth visits?
No. Apple FaceTime does not offer a Business Associate Agreement (BAA), which is required under the HIPAA Security Rule for any platform handling protected health information. During the COVID-19 Public Health Emergency, the HHS Office for Civil Rights issued enforcement discretion allowing non-compliant platforms, but that discretion expired. Use a platform that provides a signed BAA, end-to-end encryption, and audit logging, such as Zoom for Healthcare, Doxy.me, or Doximity Video.
Do I need a separate state license to see my post-op patient via telehealth if they traveled home to another state?
Yes. You must hold an active medical license in the state where the patient is physically located at the time of the telehealth visit. If your patient had surgery in your state but returned home to a different state for recovery, you need a license in their home state to conduct the follow-up. The Interstate Medical Licensure Compact (IMLC) offers expedited multi-state licensure across 42 participating jurisdictions. Some states offer temporary telehealth practice permits for established patient relationships.
Can I prescribe opioid pain medication refills via telehealth post-op visit?
For Schedule III through V medications (tramadol, acetaminophen with codeine), the DEA's post-PHE final rule allows telehealth prescribing without a prior in-person exam. For Schedule II opioids (oxycodone, hydromorphone, hydrocodone combination products reclassified under state law), the DEA requires either a prior in-person examination or a referral from a DEA-registered practitioner who has examined the patient in person. Since post-operative patients have already been examined in person for their surgery, surgeons can generally prescribe refills of Schedule II medications via telehealth follow-up within the established patient relationship.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
