References

Numbered references below are formal citations, in Vancouver style, each individually verified against the original source before inclusion. The [N] marker on each criterion's Reference line and "The evidence" line corresponds to its number here.

1. Every telehealth platform used for clinical sessions must provide a signed Business Associate Agreement, executed by both parties before any clinical sessions are conducted, distinct from the common misconception that selecting a healthcare-tier platform alone constitutes compliance.

2. Telehealth security requires end-to-end encryption for real-time sessions, transport layer security of at least TLS 1.2 for signaling and APIs, and AES-256 encryption for data at rest, with these specific technical standards, not general platform reputation, constituting genuine compliance.

3. Consumer video platforms including standard FaceTime, consumer Zoom, standard Google Meet, and Skype are explicitly identified as non-compliant for clinical telehealth use because they do not offer Business Associate Agreements, with temporary pandemic-era enforcement waivers for such platforms having since expired.

4. Administrative controls including role-based access controls, multi-factor authentication, and session timeouts are established as essential technical safeguards for telehealth systems handling sensitive health information, reflected in health data security frameworks recognized across many countries' privacy and data protection regulation.

5. Security depends on the full system, not the software alone, establishing that operational resilience — including defined processes for technical failure during a clinical session — is a genuine component of telehealth platform reliability, distinct from encryption and access control alone.

6. The Interstate Medical Licensure Compact Commission establishes that the location of medical practice is the state where the patient is located, with all laws and regulations of the patient's state applying, distinct from the provider's own location or state of principal licensure.

7. Documenting the patient's specific location at the time of the telemedicine visit is established as essential practice, distinct from relying on an address on file, given that applicable law and licensure requirements are determined by the patient's actual location during the encounter.

8. The Interstate Medical Licensure Compact covers physicians specifically and does not extend to nurses, physician assistants, or other allied health professionals, who require verification under their own distinct interstate compacts with separate membership states and requirements.

9. Genuine attention to changing licensure implications when a patient relocates or travels, distinct from continuing care regardless of resulting licensure gaps or abruptly discontinuing without transition, is established as necessary practice for telemedicine continuity of care.

10. Under interstate medical licensure compact structures, if a participating state board takes disciplinary action against a provider's compact-facilitated license, all compact member boards are notified and authorized to take similar action, establishing coordinated disciplinary risk as a genuine, distinct consequence of compact licensure.

11. A retrospective review of teledermatology consultations found 60.2 percent of patients had additional diagnoses identified only on in-person examination, including an additional malignant diagnosis in 8.4 percent of patients, establishing genuine, condition-specific limits to remote assessment that providers must actively recognize.

12. The standard of care remains the same whether a visit is conducted in person or remotely, with malpractice claims analysis identifying failure to order diagnostic testing, failure to assess continued symptoms, and failure to establish a differential diagnosis as leading contributors to diagnostic error in telehealth practice.

13. Clinicians and subject matter experts describe genuine challenges in managing diagnostic uncertainty via telemedicine due to the absence of hands-on examination, with few patients receiving a new diagnosis through telemedicine and many preferring in-person visits specifically for new or complex concerns.

14. Clinicians describe relying more on additional diagnostic testing, structured patient self-reports, and scheduled in-person follow-up visits specifically to compensate for the absence of hands-on physical examination in telemedicine encounters, establishing active compensation as effective, documented practice.

15. Research on telemedicine's diagnostic process found few patients receive a genuinely new diagnosis through telemedicine, with patients themselves preferring in-person evaluation specifically for new concerns, establishing a genuine, documented distinction between remote management of known conditions and remote establishment of new diagnoses.

16. Genuine confirmation of a client's physical location at the start of every single session, not reliance on intake records, is established as essential telehealth crisis protocol, because not knowing where a patient actually is can be the difference between emergency help arriving and not arriving.

17. A documented telehealth emergency management protocol establishes a three-tiered emergency activation process: direct local emergency service activation where standard coverage exists, a patient-reported local dispatch number where it doesn't, and an e911 relay center connecting the clinician to local emergency services as a further alternative.

18. Established telehealth emergency management protocol specifically requires clinicians to remain connected on the session with the patient until local emergency services arrive on scene and care is genuinely transferred, only disconnecting once that handoff has actually occurred.

19. Genuine designation of primary and secondary emergency contacts requires a verification step confirming the contact has been informed and is willing to serve in that role, distinct from a name and number recorded without active confirmation.

20. Established telehealth crisis protocol specifically addresses when telehealth is no longer clinically appropriate and a higher level of care needs to be facilitated, establishing a defined threshold as necessary practice, distinct from indefinite continuation of remote sessions without a clear transition point.

21. Telemedicine prescribing regulations for controlled substances remain an actively evolving area of law in numerous countries, with the underlying international framework under the Single Convention on Narcotic Drugs (1961, as amended) requiring national implementation that can itself change, making active tracking of current, jurisdiction-specific requirements a genuine, ongoing necessity.

22. The Single Convention on Narcotic Drugs (1961, as amended), ratified by 186 countries, establishes that the production, distribution, and use of controlled substances must be limited exclusively to medical and scientific purposes, a principle applying identically whether a prescription is issued in person or via telemedicine.

23. In countries with federal, provincial, or similarly devolved governance structures, sub-national controlled substance telemedicine prescribing rules can apply independently of and in addition to national requirements, with some regions imposing distinct exceptions or conditions beyond the national baseline.

24. Some jurisdictions permit a narrow exception for prescribing certain restricted stimulant medications to minors using real-time, interactive audio-visual technology and prior written guardian consent, in place of the standard in-person evaluation requirement; where no such exception exists in a given jurisdiction, the standard requirement applies without exception.

25. Under the international framework established by the Single Convention on Narcotic Drugs, each country designates a competent national authority responsible for controlled substance prescribing authorization, with this authorization status forming the foundational basis for lawful prescribing, requiring genuine, periodic verification distinct from a one-time historical check assumed to remain accurate indefinitely.

26. Official telehealth guidance specifically advises patients to find a private location for their session and provides concrete suggestions — a quiet room at home, a private space in a community setting, a parked car — reflecting that session environment privacy requires active guidance, not assumed adequacy from platform security alone.

27. Established health privacy guidance specifically requires recorded consent before continuing a consultation when a translator, caregiver, or family member is present, or when the patient is in a public location where the conversation may be overheard, reflecting the genuine risk of an unseen third party during a telehealth session.

28. Practitioners often lack clear guidance on whether and how to record telehealth sessions, creating genuine ambiguity and discomfort for both provider and patient, establishing a clear, specific, documented recording policy as necessary to close this documented gap.

29. Many clinicians continue conducting sessions from home offices with unencrypted devices and storing session recordings in personal cloud storage, having never completed the compliance transition required since temporary pandemic-era enforcement discretion ended, establishing the provider's home office as a genuine, distinct privacy compliance layer separate from platform security.

30. Multiple countries' health privacy frameworks specifically establish heightened confidentiality protections for substance use disorder or addiction treatment records, distinct from general health information privacy practice, often requiring the patient's own specific consent for disclosure.

31. Many older malpractice insurance policies were drafted before telemedicine became mainstream and contain explicit exclusions for virtual care unless a formal endorsement is added, with coverage needing to be affirmatively stated in policy declarations or endorsements, since silence is not protection.

32. Interstate licensure compacts such as the Interstate Medical Licensure Compact facilitate multi-state licensure but do not inherently standardize malpractice insurance requirements, meaning providers must separately confirm their coverage explicitly extends to every state where they actually deliver care.

33. When care delivery depends on digital platforms, software malfunctions including failed video platforms, corrupted data transmission, or algorithmic triage tool errors can contribute to patient harm, with traditional malpractice policies often not covering these technology-driven operational failures.

34. Direct verification of provider credentials with the issuing licensing authority, distinct from acceptance of self-reported documentation, is established as necessary practice, carrying particular importance for remote-only practice arrangements that lack the informal verification opportunities a physical site provides.

35. Defined coverage arrangements for a solo provider's unavailability, distinct from an assumed continuation of care without one, are established as necessary practice for genuine continuity in any single-provider care model, telemedicine included.

36. WHO Competency Standard 1 (Refugee and Migrant Health: Global Competency Standards for Health Workers, 2021) requires health workers to adapt practice to migration and displacement experiences, address trauma-informed care and psychosocial needs, and support continuity of care regardless of legal status.

37. Systematic review of telemedicine for refugee populations identifies limited access to technology, unreliable internet connectivity, and insufficient digital literacy as key barriers hindering effective telemedicine use, requiring active strategies including affordable connectivity, digital literacy support, and multilingual platforms.

38. WHO Competency Standard 3 explicitly states health workers have a responsibility not to engage minors to facilitate interpretation, given the associated significant risk, and identifies inaccuracy, information distortion, and compromised confidentiality as documented risks of family-member interpretation generally.

39. Research on refugee telehealth implementation specifically cautions that health technologies should be designed to create space for refugees to practice and demonstrate genuine agency, rather than treating them as passive beneficiaries of the technology, a framing that itself perpetuates harmful assumptions about their capabilities.

40. Refugees experience genuine difficulty accessing their medical records and maintaining continuity of care due to mobility-related challenges, with the absence of standardized, interoperable procedures between health systems resulting in fragmented records, incomplete medical history, and documented medical errors.

41. WHO Competency Standard 7 requires health workers to use evidence-informed guidelines specific to refugee and migrant health where they exist, recognise where the health needs of this population differ from the general population, and identify where evidence gaps remain.

42. WHO Competency Standards 8 and 9 (Refugee and Migrant Health: Global Competency Standards for Health Workers, 2021) require health workers to maintain structured awareness of their own biases and institutional discrimination's impact, and to engage in self-care within a supportive team environment addressing the wellbeing impacts of migration-context care.

43. Some governments have begun analyzing migrants' phone data as part of asylum adjudication processes, establishing genuine, documented grounds for displaced patients' distinct privacy concerns regarding digital health data, separate from general patient confidentiality practice.

44. WHO's Competency Standards explicitly distinguish these legal status categories throughout, noting that access to health care and legal entitlements vary meaningfully by status and by country, and that health workers need specific awareness of this rather than a single generalised assumption.

45. Equal standard of care and documentation regardless of immigration or legal status, without differential record-keeping practice, is established practice in international guidance on healthcare access for migrant and refugee populations.

Established Practice — Not Attributed to a Single Source

The statements below reflect genuine, widely recognised professional consensus — drawn from accreditation frameworks, quality improvement literature, and established clinical practice broadly — but are not attributed to one specific paper or document. They are listed here, honestly and separately from the numbered citations above, rather than assigned an invented formal reference.

Annex — ISO 9001:2015 Correlation Table

A single-place summary of every criterion's correlation to ISO 9001:2015, for anyone checking this standard's alignment without searching page by page. Criteria not listed here carry no ISO 9001:2015 correlation — this is stated honestly, not implied as a gap in the standard itself; many patient-safety and dignity criteria simply fall outside a quality-management-system standard's scope.

Index

Alphabetical, correlated to page number.

A

B

Business Associate Agreement 8, 9, 12, 13

C

Compact 20, 23, 24, 27, 28, 76, 77

Continuity 17, 26, 83, 86, 93, 94

Controlled substance 52, 53, 54, 55, 56, 57, 60, 61

D

Digital literacy 87, 88

E

Emergency activation 43, 44, 46

Emergency contact 47, 48

Encryption 10, 11, 17, 69

F

G

H

Home office 69, 70

I

Immigration status 101, 105

L

Legal status 86, 102, 103, 104, 105

Licensure 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 76, 77, 80

M

Malpractice insurance 74, 75, 76, 77

Migration 85, 86, 97, 99, 100, 101, 104, 105

Multi-factor authentication 14, 15

N

P

Patient location 21, 41

R

Refugee 86, 88, 91, 92, 94, 95, 96, 99, 102, 103, 105

S

Session environment 63, 64

Single Convention 53, 55, 61

Solo provider 82, 83

Standard of care 32, 33, 104, 105

Sub-national 56, 57

Substance use disorder 71, 72

T

Third party 65, 66

U