Health Law Monitor
Federal Government Temporarily Expanding Telehealth in Response to COVID-19
March 17, 2020
By: Alaina N. Crislip and Derrick L. Maultsby, Jr.
The COVID-19 global pandemic caused the President of the United States to declare a national emergency. During this nationwide public health emergency, when clinical health care providers (“clinicians”) are in high demand and short supply, it is increasingly important for clinicians to seek innovative ways to help as many patients as possible. One of those ways is through telehealth. Telehealth encompasses a broad variety of technologies and tactics to deliver virtual medical, health, and education services. Telehealth is not a specific service, but a collection of means to enhance care and education delivery. Today, CMS announced a plan to broaden Medicare coverage to include telehealth services and to loosen regulatory enforcement of HIPAA surrounding telehealth.1
Telehealth Coverage Under Medicare
CMS is expanding telehealth benefits through Medicare 1135 waiver authority.2 Centers for Medicare and Medicaid Services now have the authority to waive certain Medicare requirements so that care can be provided outside of traditional in-person doctor visits and to eliminate telehealth payment constraints in Medicare. Prior to this announcement, a beneficiary generally would not be able receive telehealth services in their home.
With the 1135 waiver authority in place, patients can seek telehealth services such as video conferencing and telephones that have audio and video capabilities, making it easier for clinicians to provide beneficiaries with the attention they need. The flexibility provided through this waiver authority will allow clinicians to see more patients than in a traditional office or hospital setting. This should also allow for a more rapid response in identifying symptoms and decreasing the impact of COVID-19.
Telehealth and HIPAA
The Office for Civil Rights (“OCR”) within the U.S. Department of Health and Human Services (“HHS”) is responsible for enforcing certain regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, to protect the privacy and security of protected health information, namely the HIPAA Privacy, Security and Breach Notification Rules (“the HIPAA Rules”). OCR announced in its Notification of Enforcement Discretion for Telehealth3 (“Notification”) that it will exercise its enforcement discretion and will not impose penalties for noncompliance with regulatory requirements in connection to covered health providers usage of telehealth.
OCR has stated that covered clinicians may utilize video or audio technology to communicate with patients for any reason, regardless of whether the telehealth services is related to the diagnosis and treatment of health conditions related to COVID-19 using non-public facing remote communication. Applications such as Apple FaceTime, Facebook Messenger, or Skype, may be utilized by healthcare providers without risk of penalty for noncompliance with HIPAA. However, clinicians are encouraged to notify patients of the privacy risks associated with the use of these third-party applications. OCR emphasizes that clinicians should enable all available encryption and privacy settings when utilizing these applications. Clinicians who are seeking further privacy protection when utilizing video communication products to administer telehealth should engage in HIPAA compliant Business Associate Agreements with technology vendors offering HIPAA-compliant platforms. Effective today, clinicians can proceed with utilizing non-traditional HIPAA telehealth options as identified in OCR’s Notification and not face penalties, even if the clinician does not have a HIPAA compliant Business Associate Agreement in place.
Federal responses to the rapidly evolving COVID-19, such as provided in this OCR Notification should ease the minds of front-line clinicians and other providers of care to proceed to provide much needed health care services via telehealth, even non-compliant, non-traditional means of telehealth. These almost daily sweeping changes from federal regulatory bodies is an effort to enable clinicians with the tools necessary to combat COVID-19.
1 Notification of Enforcement Discretion for Telehealth: https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html (accessed March 17, 2020).
2 Medicare Telemedicine Health Care Provider Fact Sheet https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet (accessed March 17, 2020).
3 Supra Note 1.