This review identified several legal issues regarding obtaining consent from patients with SUD through telehealth. Philosophers and ethicists [21] have proposed arguments to suggest that people with SUD may be unable to provide informed consent to participate in treatment programs [25]. Their reasoning included the inability to say “no” to the offer of heroin [26]. Other research however suggests that addiction does not significantly impair autonomy. In NSW, patient consent to treatment is mandatory [27,28] except for involuntary treatment in cases of severe substance dependence under the Drug and Alcohol Treatment Act 2007 (NSW) [29]. The legislation provides that patient consent to treatment is not required under 3 limited circumstances. First, when an emergency arises and the patient lacks capacity and treatment wishes are unknown [30], when capacity is deemed by law to not exist—such as when patients are legally “incompetent” due to mental health or disability (in such instances legislation provides for alternate means of obtaining consent), and where the law overrides a patient’s right to provide consent [31].

Where treatment is given without consent, or it exceeds the terms of the consent, the treatment will constitute a tortious battery and may also be the subject of complaint and disciplinary sanction. This is the case even if the treatment is successful or therapeutic. Where treatment is given and the consent is premised on incorrect or inadequate information, a patient has a cause of action in negligence if they endure damage or loss.

In most treatment contexts, obtaining informed consent is a necessary precondition of treatment. Without consent, a medical practitioner may face disciplinary allegations of professional malpractice or be sued for battery or negligence if detriment or harm is endured. This is despite the fact the treatment may be given in a manner that benefits the patient.

Obtaining patient consent via telehealth in a drug health setting can be problematic. Currently, there is no legal authoritative case regarding breach of consent due to telehealth use. However, the following cases are reflective of patient consent-related issues which may arise in drug health clinics.

The accepted legal test at common law for patient consent and autonomy is established in Rogers vs Whittaker [32,33] and the test has also been adopted in Canada and the United Kingdom [34]. This legal principle potentially applies to telehealth use if a health care professional fails to obtain informed consent and an informed decision from the patient regarding the risks of particular procedures and if consultation is not performed in person. The case is considered a precedent in many countries including the United Kingdom, the United States, New Zealand, and Canada [35]. Courts have no difficulty in assessing the presence and efficacy of consent simply because information and treatment are being provided by using technology.

There are challenges to providing health care via telehealth which present new variables and challenges that are not present in face-to-face consultations. The risk of misreading nonverbal cues in telehealth, the inability of the patient to access relevant information (due to their own limitations or the lack of availability of this information), the digital literacy of the patient and the effect of influence by other persons who may be unknowingly present when telehealth is conducted are all variables that have the potential to impact on the exchange of information, and therefore on the practitioner’s ability to determine informed consent.

In Malette vs Shulman [36], the issue of lack of consent and autonomy was considered. The plaintiff (Malette) was seriously injured in a car crash and was rushed to a hospital where she was found to carry a card that identified she was of the Jehovah’s Witness faith, and expressly requested that no blood transfusions be given under any circumstances. However, Dr Shulman authorized a life-saving blood transfusion despite knowing that the procedure was contrary to the patient’s consent. The patient sued. The Supreme Court of Ontario concluded that the doctor had violated the patient’s rights over her body by acting against her intentions without consent [37] and this constituted a battery. Battery is a legal concept that occurs when a person touches or applies force to another person’s body in an unauthorized and offensive way. In Malette vs Shulman, the blood transfusions without Georgette’s consent raised the question of whether it established a battery. The rules of self-determination and individual autonomy play an essential role. Georgette’s right to reject treatment, even if it might have the purpose of lifesaving, constitutes her autonomy. Dr Shulman’s action against Georgette’s consent in favor of saving her life constituted a legal and ethical tension. The trial judge decided in favor of Georgette, highlighting that the Jehovah’s Witness card validly limited Dr Shulman’s right to treat her. Dr Shulman’s actions constituted a battery as there were no grounds to ignore Georgette’s obvious rejection of blood transfusions. Malette vs Shulman provides the nuanced balance between respecting patient autonomy and ensuring medical help. It highlights the legal obligation to obtain informed consent, even in lifesaving or any other emergencies. The case can be considered as a precedent when issues of consent and patient autonomy arise in telehealth use. The case is recognized in multiple countries including Australia, the United States, the United Kingdom, and New Zealand in addition to Canada [35].

The relevant legislation in NSW regarding consent to treatment are the Children and Young Persons (Care and Protection) Act 1998 [29,38,39], Guardianship Act 1987 [40,41], Guardianship Regulation 2016 [42,43], and Minor (Property and Contracts) Act 1970 [42,44], and Drug and Alcohol Treatment Act 2007 (NSW). Obtaining and ensuring informed consent is an essential domain for telehealth consultations of patients for drug health and providing health care without consent can lead to risk of malpractice and medical negligence [45]. Consent must be provided freely [46] and the use of telehealth should acknowledge and account for the limitations and risks of telehealth services when compared to face-to-face treatment. Obtaining consent through telehealth also faces legal and regulatory barriers such as large variations in rules, regulations, and guidelines for practice. Such variation contributes to the confusion of providers engaged in the practice of telehealth [47]. The Medical Board of Australia provides guidelines on technology-based patient consultations and their medicolegal implications [48].

Patient confidentiality is at risk of being breached when using telehealth. Information related to health is always sensitive and drug health clients always prefer that their medical diagnoses and treatment be handled with a high level of confidentiality [49]. Moreover, health care providers need to inform the patient that they have a right to access information about themselves, to approve the information to be used by other health care providers, and in some cases for deidentified information to be used in clinical research [49].

Skene [15] defined confidentiality from three viewpoints. The first is an ethical perspective, as maintaining confidentiality about a medical record respects the autonomy of the patient [45]. The second is the medical perspective. If a patient knows that what they discuss with their doctor is confidential, they are more likely to be honest about what they disclose, which is beneficial for their treatment [45]. The third is a public policy perspective, that is, it is in society’s interest that patients are provided with the best possible treatment through telehealth [15].

Medical records of patients with substance use dependency and mental health issues have strong protection in the United States. In Jaffee vs Redmond [33], communications between psychotherapists and their patients were found to be privileged under the Federal Rules of Evidence [50]. This judgment extended the privilege of patient records to psychotherapists, with the court noting that confidentiality played an important part in effective patient treatment. The case law is authoritative in other states because of the superiority of the court making the judgment [50]. The court concluded that the privilege is necessary because “the mental wellbeing of our citizenry, no less than its physical health, is a public good of transcendent importance” and “the mere possibility of disclosure may harm establishment of the confidential relationship necessary for successful treatment” [50].

In summary, health professionals must consider confidentiality when providing health care through telehealth by taking reasonable steps such as ensuring the use of telehealth software that prevents screen recording [48]. However, confidentiality can be still breached such as by recording the consultation using another device [48]. Jaffee vs Redmond is one of the key cases for legal and ethical consideration when using telehealth regarding patient confidentiality and is recognized around the world [51].

Patient privacy can be compromised in the following ways: first, patients may need to access the internet from public locations such as libraries due to limited connectivity. This situation can compromise privacy, as patients may be using shared devices or networks, potentially exposing sensitive health information. Living in a remote area without an internet connection is not a privacy issue, however, lack of internet connection and the act of using the internet from public places can impact privacy [48]. Second, health professionals might have less ability to perform a controlled examination through telehealth. This can lead to a lack of control over the collection, use, and sharing of private information. Unusually, people may be around the consultant and the patient might not want to overhear what was said or sometimes people are not comfortable discussing health issues from within their home due to a lack of privacy, and an unsafe environment to discuss concerns [52]. Patients for drug health are a vulnerable cohort and when their medical information is disclosed against their will, they frequently feel ashamed, helpless, and stigmatized [53]. Successful treatment may become difficult in such circumstances and the relationship of trust with the doctor may be permanently harmed. Actual or threatened disclosure can be particularly traumatic for the drug health of patients as they need supportive, reliable, and trusting relationships with health care providers.

The following cases are also relevant in Australia. In R vs Osolin [54], the importance of patient-centric privacy was emphasized by the court and the case is recognized by multiple jurisdictions around the world [55]. In this case, disclosure of sexual assault in medical records that were then produced under subpoena was considered by the court to amount to “double victimization” of the patient, with significant adverse consequences for ongoing treatment [56]. Undesired disclosure of patient records impairs treatment and can impact the procedural fairness of court proceedings that use clinical records as evidence [57]. Use of patient records as evidence can result in harm to the person’s psychiatric treatment.

Health professionals must consider privacy when providing health care through telehealth by taking reasonable steps to protect personal information from misuse and loss, and from unauthorized access, modification, or disclosure. The clinicians must advise on and obtain patient consent as to how their personal details will be collected, stored, and used [14].

Data security has become a far more serious issue stemming from technology use in drug health clinics as greater volumes of data are generated and used in novel ways. Therefore, drug health information requires special protection against threats such as hacking and malware. Malicious or mistaken breaches of sensitive patient data can result in serious consequences such as reputational damage, emotional distress, stigma, and public health concerns [58]. Data security issues can also arise during telehealth consultations of people with SUD by being hacked when using video visits, using unprotected devices, public Wi-Fi, when there is low health digital literacy, or a lack of familiarity with online platforms [59]. Breach of data security during telehealth will have the same legal consequences as breaching data security of the patient’s medical record.

Recently, hacking by state actors has gained prominence. This is exemplified in the recent class action that is being brought against the private health insurer Medibank, where thousands of patient’s health records were published by ransomware hackers [58]. Frequently, hackers are external to health care and are linked to political or profit motives [58,60]. For example, the Australian National University lost the data of 200,000 patients covering a 19-year period due to a cyberattack believed to have been perpetrated by a sophisticated state actor [16]. In Australia, where those responsible for such attacks can be identified and brought before the courts, a range of criminal offenses exist under the Criminal Code Act 1995 (the Commonwealth; Cth) [61] and the Cybercrime Act 2001 (Cth) [45,62]. Australia participates in international approaches to support data security such as becoming a signatory to Europe’s Convention on Cybercrime [45,63]. However, it must be acknowledged that bringing perpetrators to justice is not always possible, and this does not undo the damage to patient confidentiality or privacy.

Thus, when providing health care through telehealth, patients need to be informed of privacy choices and data security measures the practitioner is adopting. Clinicians must avoid disclosure of sensitive personal information. In determining policy on data sharing, the interests of the individual need to be balanced against the risks [64].

The legal ramifications regarding the provision of health care through telehealth consultation are largely untested. Courts will continue to consider what is reasonable in the provision of health care on a peer standard test. Practitioners who do not adopt appropriate technology or take reasonable and necessary precautions to secure patient information face potential legal action [65]. Clinicians, all users, software developers, and algorithm developers are all potentially liable. Hence, software and algorithm developers cannot be the only ones responsible for issues regarding technology [45].

Thus, health professionals should be aware that they have all the medicolegal risks of face-to-face consultations, and potentially an increased risk because of the limitations of telehealth in obtaining informed consent and the absence of physical examination. Special attention should be given to prevent errors and omissions, negligent credentialing, breaches of privacy, and interruptions of service due to equipment or technology failures. Clinicians need to be aware of what exactly their liability insurance policy covers, especially when providing telehealth services in other jurisdictions [47].