Health Law Monitor

With an Extension Likely, Telehealth Seems Here to Stay

October 6, 2022

By: M. Jane Brannon

Telehealth is a growing trend in medicine.  From 2019 to 2020, telehealth use increased an eye-popping 3000%, not including Medicaid and Medicare claims.  Although the claims have decreased slightly as of 2021, telehealth is clearly here to stay and with it comes new challenges.

What is Telehealth?

For the purposes of Medicare, “telehealth services” are “professional consultations, office visits, office psychiatry services and any additional services specified by the Secretary” that are furnished via a telecommunications system by an eligible physician or practitioner to an eligible telehealth individual. Social Security Act, Sec. 1834(m)(4)(f).  A “telecommunications system” means “multimedia communications equipment that includes, at a minimum, audio and video equipment permitting two-way, real-time interactive communication between the patient and distant site physician or practitioner.” 42 CFR 410.78(a)(3).

Telehealth does not include:  

1. Communication Technology-Based Services (CTBS) – These are brief check-ins, not face-to-face with a patient via communication technology, to assess whether the patient’s condition necessitates an office visit.  They are not subject to the originating site, geography, and technology restrictions;
2. Remote Physiologic Monitoring  (RPM) – This is remote evaluation of recorded video and/or images and subsequent communication time with the patient within twenty-four hours; or
3. Audio-Only Evaluation and Management – As the name says, audio-only interactions, like phone calls with a patient.

Conditions for Medicare Payment – A Comparison

Five key conditions for Medicare payment have been significantly altered in the wake of the Public Health Emergency (PHE)  declaration.  Once the PHE ends, some of the waivers and exceptions will end.[1]  It is important, then, to be aware of what the conditions for reimbursement for telehealth payments were pre-PHE and what they are currently.

1. Identified Telehealth Services -

Prior to the PHE, the CMS was required to maintain a list of telehealth services that would be reimbursed by Medicare which was updated on an annual basis.  Presently the Telehealth Service List changes with the Physician Fee Schedules.  The 2021 Physician Fee Schedule added services on a permanent basis as well as services that are reimbursable through the end of the year in which the PHE ends.  The permanent additions include group psychotherapy; psychological and neurological testing; home visits for established patients; and cognitive assessment and care planning services.

1. Geography –

Prior to the PHE, Medicare restricted telehealth services to areas 1) in a Rural Health Professional Shortage Area; 2) located in a county that is outside of a Metropolitan Statistical Area; or 3) from an entity that participates in a federal telemedicine demonstration project.  Since the PHE, however, patients can be located anywhere, not just in rural areas.

1. Location of the Patient (“Originating Site”)  –

Prior to the PHE, only specific defined facilities, such as doctors’ offices, qualified, but now the patient may be located anywhere, including their home.

1. Eligible Practitioners –

Prior to the PHE, only specific, identified practitioners could be reimbursed and they had to be licensed and credentialed at both the originating and distant sites.  At present, any practitioner eligible to bill Medicare became eligible to bill for telehealth.

1. Telecommunications Technology –

Audio-only technologies have been added whereas before only interactive, real-time, audio and video telecommunications were allowed.

Unless Congress passes authorizing legislation,  CMS (Centers for Medicare & Medicaid Services) does not have the authority to extend the originating site and geographic restriction waiver beyond the end  of PHE. Without additional action, 151 days after the PHE ends, the waivers will expire and the rules will revert to pre-PHE standards.

HIPAA –

The provision of telehealth services implicates privacy concerns governed by HIPAA and its implementing regulations, including the HIPAA Security Rule and the HIPAA Privacy Rule.  The HIPAA Security Rule requires covered providers to protect patients' electronically stored, protected health information (known as “ePHI”) by using appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of this information.  Providers should conduct their telehealth appointments in private spaces to maintain patient privacy.  They are encouraged to educate their patients on privacy issues and to determine whether the patient’s home environment is private and safe for their appointment.

Pre-PHE, health care providers were required to use HIPAA-compliant communications, including signing a business associate agreement (BAA) with telecommunications vendors; however, during the PHE, the Office of Civil Rights has indicated that it will not enforce or impose penalties for good-faith use of non-public facing audio or video communication products for the delivery of telehealth services even if a BAA is not in place. Acceptable non-public facing applications include FaceTime; Facebook Messenger video chat; Google hangouts; Zoom; and Skype.  Public-facing applications such as Facebook Live; Twitch and TikTok are not acceptable. The HIPAA Security Rule does not apply to landlines (audio-only telehealth) because they are not electronic in nature (although other HIPAA requirements, including those in the HIPAA Privacy Rule, may still apply).  The HIPAA Security Rule applies to internet, cellular and wi-fi communications.

State Licensure Issues –             

Under Covid-19 waivers, Medicare allows reimbursement for services provided by a physician licensed in one state to a patient located in another state; however, state licensing requirements may limit what a provider may do.   Every state considers the practice of medicine to occur in the state where the patient is located.  Delivering services to a patient in a state in which a provider is not licensed may constitute the unauthorized practice of medicine and may subject that provider to discipline. During the pandemic, many states enacted emergency legislation or orders permitting out-of-state-practitioners to deliver healthcare services to patients in their states.  This generally requires that the practitioner register with that state’s licensure board. Issues may also arise around remote prescribing.  Remote prescribing is regulated at the federal level by the Drug Enforcement Agency and most generally be based on an initial in-person medical evaluation.  During the PHE, however, exceptions were created allowing prescribers to issue prescriptions for controlled substances  to patients they have not examined in-person if:

1. The prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of her professional practice;
2. The telemedicine communications is conducted using an audio-visual, real-time, two-way interactive communication system; and
3. The practitioner is acting in accordance with applicable state and federal laws.

With the return of a sense of normalcy in this post-pandemic era, telehealth will remain an ever-evolving area of medicine requiring that practitioners be aware of the constantly changing landscape.

[1] The current end date of the PHE is October 15, 2022. However, another extension is expected as HHS Secretary Xavier Becerra indicated he would give states and providers a 60-day notice before ending the PHE, and no such notice has been provided to date.

• M. Jane Brannon