Mental Health Telehealth Standards · ISO 13131 · ISO 7101
Mental health telehealth standards stopped being a philosophical question on 1 January 2026 and became a calendar problem. The federal flexibility that lets a clinician prescribe controlled medications after a video visit — the arrangement most of virtual psychiatry has been built on since 2020 — expires on 31 December 2026. What replaces it is a permanent rule the DEA has been drafting for two years, and the proposed version reads like a documented management system: credentialing, identity verification, prescription documentation, record retention, and data reporting. Companies that already work to mental health telehealth standards will treat that as an administrative change. Companies that do not will spend the first quarter of 2027 discovering how much of their operation lived in somebody's head.
Direct Answer: Mental health telehealth standards are the published requirements that define what a virtual behavioral health service must actually do and document. Two matter: ISO 13131:2021 supplies telehealth-specific quality planning and risk guidance, and ISO 7101:2023 supplies the certifiable healthcare quality management system underneath it. Neither is legally mandatory in the United States, and both are about to become the cheapest way to survive what is coming.
This is written for two people. The first runs or leads a teletherapy, telepsychiatry, or digital behavioral health company and is watching a deadline approach with no framework to prepare against. The second is someone about to type their symptoms into a sign-up form for a service they have never heard of, with no way to judge whether it is any good. Those look like different problems. Mental health telehealth standards are the single answer to both, and it is the same answer ISO consulting has been giving regulated industries since the 1990s: write down how the work is supposed to happen, prove it happened that way, and let an independent party check.
The Deadline
Why Do Mental Health Telehealth Standards Suddenly Matter in December 2026?
Extended. Again. Ending.
The deadline driving interest in mental health telehealth standards has a specific history. Since March 2020, practitioners have been able to prescribe Schedule II to V controlled substances by telemedicine without an initial in-person examination. That authority has never been permanent. It has been extended by temporary rule four separate times, and the fourth temporary extension, issued jointly by the DEA and the Department of Health and Human Services, runs from 1 January 2026 through 31 December 2026.
The DEA has been explicit about what the extension is for. Legal analysis of the rule notes the agency described the year as a bridge, giving it time to promulgate a final rule and allow providers to come into compliance with any new requirements adopted in it. That second clause is the one worth reading twice. The agency is not only writing a rule. It is expecting providers to change how they operate in order to meet it, and it allocated a year for that.
Direct Answer: Mental health telehealth standards matter now because the DEA telemedicine prescribing flexibility expires 31 December 2026, and the permanent rule replacing it is expected to impose documentation, credentialing and record-keeping obligations. An organization with a management system already has the machinery those obligations require. One without it has to build the machinery and meet the deadline simultaneously.
It is worth being precise about scope, because the deadline behind mental health telehealth standards does not hit everyone equally. Therapy-only services that never touch a prescription are not directly affected by the DEA rule at all. Telepsychiatry, ADHD care, and medication-assisted treatment for substance use disorders sit squarely inside it. Even for the therapy-only side, though, the regulatory temperature of the whole sector is rising, and the argument for mental health telehealth standards does not depend on the DEA clause alone.
The Shape of the Rule
What Will the Permanent Rule Actually Require?
Document. Verify. Retain.
Nobody outside the agency knows the final text of the rule that will reshape mental health telehealth standards, and any consultant who tells you otherwise is guessing. What exists is a proposed rule, and it is a reasonable guide to the direction of travel. Published analysis of that proposal describes three special registrations creating pathways for telehealth practitioners to prescribe and for platforms to dispense, alongside detailed requirements for practice standards, prescription information, and documentation — including prescription drug monitoring program checks, audio-video technology requirements, restrictions on Schedule II substances, data reporting to the DEA, identity verification, clinician credentialing, and record retention.
Read that list as an operations person rather than a lawyer, and it becomes a specification for mental health telehealth standards. Identity verification is a documented procedure with a record. Clinician credentialing is a documented procedure with a record. Record retention is a records table with a location, an owning role, and a retention period against every record type. Data reporting is a defined output with an owner and a frequency. Practice standards are, quite literally, documented procedures.
Every requirement in that proposed rule is something a management system already produces as a by-product. That is the entire argument for building one before the rule lands rather than after.
Direct Answer: The proposed permanent rule maps almost one-for-one onto what mental health telehealth standards already require: credentialing records, identity verification procedures, documented practice standards, defined data reporting, and a retention schedule. An organization certified to a healthcare quality management system has produced all of it already and is answering an audit question rather than starting a project.
One nuance that matters for substance use treatment: separate authorities already cover some pathways, and analysis of the fourth extension notes that audio-only telemedicine may still be used for certain opioid use disorder medications, with buprenorphine and continuity-of-care pathways carrying their own specialized conditions. If your service spans therapy, psychiatry and substance use treatment, you are operating under three overlapping regimes at once — which is precisely the situation a single documented system exists to make manageable.
The Two Documents
Which Mental Health Telehealth Standards Actually Exist?
Guidance. Requirements. Difference.
Two ISO documents make up the published mental health telehealth standards, and almost every article on this subject confuses them. Getting the distinction right is the difference between a certification project that works and one that produces a certificate nobody recognizes.
| Standard | What it gives you | What it is not |
|---|---|---|
| ISO 13131:2021 Health informatics — Telehealth services — Quality planning guidelines |
Processes for analysing risks to quality, safety and continuity of care when telehealth is used, plus example quality objectives and procedures for each service domain — workforce, finance, information security, infrastructure and technology. | Not a requirements standard. It is written as guidance and worked examples rather than auditable obligations, and it explicitly does not cover device manufacture or technical system management. |
| ISO 7101:2023 Healthcare organization management — Management systems for quality |
The certifiable management system: leadership, risk, competence and credentialing, service design, service user feedback, internal audit, management review, improvement. Applies to any organization providing healthcare services regardless of type or size. | Not telehealth-specific. It says nothing about video quality or connectivity, which is exactly why the two documents are used together rather than instead of each other. |
Direct Answer: Two mental health telehealth standards apply. ISO 13131 tells a telehealth service what to think about and gives worked examples; ISO 7101 is the management system you actually certify against. Use ISO 13131 to shape the content of your procedures and ISO 7101 to hold them together and prove they run.
Of the two mental health telehealth standards, ISO 13131 replaced an earlier 2014 technical specification and was aligned with ISO 9001:2015 and ISO 31000:2018 in the process, which is why it slots cleanly alongside a management system rather than competing with one. Some certification bodies do offer independent assessment against it — BSI markets exactly that — and that can be genuinely useful. But an assessment against a guidance document is a different animal from accredited certification against a requirements standard, and a sophisticated buyer will know the difference even if your marketing page does not.
The certifiable half of the mental health telehealth standards pair is ISO 7101, published in October 2023 as the first international consensus standard written specifically for healthcare quality management and developed under U.S. leadership of ISO technical committee 304. Nothing in it restricts it to buildings. A fully virtual practice is an organization providing healthcare services, and the standard says it applies regardless of type, size, or the services provided.
What Enforcement Already Shows
What Does Enforcement Tell Us About Mental Health Telehealth Standards?
Promised. Breached. Penalised.
The DEA deadline is the visible risk driving mental health telehealth standards up the agenda. The quieter one has already produced enforcement, and it is instructive because in every case the failure was a management failure rather than a clinical one.
In 2023 the Federal Trade Commission finalised an order banning BetterHelp from sharing sensitive health data for advertising and requiring it to pay $7.8 million, used to provide partial refunds to consumers. The order also barred the company from sharing personal information for re-targeting. The case record sets out the allegation: that the online counselling service revealed consumers' sensitive data to third parties after promising to keep it private.
In 2024 the FTC proposed an order against Cerebral that would permanently ban the company from using or disclosing personal and health information to third parties for most marketing purposes, generally require consent before any such disclosure, prohibit misrepresentation of its privacy and security practices, and require it to implement a comprehensive privacy and data security program. The order also addressed cancellation practices, with roughly $5.1 million allocated to partial refunds for consumers affected by them.
The pattern continued in July 2026, when the FTC, joined by two state attorneys general, filed a complaint in federal court against a major telehealth company alleging misrepresentation of how it handled consumers' health information along with deceptive billing, subscription and cancellation practices. That matter is a filed complaint rather than a finding, and it should be read as an allegation. But its existence tells you where regulator attention sits.
Direct Answer: Enforcement against virtual behavioral health has centred on privacy promises, data sharing and cancellation practices — not on clinical error. Mental health telehealth standards address exactly that territory, because a management system governs what you promise, what you actually do, and whether anyone checks that the two match.
Note what none of these mental health telehealth standards failures turned on. Not a misdiagnosis. Not a clinician acting outside scope. The failures were in the gap between what the marketing page said and what the tracking pixel did, and in a cancellation flow nobody had specified as a process with a defined outcome. Those are documented-procedure problems. A comprehensive privacy and data security program — the remedy the FTC imposed — is a management system by another name. Building it before a regulator requires it costs a fraction of building it under an order.
The Commercial Case
How Do Mental Health Telehealth Standards Let a Company Differentiate?
Claim. Evidence. Contract.
Virtual behavioral health is a crowded market selling an invisible product, which is exactly the condition mental health telehealth standards were built for. A patient cannot inspect the clinical governance the way they can inspect a waiting room, and every competitor's landing page says the same four things. Certification is the only claim in that market that costs something to make, which is the only reason it signals anything.
Four doors open when mental health telehealth standards move from intention to audited system.
Payer and employer contracts. Health plans and employee assistance purchasers run vendor qualification. Those questionnaires ask about clinical governance, incident handling, credentialing verification and data protection, and they score a documented answer above a reassuring one. This is where an uncertified service loses a renewal without ever being told why.
Health system and referral partnerships. A hospital system routing patients to an external virtual behavioral provider inherits the reputational exposure. It will ask what independent assurance exists, and a certificate from an accredited body is the shortest possible answer to a question that otherwise takes six weeks of due diligence.
Investment and acquisition. Diligence in digital health now goes hard at regulatory exposure, and for good reason. A documented system with credentialing records, incident logs, internal audit results and management review minutes shortens diligence and removes the discount a buyer applies to unquantifiable risk.
Clinician retention. The underrated one. Therapists and prescribers leave platforms where escalation paths are unclear, supervision is improvised, and nobody can tell them what to do when a session goes wrong at 9pm. Written processes are a working-conditions issue before they are a compliance issue, and in a market with a clinician shortage that is a competitive asset. MSI's implementation experience suggests this is the benefit leadership expects least and values most once it appears.
Direct Answer: Mental health telehealth standards differentiate a company because certification converts an unverifiable claim into an audited fact. The commercial returns are payer and employer contracts, health system referral partnerships, cleaner investment diligence, and clinician retention — none of which marketing copy can produce.
Beat the December deadline
The ISO 7101 Procedure Templates & Guides — every procedure the rule will ask you to produce, already written
Credentialing and privileging. Risk, clinical and non-clinical, in one register. Service design. Service user feedback with a response floor per group. Internal audit. Management review. Evaluation of compliance — the register a 7101 organization needs and the standard never tells you how to build. All in editable Microsoft Word, with the judgment calls already made and explained, annotated from 200+ audits. A virtual practice with no quality manager can work through it in weeks rather than quarters, which is the only timescale that still fits before 31 December.
Need one procedure rather than the set, or running more than one standard? The ISO Procedure Templates and Guides hub carries every standard and integrated combination, plus free maturity checks that score your own processes before you buy anything.
A personal note from Diana Lynn
My daughter is a licensed social worker. She went into this profession with more conviction than I had at her age, and I have watched what the work actually costs — the caseload that does not end at five, the client whose situation does not fit any intake category, the moment when someone is in real trouble and she is the person on the other end of the line.
What strikes me, listening to her, is how much of the difficulty is organizational rather than clinical. She is trained for the hard conversations. What wears clinicians down is everything around them: not knowing who to escalate to after hours, finding out a triage rule changed without anyone telling the people applying it, inheriting a caseload with no handover, being asked to carry a risk the organization never wrote down.
Every one of those is something a management system fixes, and that is the part leaders in virtual behavioral health should sit with. Mental health telehealth standards get pitched as a compliance purchase, and yes, they will pass an audit. But the clause requiring a tested escalation process is not really written for the auditor. It exists so the social worker on shift at nine at night knows exactly what to do — and so the person she is talking to gets an organization's response rather than one tired individual's best guess.
That is what moving the bar actually looks like. Not a better landing page. A floor under the people doing the work, which becomes a floor under everyone they serve. Leaders in this industry are in a position to put that floor in place, and most of them do not yet know the standard that describes how.
The Patient Side
What Should a Patient Ask Before Their First Session?
Ask. Verify. Decide.
Virtual behavioral health has a consumer information problem sharper than almost any other health service, and mental health telehealth standards are the only public answer to it. The sign-up flow asks about depression, suicidal thoughts and current medications before it tells you anything about who will read the answers. Federal health agencies note that telehealth for behavioral health can increase access, continuity of care, privacy and convenience while reducing barriers including fear of stigma, and that a survey of mental health treatment facilities found 80% offering care by telehealth. The access gain is real. The information asymmetry is also real, and these seven questions close most of it.
1. Is the person I will see licensed in my state, and what is their licence type? Not “a licensed professional.” A licence type and a state. Psychiatrist, psychiatric nurse practitioner, psychologist, clinical social worker and licensed counsellor carry different training and different authority.
2. Will I see the same clinician each time, and what happens if they leave? Continuity of care is a named concern in the telehealth quality guidance for a reason. Platforms with high clinician churn and no handover process restart your treatment every few months.
3. What happens in a crisis, and who is available outside session hours? A written escalation path, or an improvisation. There is no third option, and the answer arrives fast when you ask.
4. Who else sees my data, and is any of it used for advertising? This is the question the enforcement record was built on. Ask it plainly and read the privacy policy for what it permits, not what the homepage promises.
5. How do I cancel, and can you show me before I sign up? Cancellation practices have drawn regulator penalties in this sector specifically. A service confident in its process will show you the flow.
6. If I am prescribed medication, who monitors it and how often? Prescribing without a monitoring plan is the failure mode the DEA rule exists to address. Ask what the follow-up schedule is before the first prescription, not after.
7. What independent standard are you certified or assessed against, and by whom? A named standard and a named body. If the answer is a self-declared badge or a membership logo, that is still an answer.
Direct Answer: A patient can apply mental health telehealth standards without reading one by asking seven questions: clinician licence and state, continuity of care, crisis escalation, data sharing, cancellation, medication monitoring, and independent certification. Each has a documented answer in a well-run service and a deflection in a poorly-run one.
If you are experiencing a mental health crisis, do not wait on any of this. In the United States, call or text 988 to reach the Suicide and Crisis Lifeline. The questions above are for choosing an ongoing service, not for an emergency.
Operators should notice what the list implies. Six of the seven are answered by a document you either hold or do not. That is the argument for building the system before the market starts asking — and it is why how you measure service user experience matters more than an app store rating. An aggregate score can conceal the exact failure a standard exists to surface.
The Build
How Do You Build the System Behind Mental Health Telehealth Standards?
Govern. Document. Prove.
The management system behind mental health telehealth standards is not exotic. ISO 7101 follows the harmonized structure common to ISO management system standards, so a telehealth company building it acquires the same architecture that ISO 9001 gives a manufacturer, and can extend later into an integrated management system without rebuilding. Six components carry most of the weight in a virtual behavioral health setting, and each maps onto something the DEA proposal or the enforcement record has already flagged.
Credentialing and privileging. The first requirement in any set of mental health telehealth standards: who is permitted to do what, in which states, verified against what source, re-verified how often. This is the single most audit-exposed area in virtual care because clinicians are remote, multi-state, and often contracted rather than employed. “Competent by experience” with nothing on file is not a record.
Leadership and governance. A named owner for quality, a policy that commits to something specific, and a management review that examines performance rather than approving a deck. Eight clauses feed that one meeting, which is why most organizations prepare it worst.
Risk management. Clinical and non-clinical risk in one register with criteria set in advance. In telehealth the non-clinical column is unusually heavy: connectivity failure mid-session, identity verification, data sharing, and the platform outage that strands a caseload. The culture around reporting decides whether the register ever sees a real event.
Service design. New care pathways, intake flows and triage rules introduced by decision rather than by growth-team experiment. ISO 7101 puts thirteen considerations in one clause, including confirmations required before artificial intelligence informs a clinical decision — which in this sector is no longer a hypothetical.
Emergency preparedness and escalation. Written response actions, periodically tested, reviewed after every real event. For a service whose patients are sometimes in crisis and always somewhere else, this is the requirement with the sharpest consequences and the one most likely to exist only as a shared document nobody has opened.
Internal audit and improvement. Your own people testing the system before a regulator or a payer does. An internal audit program unchanged since launch is itself the finding, and a trained internal auditor is the cheapest assurance a growing company can buy.
Direct Answer: Building to mental health telehealth standards means installing six things: verified credentialing across every state you operate in, named leadership with a real management review, a combined clinical and technical risk register, a controlled service design process, tested crisis escalation, and an internal audit program that reopens when the organization changes.
Related reading
• Wellness Industry Standards: Why Proof Finally Wins
• ISO 7101 Implementation: Proven First Steps
• ISO 7101 Documentation: The Proven Order to Build It
• ISO 7101 in Action: Patient Safety and Operational Efficiency
• ISO 7101 and People-Centred Care
• Creating the Healthcare Quality Policy
• Best Practices for Quality Healthcare and Better Outcomes
• What Every Practice Owner Should Know About a QMS
• Choosing an ISO Registrar
• What Is ISO? The Standards Behind Global Trust
Score your own processes against mental health telehealth standards before spending anything. The maturity checks are free, need no sign-up, and give a straight answer: management review and leadership, competence and credentialing, emergency preparedness, service user feedback, internal audit, and compliance obligations. Each takes about five minutes.
If you would rather be taught it
Three routes into ISO 7101 — pick the one that matches who needs to understand it
A template hands you the finished document. A course walks you through why it is built that way — the better route when the people who will run the system have never worked inside one, which in a venture-built telehealth company is usually everybody.
1. Executive Brief — Healthcare QMS
The short version, for the founder, board or investor who approves the budget and will not read a standard. What a healthcare quality management system is, what it produces, and what it costs to not have one when a regulator arrives.
2. ISO 7101 Overview (HCQMS) — $497
For whoever will actually own the system. What the standard requires, what certification involves, and where a healthcare quality management system differs from the generic one your engineering team may already know. The course that stops a first-timer building the wrong thing for six months you no longer have.
3. Executive ISO 7101 Healthcare Quality Launch Program — $397
The kickoff framework MSI uses on real engagements: scope, roles, sequence, and the decisions leadership has to make in the first month. Built for the leadership team, because the implementations that stall are the ones leadership never actually started.
Training a distributed clinical team? The LearningPaths seat-based license is usually the cheaper route.
After December
What Happens to Mental Health Telehealth Standards After 2026?
Consolidate. Qualify. Compete.
Three things about mental health telehealth standards look reasonably predictable. First, whatever the DEA finalises, the compliance burden goes up rather than down — a special registration framework with credentialing and reporting obligations is a higher floor than the current flexibility, and the sector consolidates around whoever can meet it. Second, payers move faster than regulators. Coverage decisions and network qualification already carry documentation requirements, and behavioral telehealth from the home has policy support running well beyond the DEA date, which means the buyers will still be there and will still be choosing.
Third, and most relevant to how you plan: certification takes longer than compliance panic allows. Building a system, running it long enough to generate records, completing an internal audit and a management review, and then passing a two-stage certification audit takes most small to mid-sized organizations six to twelve months. Counting from today, an organization starting now is certified around the middle of 2027. One starting in January is not. The scarcity of credible mental health telehealth standards in this sector is temporary, and it is worth the most to whoever moves while it lasts.
Direct Answer: After December 2026 the compliance floor for virtual behavioral health rises and the sector consolidates around organizations that can document what they do. Mental health telehealth standards are the cheapest route to that documentation, and because certification takes six to twelve months, the decision has to be made well before the requirement lands.
One accreditation point to carry into any conversation about certifying against mental health telehealth standards. A certificate is only worth what the accreditation behind it is worth. Global Accreditation Cooperation Incorporated replaced the former International Accreditation Forum and International Laboratory Accreditation Cooperation on 1 January 2026 and now operates a single worldwide recognition arrangement. Below it sit national accreditation bodies, and below them the certification bodies that audit you. Also worth knowing: ISO/IEC 17021-1 requires certification bodies to be impartial, so the firm that helps you build the system cannot be the firm that certifies it. Anyone offering both is offering a certificate a serious payer will discount to nothing.
Size it before you commit
Find out what certification would actually take for your telehealth practice — and whether you can still make 2027
A planning session sizes the real effort: which standard fits your service mix, what you already hold that counts toward it, what genuinely has to be built, and how long it takes at your headcount and state footprint. No obligation, and if the honest answer is that you do not need a consultant, you will be told that. Call 760-434-9141 and ask for Diana. If you would rather see the delivery models first, SurePath is the turnkey route to a first certificate, SureResults runs the internal audits and management reviews year-round once you hold one, and The Portrait traces a real patient journey through every hand to find where the process actually breaks.
Answers
Mental Health Telehealth Standards: Frequently Asked Questions
Short. Direct. Useful.
Can a telehealth company be certified to ISO 13131?
Some certification bodies offer independent assessment against it, so in a practical sense yes. But ISO 13131 is written as quality planning guidance with example objectives and procedures rather than as auditable requirements, so an assessment against it is not the same instrument as accredited certification to a requirements standard. Most organizations use ISO 13131 to shape their procedures and certify to ISO 7101.
Does ISO 7101 apply to a company with no physical clinic?
Yes. ISO 7101 states that it applies to any organization providing healthcare services regardless of type, size, or the services it provides. Nothing in it requires premises. A fully distributed telepsychiatry practice is inside scope, and the credentialing and service design clauses are arguably more relevant to a virtual organization than to a hospital.
Is HIPAA compliance enough on its own?
No, and the enforcement record shows why. Several of the actions against online health services were brought by the Federal Trade Commission under consumer protection authority, not by health privacy regulators, and turned on the gap between marketing promises and actual data practices. Mental health telehealth standards cover a wider surface: clinical governance, credentialing, continuity of care, escalation and improvement, none of which HIPAA addresses.
What happens on 31 December 2026?
The fourth temporary extension of telemedicine flexibilities for prescribing controlled medications expires that day. Either a permanent rule is in force by then, a fifth extension is issued, or pre-pandemic restrictions return. The DEA has described the current year as a bridge to a final rule and said the time also allows providers to come into compliance with new requirements, so planning on the assumption of higher obligations is the prudent read.
Do mental health telehealth standards apply to a therapy-only service?
Yes, though the DEA prescribing rule does not. ISO 7101 and ISO 13131 are about clinical governance, credentialing, continuity of care, data handling and escalation, all of which apply to a service that never writes a prescription. The privacy and cancellation enforcement in this sector has fallen on therapy platforms as much as on prescribing ones.
Is certification mandatory for a telehealth company?
No. Certification against mental health telehealth standards is voluntary in law. It becomes mandatory in practice when a payer, an employer purchaser, a health system partner or an acquirer requires it, which is the same route ISO 9001 took in manufacturing, where the standard remains voluntary and effectively compulsory to compete.
How long does certification take, realistically?
Six to twelve months for most small to mid-sized organizations. The uncompressible part is running the system long enough to produce records, completing an internal audit, and holding a management review before the certification audit. Starting from complete procedure templates rather than a blank page removes the single largest delay, which is the drafting.
We are a startup with twelve people. Is this premature?
It is cheaper at twelve people than at eighty. The documentation load scales with how much undocumented practice already exists, so the least expensive moment to write down how the work happens is before three different people are doing it three different ways. Certification can wait; the system should not.
The Bottom Line
Mental Health Telehealth Standards Reward Whoever Starts Before the Rule Lands
Decide. Build. Prove.
Virtual behavioral health grew during a period when nobody was asking hard questions about mental health telehealth standards, and it is now entering a period when several parties are asking them at once: a federal agency writing a permanent prescribing rule, a consumer protection regulator with a track record in this exact sector, payers building network requirements, and patients who have read the headlines. Mental health telehealth standards are how an organization answers all four with the same set of documents — and, as the note above argues, how a leadership team raises the floor for its own clinicians and for everyone they serve.
MSI has worked this transition on behalf of other sectors for 28 years: 80+ certifications supported, 200+ audits attended from inside the room, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare and other regulated industries. The pattern is consistent wherever mental health telehealth standards or their equivalents arrive. Organizations that treat a standard as a description of how they already want to work get a certificate as a by-product. Organizations that treat it as paperwork get paperwork, usually at speed and usually in the wrong quarter. Call 760-434-9141, or start with the procedure templates and guides if you would rather build it yourself. Either way, start before December decides for you.
References and further reading
• ISO 13131:2021 — Health informatics: Telehealth services, quality planning guidelines
• ISO 7101:2023 — Healthcare organization management: Management systems for quality
• ANSI — Inside ISO 7101, the first international standard for healthcare quality management
• BSI — ISO 13131 health informatics in telehealth services
• Federal Register — Fourth temporary extension of COVID-19 telemedicine flexibilities for prescription of controlled medications
• McDermott+ — DEA extends telemedicine flexibilities for controlled substance prescribing for 2026
• Holland & Knight — DEA and HHS extend telemedicine prescribing flexibilities through 2026
• Virginia Telehealth Network — Fourth temporary extension explained
• FTC — Final approval of order banning BetterHelp from sharing sensitive health data for advertising
• FTC — BetterHelp, Inc., in the matter of
• FTC — Proposed order prohibiting Cerebral from using or disclosing sensitive data for advertising
• HHS — Telehealth for behavioral health care: best practice guide
• HHS — Telehealth and behavioral health for patients
• Global Accreditation Cooperation Incorporated (Global ACI)
• ISO Online Browsing Platform — confirm the current status of any standard
This article is general guidance and does not replace ISO 13131:2021, ISO 7101:2023, ISO/IEC 17021-1, DEA or HHS rulemaking, FTC orders, HIPAA, state licensure law, or the judgment of a competent professional or attorney. It is not clinical advice. Regulatory positions described here were current on 5 September 2026 and are subject to change; confirm the status of any rule or standard before relying on it. If you are in crisis in the United States, call or text 988.
About the author
About Management Systems International (MSI)
Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a consulting firm she co-founded in 1998. With 28 years of experience including extensive AS9100 work in MSI's early years, MSI's track record includes 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries. Today MSI implements ISO 9001, ISO 13485, ISO 14001, and ISO 45001, with an expanding focus on ISO 7101 healthcare quality.
msi-international.com · 760-434-9141 · Veteran-owned and female-owned.
