Two notices hit your desk in the same week. Florida wants to know why you didn't file a corporate return. New York's questioning sales tax on telehealth consults you provided to patients in Buffalo from your office in Texas. Your stomach drops. I've been in your shoes, or at least alongside enough clinicians who were, and I can tell you: multi-state tax audits for telemedicine are not the apocalypse they feel like. They're a documentation puzzle with a clear solution, and you'll get through it.
This article is for educational purposes only and does not constitute tax advice or legal advice. Figures vary by jurisdiction; consult a qualified professional before taking any action.
Are You Facing a Multi-State Tax Audit for Your Telemedicine Practice?
Panic is normal. But the first thing you need is a clear containment protocol, not a spiral. I've seen practices freeze for weeks because they didn't know which states fired the audit or what those states actually wanted. Get that answer first.
Define the audit scope. The letters will name the states that triggered the inquiry. Don't assume they're auditing your home state, they're likely looking at where patients sat during encounters. That's the driver. For telehealth, the billing ZIP code on a claim is what grabs their attention, not the license address on your wall. I've watched a provider owe back taxes in three states she'd never set foot in, purely because her EMR linked sessions to patient homes.
Telemedicine is a nexus powder keg. You can easily cross economic nexus thresholds in a dozen states simultaneously because you're delivering services remotely. The audit window might demand three to seven years of data, depending on the state, and they'll give you 30 days to produce it. Immediate next steps: stop speculating, pull the audit notices, identify every state on the list, and freeze all relevant financial records. That's the start.
Where Does Your Nexus Actually Begin?
Physical nexus is the old world. A server, an office, a doctor physically in the state. Economic nexus is the new rule, and for telehealth it's brutal. Once your out-of-state revenue or transaction count crosses a state's threshold, you're on the hook for income, sales, or gross receipts taxes. No physical presence required.
Most states adopted a $500,000 revenue threshold or 200 transactions, but don't get comfortable. California, New York, Texas, all $500k. Then there's North Carolina ($100k in services), Colorado ($100k in transactions), Washington ($100k in sales). Your patient billing ZIP codes drive liability, not where your laptop sits. I've seen audit flags fire simply because a practice hit 210 telehealth visits to Oregon residents, completely unaware of the threshold. The auditor didn't care about unawareness.
Here's your quick decision matrix: confirm the auditing states, then cross-reference your last three years of billing data by patient state. If you cleared their dollar or transaction thresholds during any year, you're inside the audit scope. Don't waste time pulling records for states not on the list. Precision now saves weeks later.
What Records Must You Gather Before Day One?
Auditors won't accept explanations; they accept exported data. Manual spreadsheets get shredded. If you wait until they request something, you've already lost the initiative. Gather before they ask.
I start every audit response with a clean, version-controlled cloud repository. Here's the hard list:
- Patient encounter logs with verifiable geolocation metadata. Your EMR must export fields like patient billing ZIP, date of service, provider NPI, and CPT code. Strip clinical notes down to encounter facts.
- State license verification documents. For every state where you prescribed, consulted, or treated, pull the active license screenshot along with issue and expiration dates. I've seen entire penalty portions vanish because a provider quickly produced a valid license the auditor assumed was missing.
- Payment processor statements showing transaction splits, fee allocations, and the origin state of each payment. Square, Stripe, practice management systems, all have export functions. Use them, don't screenshot.
- Standard clinical SOPs that prove services were delivered within your licensed jurisdictions. If your telehealth platform logs verify provider location at the time of service, bundle those.
- Centralized repository. Create a shared folder (Google Drive, Dropbox, Box) with a naming convention like "State_Year_DocumentType.pdf". Timestamps matter. Give counsel read-only access.
The diagram shows the flow. Notice cross-referencing with prior filings is a critical step. If your previous returns didn't mention Illinois but your payment logs show $600k in Illinois revenue, you must flag the discrepancy upfront. Surprises in discovery are the enemy.
How Do You Defend Against Common Audit Findings?
Most audit findings aren't outright fraud. They're methodology mistakes. Lean hard on that distinction.
Misapportionment errors top the list. You claimed zero liability in a state because your clinicians are all in New Jersey, but three of them work from home offices in Connecticut. That's payroll withholding exposure right there. Defend by showing your apportionment formula used actual days worked by state, not just a guess. I've corrected audits midstream by sending a payroll report that proved zero days of physical presence in the disputed state.
Independent contractor classification is a minefield. States use different tests for employee versus 1099. You classified your psychiatrists as contractors under federal rules, but California applies the ABC test. If you lose, you owe back payroll taxes, interest, and penalties. Defense tactic: immediately document the contractor's independent business registration, separate office, and payment terms. If the state's classification law clearly contradicts, don't fight, settle on the withholding piece and move on.
Failure to remit payroll withholding for clinicians working from home offices triggers automatic penalties. I've seen a practice owe $80,000 in one state because they thought remote work didn't count. It counts.
Here's where you engage the right help. For methodology disputes, wrong apportionment, misinterpreted thresholds, a CPA familiar with multistate telehealth is enough. The moment an auditor proposes a substantive liability based on reclassifying your business, you bring in a tax attorney. Don't blur those roles. I've watched CPAs try legal arguments and make the audit worse.
Choose Your Path: Contest, Compromise, or Comply?
Three doors. Most providers pick one too late and bleed cash. Here's the framework I use.
Contest only when there's a factual screw-up or a procedural error. Auditor said you lacked a license? Show the license. Auditor applied nexus threshold to gross receipts instead of services? Push back. Don't contest because you think it's unfair; auditors follow black-letter law, not vibes.
Compromise is often the smartest play. Once you see a liability crystallizing, negotiate a stipulated assessment early. In almost every state, early settlement freezes penalty accrual and stops interest from compounding. I've negotiated down from six-figure penalty exposure to a flat five-figure settlement by coming to the table with organized records and a willingness to pay core tax. Cash flow matters more than principle.
Leverage interstate compacts where you can. The Nurse Licensure Compact (NLC) and Interstate Medical Licensure Compact (IMELC) don't wipe out tax obligations, but they can clarify provider authority and reduce penalty arguments about unauthorized practice. If you're participants, say so.
The chart tells a story: low preparation, penalty risk hovers around 80%. Medium prep (gathered but messy) lands around 40% chance of significant penalty. High prep, clean, counsel-reviewed submission, drops to roughly 15% risk of any meaningful penalty. Those odds are worth every upfront hour.
Calculate the cost of extended litigation. Attorney fees at $400/hour for a 100-hour fight in a state where you only owe $15k? Stupid. Take the voluntary disclosure cap, remit the tax, and close it. Set internal milestones: within 60 days of notice, decide direction; within 120 days, finalize settlement or file protest. Audit fatigue is real and costly.
Execute Your Post-Audit Compliance Checklist
The audit isn't the finish line. Post-audit hygiene determines whether you'll ever face this again.
Step 1: Archive everything submitted, including auditor correspondence, in a secure, encrypted location. Retention requirements often run 7 years; treat these like medical records.
Step 2: Register automatically in any newly identified taxing jurisdictions. If the audit revealed you triggered nexus in three extra states, file registrations within the same quarter. Voluntary compliance after an audit reduces future penalty flags.
Step 3: Configure a quarterly reconciliation cadence. Use telehealth-specific accounting software (like Keeper or TaxJar for sales tax, or dedicated multistate income tax modules) that pulls patient-location metadata and flags threshold breaches.
Step 4: Set up automated alerts. Most state economic nexus thresholds update periodically. Create a spreadsheet with each state's current threshold and link it to your practice management system's revenue reports. When quarterly revenue for a new state hits 50% of threshold, you get an email. No more blind spots.
Step 5: Schedule biannual compliance audits with multistate telemedicine tax specialists. Treat them like a physical, less painful when it's routine, and it catches new nexus triggers before the state does.
