HIPAA Enforcement Discretion for Telehealth Remote Communications

On Friday, March 20, 2020, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued guidance on telehealth remote communications following its Notification of Enforcement Discretion during the COVID-19 nationwide public health emergency (the notification). The notification advised that, effective immediately as of March 20, 2020, OCR would not impose penalties for HIPAA violations against health care providers in connection with their “good faith” provision of telehealth using certain communication technologies during the COVID-19 public health emergency.

Essentially, a health care provider can now provide telehealth services to its patients during the COVID-19 public emergency as long as it uses any “non-public facing remote communication” to conduct. The guidance notes that telehealth services may be provided “through audio, text messaging, or video communication” and CMS has stated that, “to the extent that many mobile computing devices have audio and video capabilities that may be used for two-way, real-time interactive communication they qualify as acceptable technology” for the provision of telehealth services. That implies that the use of laptops and phones are acceptable for telehealth purposes as long as the provider is using a non-public facing product as outlined in the FAQs and below. In addition this exercise of enforcement discretion applies to the provision of telehealth for any reason, regardless of whether the telehealth service is related to COVID-19.

The new guidance is in the form of frequently asked questions (FAQs) and attempts to clarify how OCR is applying the notification to support the provision of telehealth during this pandemic. Roger Servino, OCR director, has touted the provision of telehealth during the COVID-19 pandemic, stating, “[w]e are empowering medical providers to serve patients wherever they are during this national public health emergency.” The use of telehealth is essential in helping to treat patients during periods of socials distancing and both HHS and OCR have taken steps to reduce regulatory barriers and make telehealth available to more providers and patients.

Some of the FAQs and corresponding answers listed in the guidance include:

What entities are included and excluded under the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?

The Notification of Enforcement Discretion issued by the HHS Office for Civil Rights (OCR) applies to all health care providers that are covered by HIPAA and provide telehealth services during the emergency. A health insurance company that pays for telehealth services is not covered by the Notification of Enforcement Discretion.

What patients can a covered health care provider treat under the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications and does it include Medicare and Medicaid patients?

The notification applies to all HIPAA-covered health care providers, with no limitation on the patients they serve with telehealth, including those patients that receive Medicare or Medicaid benefits, and those that do not.

What is a “non-public facing” remote communication product?

A non-public facing remote communication product is one that, as a default, allows only the intended parties to participate in the communication.

According to OCR, non-public facing remote communication products would include, for example, platforms such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, or Skype. Such products also would include commonly used texting applications such as Signal, Jabber, Facebook Messenger, Google Hangouts, Whatsapp, or iMessage.

Typically, these platforms employ end-to-end encryption, which allows only an individual and the person with whom the individual is communicating to see what is transmitted. The platforms also support individual user accounts, logins, and passcodes to help limit access and verify participants.

In contrast, public-facing products such as TikTok, Facebook Live, Twitch, or a chat room like Slack are not acceptable forms of remote communication for telehealth because they are designed to be open to the public or allow wide or indiscriminate access to the communication. For example, a provider that uses Facebook Live to stream a presentation made available to all its patients about the risks of COVID-19 would not be considered reasonably private provision of telehealth services. A provider that chooses to host such a public-facing presentation would not be covered by the notification and should not identify patients or offer individualized patient advice in such a livestream.

Does the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications apply to violations of 42 CFR Part 2, the HHS regulation that protects the confidentiality of substance use disorder patient records?

No, the notification addresses the enforcement only of the HIPAA Rules. The Substance Abuse and Mental Health Services Administration (SAMHSA) has issued similar guidance on COVID-19 and 42 CFR Part 2, which is available here.

When does the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications expire?

The Notification of Enforcement Discretion does not have an expiration date. OCR will issue a notice to the public when it is no longer exercising its enforcement discretion based upon the latest facts and circumstances.

CMS Significantly Broadens Medicare Telehealth Payment Rules

On March 13, 2020, President Trump announced an emergency declaration under the Stafford Act and the National Emergencies Act. Consistent with President Trump’s emergency declaration, CMS is expanding Medicare’s telehealth benefits under the 1135 waiver authority and the Coronavirus Preparedness and Response Supplemental Appropriations Act.

Prior to this announcement, Medicare was only allowed to pay clinicians for telehealth services such as routine visits in certain circumstances. For example, the Medicare beneficiary receiving the telehealth services must live in a rural area and travel to a local medical facility to get telehealth services from a doctor in a remote location. In addition, the beneficiary would generally not be allowed to receive telehealth services in their home.

Recognizing the “imperative during this public health emergency that patients avoid travel, when possible, to physicians’ offices, clinics, hospitals, or other health care facilities where they could risk their own or others’ exposure to further illness,” CMS has temporarily dropped the requirement that patients must be located in a rural area of the country in order for treating providers to receive Medicare reimbursement for three main virtual services covered by the program: the telehealth visit, the e-visit, and the virtual check-in.

Additionally, the patient is no longer required to receive the service at a permissible originating site outside of the home (e.g., hospital, physician’s office, or skilled nursing facility). Patients receiving e-visit and virtual check-in services can be located in their home or any other location, and patients receiving telehealth visit services can receive the service at home or in any health care facility. The HHS Office of the Inspector General (OIG) is also using its waiver authority to permit providers to reduce or waive patient cost sharing for the telehealth visit. Further, Medicare telehealth services are generally billed as if the service had been furnished in-person. For Medicare telehealth services, the claim should reflect the designated Place of Service (POS) code 02-Telehealth, to indicate the billed service was furnished as a professional telehealth service from a distant site. Learn more here.

The relaxed payment rules apply to services on or after March 6, 2020, and will remain in effect during the COVID-19 nationwide public health emergency. CMS’ telehealth fact sheet is available here. FAQs on telehealth coverage are available here and the CMS General Provider Telehealth and Telemedicine Tool Kit can be found here.

This information is provided for informational purposes only and is not intended to constitute legal advice.