Telerehabilitation grew from a niche capability before 2020 to mainstream practice with permanent reimbursement in many jurisdictions. This chapter walks the platform-architecture envelope, the regulatory + licensure mosaic, and the latency / safety budgets that distinguish a patient-monitoring telerehab session from a remote-actuated robotic session.
A telerehab platform composes (a) a HIPAA-compliant video-conferencing surface (Zoom for Healthcare, Doxy.me, VSee, Microsoft Teams with BAA, Webex Healthcare, plus per-EU equivalents); (b) a clinical-data ingest surface bound to the patient's EHR via HL7 FHIR R5; (c) a per-session device-data channel (when a wearable or robotic device is part of the session); (d) a per-session documentation + billing surface tied to the operator's CPT-code / per-jurisdiction-equivalent envelope.
Per-US-state Interstate Medical Licensure Compact (IMLC) for physicians; the Physical Therapy Compact for PT; the Nurse Licensure Compact for nursing. Cross-state telehealth still requires the patient-state licence in many cases. Per-EU member state, Directive 2011/24/EU on cross-border healthcare interacts with national professional-licence law. Per-jurisdiction telehealth-parity policy + reimbursement-parity policy varies significantly.
Patient-monitoring sessions tolerate 200–500 ms round-trip latency. Voice + video remain conversational. Remote-actuated sessions (a clinician remotely commanding a robotic device on the patient side) require sub-100-ms round-trip and a fail-safe disconnect protocol — the patient-side device freezes or returns to a safe pose on heartbeat loss. The ATA Telerehabilitation SIG and the APTA Telehealth Practice Guideline cover the operating envelope.
Every remote-actuated session carries an on-site licensed clinician, caregiver, or trained-attendant per the per-jurisdiction professional-practice envelope. The patient-side device implements an emergency-stop accessible to the on-site party. Connection-loss detection (heartbeat at 1–2 Hz; safe-state on 3 missed heartbeats) follows the per-platform tested envelope. The post-session record captures every clinically-relevant event.
Per-jurisdiction privacy law (HIPAA + GDPR + LGPD + PIPEDA + per-jurisdiction-equivalent) governs the per-session data flow. End-to-end encryption per TLS 1.3, encryption at rest per AES-256-GCM, per-clinician + per-patient access control, BAA / DPA / per-jurisdiction-equivalent execution before any third-party processor handles PHI. Cross-border data flow uses SCC / IDTA / APEC CBPR / per-jurisdiction-equivalent. Recording of clinical sessions is governed by the per-patient written consent envelope; subsequent use for clinician-training or quality-improvement requires either explicit re-consent or use of de-identified material in the operator's per-jurisdiction definition.