Asynchronous Telehealth Documentation Requirements

Asynchronous telehealth, also called store-and-forward, is exactly what it sounds like: a provider reviews recorded health data, images, video clips, EKGs, whatever, after the fact, without the patient on the line. That time gap is the whole story of this piece. Because nobody is live on a call asking follow-up questions, the documentation has to do something synchronous visits never require it to do: stand in for the entire clinical encounter, alone, without backup.

That's the throughline for everything below. Get the documentation wrong and the claim doesn't just risk denial, it risks looking, to an auditor, indistinguishable from a telephone call that got miscoded as an office visit, which happens to be one of the exact errors the HHS Office of Inspector General has already flagged. Store-and-forward, for the record, does not include telephone calls, faxed images, texts without visual review, or plain email. Those are separate animals, coded and documented differently, and conflating them is where a lot of this trouble starts.

The federal and state coverage landscape that shapes which async requirements apply to a given encounter

Medicare, oddly enough given how much telehealth policy runs through it, is the strictest payer here. Under 42 CFR Sec. 410.78, Medicare covers store-and-forward services only at originating sites tied to federal telemedicine demonstration programs in Alaska or Hawaii. That's it. Everyone else is out of scope by default, which surprises providers who assume "telehealth flexibility" means blanket coverage.

The Consolidated Appropriations Act, 2026 (H.R. 7148), signed February 3, 2026, extends most Medicare telehealth flexibilities through December 31, 2027, including audio-only coverage and the waiver of the in-person visit requirement for initial behavioral and mental health telehealth. None of that extension touches the store-and-forward restriction, though. That one stays put, demonstration programs only, so providers hoping the 2026 law quietly opened the door for async billing under Medicare should stop hoping.

State Medicaid is where the real action is. Thirty-seven states cover store-and-forward services through Medicaid, which makes state policy, not federal policy, the operative rulebook for most providers doing async work. Private payers add another layer: 44 states, D.C., Puerto Rico, and the Virgin Islands have laws addressing private payer telehealth reimbursement as of the CCHP Fall 2025 update, and payment parity requirements exist in 24 states and Puerto Rico, with 23 states fully implementing parity, 5 with caveats, and 22 states requiring none at all (per Manatt, November 2025).

New York's Medicaid program offers a useful illustration of how granular this gets. Its 2026-V2 Provider Policy Manual treats store-and-forward as its own defined modality, with billing rules and modifiers separate from telemedicine, telephonic, and remote patient monitoring. A documentation checklist built for Medicare simply will not transfer to a New York Medicaid claim, and it definitely won't transfer to a private payer's contract terms. Calibration by payer isn't optional here, it's the baseline.

What every async encounter record must contain, element by element

Start with modality identification, because this is the one auditors circle first. The record has to say, explicitly, that the encounter was asynchronous store-and-forward, not synchronous, not telephonic. "Telehealth" as a catch-all term doesn't cut it. If a visit starts as video and drops to audio-only because the connection failed, the documentation needs to capture that switch and the billing needs to follow the modality that actually happened, not the one that was planned.

Then there's the media itself. What got transmitted, digital images, video clips, x-rays, MRIs, EKGs, EEGs, audio clips, documents, matters because the file type determines which codes even apply. For G2010 specifically, the remote evaluation of pre-recorded media, the record must show the patient was established, that an interpretation actually happened, and that follow-up occurred within 24 business hours. Miss that follow-up window and the code doesn't hold up.

Patient location and provider location are two separate fields that both need to show up, and providers routinely forget one or the other. Patient location determines originating site eligibility under Medicare and most state Medicaid programs, so a missing address or setting can sink an otherwise clean claim. Provider location matters too, home, office, temporary site, even though CMS doesn't require a home address on Medicare enrollment for practitioners working remotely. The encounter record still needs it.

Informed consent deserves its own paragraph because it trips up more practices than almost anything else on this list. Nearly every payer requires it before any telehealth service, and the prevailing standard is reconsent at every single encounter, not just the first one. Many state Medicaid programs write consent requirements to include the form of consent obtained before the service, a copy kept in the medical record, and availability to the patient or their representative on request. Some categories, like telemonitoring under Home Health, require written consent specifically, so a verbal note won't satisfy every service line.

Beyond that, the clinical content has to actually read like a clinical encounter: chief complaint, pertinent history, exam findings or data reviewed, and critically, the medical decision-making. That's the provider's reasoning, connecting the transmitted data to a diagnosis and a plan. Skip that reasoning and the record becomes a data dump, not an encounter, which is a distinction auditors care about a great deal. Round it out with the diagnosis, a stated justification for using telehealth instead of an in-person visit, the date of service, provider name, and place of service.

Time matters too. Total time on the encounter needs recording, and some payers want start and stop times specifically. For the e-visit codes (CPT 99421 through 99423), billing runs on cumulative time across a seven-day window, which means the record has to reflect an accumulation, not a single sitting.

How the billing codes for async services map to what the documentation must prove

Modifier GQ signals store-and-forward on a claim, but what it certifies depends entirely on the payer. Under Medicare, applying GQ certifies the data came from a federal demonstration site in Alaska or Hawaii, full stop. California Medi-Cal uses GQ differently, applying it to async services billed from the distant site, and the modifier doesn't change the payment rate there, it just makes the claim legible as async in the first place. Place of Service codes need to match too: POS 02 for telehealth not at the patient's home, POS 10 for telehealth at home. If the documented patient location says "home" and the claim says POS 02, that's a mismatch waiting to be flagged.

G2010 has some sharp edges worth knowing. It only applies to established patients, never new ones, and the record needs to prove that established relationship exists. It also can't be billed when the service follows a related E/M visit within the prior seven days, or precedes one within 24 hours or the next available appointment. Miss either window and the code doesn't apply, no matter how good the interpretation was.

E-visit codes have their own logic. 99421 covers 5 to 10 cumulative minutes over seven days, 99422 covers 11 to 20, 99423 covers 21 or more, with G2061 through G2063 running the same tiers for therapy disciplines. The visit has to be patient-initiated, and that origination needs to show up in the documentation. One report per seven-day period, and, similar to G2010, no billing when it originates from a related E/M in the prior week or during a related postoperative period.

2026 brought a real fork in the road for coding. Telephone visit codes 99441 through 99443 were deleted January 1, 2025, and they simply don't pay in 2026, so any claim still leaning on them is dead on arrival. The AMA rolled out a new telehealth E/M family, CPT 98000 through 98016, mirroring the standard office visit logic based on medical decision-making or total time. CMS, however, chose not to reimburse most of that new 98000 series under Medicare for 2026. So there are now AMA-recognized codes and CMS-payable codes, and they don't fully overlap, which means picking the wrong one isn't a technicality, it's a denied claim.

Where async documentation requirements diverge from standard E/M documentation in 2026

The 2026 E/M guidelines refine how problems addressed, data reviewed, and risk are weighted in medical decision-making. For async encounters, all three of those elements have to be reconstructed entirely from the transmitted record, with no real-time exchange to fill gaps. That makes explicit documentation of each element more load-bearing in an async chart than in a face-to-face one, where a provider can ask one more question if something's unclear.

Time-based coding now counts work before and after the actual encounter, reviewing records, coordinating with other providers, documentation time on the date of service. The record needs to show what work happened and on which date of service, not just that it happened.

New patient documentation got tighter in 2026, requiring proof that appropriate history was gathered and that initial treatment decisions came from that data. This closes a door rather than opening one: G2010 already excludes new patients, and e-visit codes require an established relationship, so async billing pathways for first-time encounters are effectively shut.

Audio-only and async are not the same thing, and 2026 draws that line harder with new reimbursement limitations specific to audio-only visits. Documenting a store-and-forward encounter as "audio-only," or the reverse, reproduces the exact miscoding pattern the OIG already called out. It's worth repeating because it's an easy mistake to make when templates use loose language.

Geographic restrictions are back too, in modified form, requiring documentation of patient location relative to metropolitan statistical area or rural Health Professional Shortage Area status. Exceptions exist for mental health, substance use disorder, ESRD home dialysis, and acute stroke care, and when a patient doesn't sit at a qualifying facility, the record should name which exception applies rather than leaving that connection implied.

HIPAA and records-retention obligations that apply specifically to async documentation

Everything transmitted in an async encounter, recorded video, images, audio clips, asynchronous messages, is electronic protected health information the moment it's created or received. That means encryption at rest, access controls, and audit logs aren't nice-to-haves, they're the price of admission.

The proposed HIPAA Security Rule update circulating in 2024 and 2025 pushes further, with stronger requirements around remote access security, multi-factor authentication, encryption standards, and keeping an actual inventory of technology assets. All of that lands directly on how async records get stored and who can reach them.

Here's a detail that trips practices up: standard consumer platforms touching async telehealth data require a Business Associate Agreement covering that specific function. Any platform touching async telehealth data now needs a BAA covering that specific function, and that requirement extends to cloud storage vendors, EHR systems, and any third-party service that forwards or analyzes images, even ones that hold their own encryption keys.

State law can override the federal floor, too. Where a state's privacy law grants patients broader rights or sets a longer retention period than HIPAA requires, the state law governs, not HIPAA's minimum. And the minimum necessary standard applies here just as it does everywhere else in health data: retain only what's actually needed for clinical decision-making, because every extra media file kept "just in case" is both a HIPAA exposure and an audit liability nobody asked for. Risk analysis, workforce training, and documented async-specific policies round out the administrative side, and yes, auditors do ask to see those, not just the clinical chart.

Building a documentation workflow that reliably captures every required element before the claim is submitted

Most async documentation problems aren't fabrication, they're omission. Providers who know the rules cold still forget to log patient location or explicitly name the modality, not because they don't understand the requirement but because nothing in their workflow stops them and asks. That's a design problem, not a training problem, and it's worth treating it that way.

The fix is mechanical: build hard-stop fields into the async encounter template so the chart cannot close without the key documentation elements each payer requires. A field that can be skipped will be skipped eventually, usually on the one visit an auditor decides to pull. Templates that force the issue at the point of documentation, rather than relying on memory or a training session from eighteen months ago, are the difference between a defensible chart and a guessing game.

None of this is glamorous work. Nobody goes into medicine dreaming of POS code accuracy. But the async encounter record is, in a very literal sense, the entire visit, there's no live conversation to fall back on if the chart comes up short. Get the elements down consistently, and the same documentation that keeps an auditor satisfied also keeps the next provider looped in and the reimbursement intact. That's not a bad return for filling out a few extra fields.