# Log-In and the Session: Trust Surfaces in Telehealth Mental Health Healthcare keeps pulling me back. I volunteered at a family clinic in high school and a women's shelter in college, and the thing I could not stop noticing in both places was the distance between the people in the waiting room and the expertise that existed somewhere else. Women, people of color, and LGBTQ+ people are the groups the data keeps flagging as the least connected to the research, the specialists, and the plain information that changes how a life goes, or how long it lasts. At Kaiser I learned what it costs to move regulated data safely ([[Kaiser Permanente Case Study]]). This case study is the other half of that education: what the front door of care should feel like when the door itself is a trust surface. The subject is a queer-founded, trauma-informed telehealth therapy practice, in-network with Medicaid across Maryland, Virginia, and DC, hiring pre-licensed clinicians, and pointed at a fourth state. Medicaid sessions cost the patient nothing, which means price is rarely the leak. The leaks live in eligibility, in matching, in the gap between booking and the first session, and in the therapist queue between hired and billable. Two doors, one room. I am going to sketch both doors before anyone tells me what is feasible, because the finest architecture starts with artful drafts: pen, paper, charcoal. The feasibility conversation is real and it comes second. ## The patient door Most of the peer platforms open the same way. Headway, Grow, Rula, and Zocdoc show a therapist's calendar before you have an account; Talkspace and BetterHelp run a questionnaire first and match you to one person you did not choose; Alma lets you browse anonymously and books a fifteen-minute consult; the practice I am studying starts with a phone call to a care coordinator who verifies coverage by hand and asks about identity and availability out loud. None of the therapy platforms I looked at offers passkeys. Epic's MyChart does, which says the technology is ready and the category is behind. Rula tried emailed links and retired them for passwords, social sign-in, and one-time codes. Password-first is the industry default, and the industry default is a leak. ![[telehealth-patient-flow.png]] **First time.** The front door asks three things: where are you, who covers you, what matters to you in a therapist. No account yet. Eligibility runs in the same sitting, a 270/271 through a clearinghouse, and the design has to know the failure modes. A 271 that says active is talking about the medical plan; behavioral health is often carved out to a separate organization with its own payer id and its own network, and in Maryland Medicaid the carve-out is total: specialty behavioral health sits with an administrative services organization, and the managed care plan on the card is beside the point for therapy. Most "we could not verify your coverage" moments are a nickname, a typo in a birthdate, a query aimed at the wrong payer, or a plan reassignment the state system has not caught up with. The product should say which one, in plain words, and offer the next step. Then the match, and a match is only valid when the therapist is licensed in the patient's state, enrolled with the patient's plan, and fits what the patient asked for. The account is born at the moment of a real appointment, with a passkey or a one-time code, and the chosen name, pronouns, and safe-contact rules are set once, right there. ``` ┌───────────────────────────────────────────────────────┐ │ Let us find you the right person. │ │ │ │ Where are you right now? [ Maryland ▾ ] │ │ Who covers you? [ Medicaid ▾ ] │ │ Plan on your card [ Priority Part ▾ ] │ │ ✓ In network. Sessions cost you $0. │ │ │ │ What matters to you in a therapist? │ │ [ LGBTQ+ identified ] [ BIPOC ] [ trauma-informed]│ │ [ trans and nonbinary experience ] [ evenings ] │ │ │ │ Name you go by [ Sam ] │ │ Name on your card [ ________________ ] (billing │ │ only) │ │ │ │ [ Show me three people → ] │ │ │ │ No account yet. We ask for one when you book. │ └───────────────────────────────────────────────────────┘ ``` **Returning.** The reminder reads as neutral on a lock screen: no diagnosis, no clinic name, no PHI in a push or an SMS. Joining is one tap, a passkey on the device that booked or a signed link bound to that device, which is phishing-resistant and asks the patient to type nothing. Then the threshold. Licensure follows the patient's physical location at the time of the visit, and the interstate compacts are still arriving (the Counseling Compact only began issuing privileges in late 2025 and the Social Work Compact has no multistate license yet), which means the room has to ask "where are you right now" every time and write the answer to the audit log. The threshold also shows the consent state for this session before the door opens. ``` ┌──────────────────────────────────┐ │ Thursday · 6:00 PM · with Rae │ │ │ │ Where are you right now? │ │ ( • ) Maryland, same as usual │ │ ( ) Somewhere else │ │ │ │ This session │ │ Recording off │ │ AI notes off │ │ Session partner none invited │ │ │ │ [ Join with this device ] │ │ │ │ Leave quickly: tap the corner │ │ twice and the screen goes blank.│ └──────────────────────────────────┘ ``` **Where bespoke LGBTQ+ care changes the door.** Chosen name in the room, legal name on the claim. The 271 needs the name on the card, the person does not, and the billing layer should hold one while the room shows the other without the therapist ever asking. Pronouns and the preferences that made the match travel with the match as part of the therapist's brief, because the explaining is often what drove the patient to a queer-founded practice in the first place. Safe-contact rules are a first-class object: who may know, how reminders read, which channel is safe, and a quick exit on a shared device. Minors are state logic: teens consent to outpatient mental health care on their own in Virginia at any age, in DC for ninety days before reassessment, in North Carolina at any age, and in Maryland from twelve. A parent proxy is its own role with its own credential and a clinician override, and the Cures Act already draws the line the product needs, progress notes released to the patient by default, psychotherapy notes flagged apart. ## The provider door The job description calls it a portal that takes a therapist from sign-up to first-patient-ready. Turns out "ready" has a different definition in every state, and the definition changes again with license tier. ![[telehealth-provider-flow.png]] The pipeline itself is familiar: apply, verify against primary sources (the board, NPDB continuous query at two dollars and fifty cents a head, OIG and SAM exclusion lists checked monthly under the 2025 NCQA standards), attest a CAQH profile (now branded DataSpring, still a 120-day re-attestation clock that puts claims on hold when it lapses), enroll with the state Medicaid program, credential with each managed care plan or the carve-out organization, secure a board-approved supervision contract if pre-licensed, open availability. The peers publish their timelines in the open: Headway tells clinicians three weeks to four months plus up to eight weeks for payers to load the record, Grow says some payers run past six months, SonderMind says instant for delegated networks and up to 120 business days otherwise. Delegated credentialing, where a payer trusts the practice's own committee, turns months into days, and standing one up takes three to nine months and a file audit. What license tier does to "ready" is the finding I did not expect. In Maryland, a clinician who is not independently licensed cannot enroll in Medicaid individually and cannot be paid outside a licensed facility, which means the pre-licensed hiring push does not reach Maryland Medicaid at all under a group-practice model. In Virginia, residents and supervisees bill through the supervisor, and the state removed the ninety-day grace period after a license expires as of July 2025: enrollment ends the day the license does. In DC, graduate licensees deliver inside DBH-certified agencies under a qualified practitioner, and whether a group practice can bill for them is unconfirmed, which is itself a finding. North Carolina is the outlier: associates enroll directly under their own NPI, same codes, same rates, no supervisor on the claim, and one extra step, a written service order before the first treatment. A therapist onboarding portal has to be state-parametric from its first version because the states disagree about what a therapist is. ``` ┌─────────────────────────────────────────────────────────────┐ │ Rae Okafor · LGPC (MD) · Resident in Counseling (VA) │ │ │ │ Ready in Virginia ✓ since Aug 21 │ │ Blocked in Maryland ✗ facility pathway only │ │ Pending in DC … DBH agency enrollment │ │ │ │ Stage Owner In stage Longest pole │ │ Verify credentialing done │ │ Attest (CAQH) Rae done re-attest Dec 19 │ │ Enroll VA PRSS credentialing done │ │ Credential credentialing 41 days Sentara │ │ Supervision clinical done co-sign < 1 day │ │ │ │ Sessions stamped this month: 12 · all attested-and-current │ └─────────────────────────────────────────────────────────────┘ ``` **Verification of the verification.** Every session stamps license status, enrollment effective date, and supervision approval as of that date, and the room does not open without the stamp. This is the part I would build first, before any dashboard, because it is the thing an auditor asks for and the thing a payer clawback turns on. The queue between hired and billable is paid, idle capacity. Time-in-stage with a named owner is the supply metric, and the longest pole is usually a payer. ## The trust boundary ![[telehealth-trust-boundary.png]] HIPAA is a design material here, and a specific one. The Security Rule requires unique user identification, person or entity authentication, and audit controls, and it lists automatic logoff and encryption as addressable, which means you implement them or document why an alternative is equivalent. The proposed update would make multi-factor authentication, encryption at rest and in transit, and an annual compliance audit mandatory across the board; it has slipped to a July 2027 target on the regulatory agenda, and I would build to it anyway, because enforcement already expects it. NIST's 2025 digital identity guidelines put passkeys at AAL2, require verifiers to offer at least one phishing-resistant option, and set re-authentication after an hour idle. A passkey on a phone is the friendliest thing in that document, and it is also the most secure thing most patients will ever hold. Vendors are a boundary question. The video vendor signs a BAA and runs in a mode that names rooms randomly, disables cloud recording, and never stores chat. The identity provider signs a BAA. Google Analytics does not offer one and says so, and the OCR tracking bulletin still holds that anything on an authenticated page, or any intake answer, is protected. The FTC fined BetterHelp $7.8 million for sending intake answers to ad networks, and Maryland's 2025 privacy law bans the sale of sensitive data, mental health status included, consent or no consent. First-party events only, cohorted by state, payer, channel, and license tier. Third-party pixels stop at the front door. The consent ledger is its own service because consent is a product: recording, AI notes, partner invites, and proxy access are each per session, revocable, and all-party wherever the patient is sitting, since Maryland requires every party's consent to record and the patient's location controls. The room asks the ledger before anything is recorded. ## The room, sketched widely If the practice owns its video surface, the whole session is a design space, and this is where I want to ideate before the feasibility conversation. **Live feedback, private by construction.** A single tap the patient can make mid-session, "how is this landing," visible only to the therapist as a quiet indicator. No transcript, no recording, no model listening. The signal lives and dies inside the room. Voice biomarkers are real (a 2025 study of two thousand care-management calls predicted depression scores with useful accuracy) and clinician-facing fidelity scoring is sold today. Both raise the question of whose consent, patient and clinician, and what the job looks like when the software grades the therapist. I would start with the tap and earn the right to more. **A session partner, by the patient's hand.** Chosen family matters in queer life, and the low-tech version already exists: Grow tells patients to forward the reminder email. The designed version is a time-boxed invitation the patient issues for one segment of one session, with the therapist admitting from a waiting room and the ledger recording who was present for what. A partner rail beside the video, a countdown, and a one-tap dismiss. ``` ┌──────────────────────────────────────────────────────────┐ │ ┌──────────────────────────────┐ ┌────────────────────┐ │ │ │ │ │ In this room │ │ │ │ Rae (they/them) │ │ Sam · you │ │ │ │ │ │ Rae · therapist │ │ │ │ │ │ Jo · partner │ │ │ │ │ │ 12:40 left │ │ │ │ │ │ [ end Jo's ]│ │ │ │ │ │ [ segment ]│ │ │ │ │ ├────────────────────┤ │ │ │ │ │ How is this │ │ │ │ │ │ landing? │ │ │ │ │ │ (Rae sees this, │ │ │ │ │ │ nobody else) │ │ │ └──────────────────────────────┘ │ [ ○ ] [ ◑ ] [ ● ]│ │ │ Recording off · AI notes off └────────────────────┘ │ └──────────────────────────────────────────────────────────┘ ``` **After, in under a minute.** Feedback-informed treatment has twenty-plus years of evidence and a four-item instrument, the Session Rating Scale, that clinicians accepted precisely because it takes less than five minutes. Progress feedback improves outcomes modestly and reduces dropout, and the therapeutic alliance is a stronger predictor of dropout than any demographic variable; Talkiatry's 2025 data put weak alliance at 2.6 times the early dropout risk. I could not find a major platform that documents a one-tap post-session rating. That is white space. Four sliders on the way out, did we talk about what you wanted, did the approach fit, did you feel heard, how did it go overall, and the alliance score at session one becomes the earliest retention signal the practice has. PHQ-9 and GAD-7 on a two-week cadence ride along with the reminder, the way SonderMind and Alma already do it. ``` ┌──────────────────────────────────┐ │ Thank you, Sam. One minute. │ │ │ │ We talked about what I wanted │ │ ○────────────────●──○ │ │ The approach fit me │ │ ○──────────────────● │ │ I felt heard │ │ ○───────────────●───○ │ │ Overall │ │ ○─────────────────●─○ │ │ │ │ [ Done ] [ I want to say more]│ │ │ │ Your therapist sees these. Your │ │ care coordinator sees a trend. │ └──────────────────────────────────┘ ``` **Patient-owned recordings.** Nobody offers this, and the reasons are good ones, which is exactly why it is worth a sketch. The patient holds the key, the file lands in storage the patient controls, the therapist consents per session, and the practice keeps only the fact that a recording exists. The ethics baseline is old and clear: consent covers purpose, use, retention, and revocation without penalty. This would be a probe, in the [[Thesis - Ship Probes, Not Monoliths|probes over monoliths]] sense, with a handful of patients who ask for it. ## Referrals, and the Midi callback Midi Health started with about 150 women in a pilot who said, at the end, that they had nowhere else to go and that the company could not go away. Joanna Strober has said that was what gave them the confidence to raise money, and that it was hard to raise. Half of Midi's patients now arrive by word of mouth, from friends and book groups, and primary care physicians and oncologists send the conversation they do not have six minutes for to a place that does. Strober is blunt about the engine underneath: "To build a big healthcare company, you need to have insurance coverage," and "We don't try to do anything fancy. We just get basic insurance coverage." The takeaways carry straight over to a queer-founded practice. Pilot until patients say you cannot go away. In-network is the growth engine, because word of mouth only converts when there is no price objection at the end of it. Design for referral by the clinician who has six minutes. Seed where the trusted voices already are, and measure the spike. Protect the trust as revenue pressure grows, since the same population that arrived on trust leaves on an upsell. Referral loops in a Medicaid-heavy practice have a legal shape. Therapist-to-therapist bonuses are common (Headway pays $350, Alma $500) and Alma's terms carry the sentence a compliance officer wants, that bonuses are never payment for patient referrals or claim volume. Patient-to-patient rewards are a different animal: the beneficiary inducement rules cap gifts at fifteen dollars an item and seventy-five a year, exclude cash and cash equivalents entirely, and Virginia's Medicaid rules for community mental health providers prohibit incentives to enrolled or prospective members outright. The design answer is a reward-free door: a shareable link that says "hold this door open for someone," a therapist referral program with Alma's language, and a clinician referral channel built for the six-minute doctor, with a one-page fax-and-portal path because that is still how a lot of primary care refers. ## What I would measure | Signal | Why it is the one | |---|---| | Booked and attended first sessions per week | The number the job description is built around, with show rate in scope even though the bullet stops at the booking | | Eligibility pass rate by payer, with failure reason | The leak most likely to be a fixable data problem, and an alert when one payer drifts | | Time-to-first-patient by state, payer, and license tier | The supply twin, with time-in-stage and an owner per stage | | Return-login success rate and time to join | The password tax, measured; passkeys should push this toward one tap | | Alliance score at session one | The earliest retention signal there is, and the one nobody collects in one tap | | Consent completion and revocation counts | Consent is a product; a product has usage | | Chosen-name and safe-contact adoption | How much of the bespoke promise patients actually reach for | ## The deeper point A log-in is a promise about what happens after it. In most software the promise is convenience. In therapy for people who have spent years explaining themselves, the promise is that the explaining is over and the room is safe, and every control in this sketch sits next to the consequence it governs ([[UX - Controls Near the Consequence]]): the name next to the claim, the consent next to the record button, the location next to the license, the stamp next to the session. The compliance work and the care work turn out to be the same work. Kaiser taught me the cost of moving regulated data. This is the version where the cost buys something a patient can feel. **Side note, anchored here on purpose.** I have been evaluating screen recording tools, and Cap, an open-source Loom alternative I was comparing, shipped "HIPAA compliance" as a changelog entry on August 13, 2026: BAAs signed from the dashboard on the Pro plan with no enterprise tier, every production vendor covered, recordings written straight to your own S3 bucket so PHI never touches their servers, screen and webcam saved as separate tracks so PHI can be redacted, and AI captions you can switch off. A compliance program showed up in a release note between two bug fixes. That is the pattern from [[Delve.co Case Study]] arriving in a consumer-grade tool, and it is also, almost exactly, the storage model the patient-owned recording sketch above would need. I went shopping for a screen recorder and came back with a reference architecture. ## Links - [[Kaiser Permanente Case Study]] - where I learned the cost of moving regulated data - [[Delve.co Case Study]] - compliance as compute, and write-only evidence - [[Skeleton Spec (PRD) - Secure Variables in SaaS]] - store it once, secure it everywhere, use it without seeing it - [[Thesis - Current tools are lossy membranes]] - the handoff problem, seen from the patient's side of the glass - [[Product Explorations]] - more case studies ## Sources - HHS, HIPAA Security Rule technical safeguards, 45 CFR 164.312, and the [Security Rule NPRM fact sheet](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html); [HIPAA Journal on the final rule slipping to July 2027](https://www.hipaajournal.com/hipaa-security-rule-update-postponed/) - HHS, [Use of online tracking technologies bulletin](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html); [Google Analytics HIPAA statement](https://support.google.com/analytics/answer/13297105); [FTC BetterHelp order](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising) - NIST, [SP 800-63B-4 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html) - Daily, [HIPAA mode requirements for video rooms](https://docs.daily.co/guides/privacy-and-security/hipaa) - Carelon Behavioral Health of Maryland, [Public Behavioral Health System provider manual](https://www.schoolmentalhealth.org/media/som/microsites/ncsmh/documents/youth-care-coordination/Carelon-Maryland-PBHS-Provider-Manual.pdf); Virginia DMAS, [provider enrollment requirements effective July 1, 2025](https://vamedicaid.dmas.virginia.gov/bulletin/updated-provider-enrollment-requirements-effective-july-1-2025); NC Medicaid, [Clinical Coverage Policy 8C](https://medicaid.ncdhhs.gov/8c-outpatient-behavioral-health-services-provided-direct-enrolled-providers/download?attachment=) - Headway, [credentialing timelines](https://help.headway.co/hc/en-us/articles/360058294552-Credentialing-with-Headway) and [provider referral rewards](https://help.headway.co/hc/en-us/articles/11559127552404-Provider-referral-rewards-program); Alma, [referring colleagues](https://support.helloalma.com/hc/en-us/articles/360015279073-Referring-Your-Colleagues-to-Alma) - Duncan, Miller et al., [The Session Rating Scale](https://www.scottdmiller.com/assets/uploads/documents/SessionRatingScale-JBTv3n1.pdf); de Jong et al. 2021, [progress feedback meta-analysis](https://pure.uva.nl/ws/files/68128665/Using_progress_feedback_to_improve_outcomes_and_reduce_drop_out_treatment_duration_and_deterioration_A_multilevel_meta_analysis.pdf); Talkiatry, [early dropout thresholds](https://www.prnewswire.com/news-releases/talkiatry-study-identifies-clear-thresholds-predicting-early-dropout-in-telepsychiatry-302638961.html) - OIG, [gifts of nominal value policy statement](https://oig.hhs.gov/documents/special-advisory-bulletins/887/OIG-Policy-Statement-Gifts-of-Nominal-Value.pdf); Virginia, [12VAC30-130-2000](https://law.lis.virginia.gov/admincode/title12/agency30/chapter130/section2000/) - Midi Health: [The Story Exchange interview](https://thestoryexchange.org/menopause-care-grows-up-we-want-to-be-the-company-for-aging-beautifully/), [Kara Goldin Show](https://karagoldin.com/podcasts/joanna-strober/), [Fierce Healthcare on the Series D](https://www.fiercehealthcare.com/health-tech/womens-health-clinic-midi-health-closes-100m-series-d-round-hitting-1b-valuation) - Minor consent statutes: [Md. Health-Gen. § 20-104](https://youthlaw.org/sites/default/files/2024-10/NCYLMinorConsentCompendium2024-Maryland.pdf), [Va. Code § 54.1-2969](https://law.lis.virginia.gov/vacode/title54.1/chapter29/section54.1-2969/), [D.C. Code § 7-1231.14](https://code.dccouncil.gov/us/dc/council/code/sections/7-1231.14), [N.C.G.S. § 90-21.5](https://www.ncleg.net/enactedlegislation/statutes/html/bysection/chapter_90/gs_90-21.5.html) - Cap, [HIPAA-compliant screen recording](https://cap.so/hipaa-compliant-screen-recording) and the August 13, 2026 changelog *Written September 2026.*