Telehealth Rules, HIPAA, and Healthcare

NAVIGATING THE RELAXED TELEHEALTH RULES

Traversing the labyrinth of HIPAA related regulations and guidelines is difficult enough as it is, but the COVID-19 seems to have toggled on a “challenge mode” for medical professionals and healthcare attorneys in their efforts to comply. The privacy of patient Protected Health Information, or PHI, is seemingly constantly attacked, both as it relates directly to COVID-19 (especially in the context of contact tracing), and indirectly, as healthcare offices deal with the fallout from lockdowns and varies-by-the-week social distancing rules.

Of special concern to medical professionals is the new importance of video conferencing technology is the field of medicine. In response to the COVID-19 pandemic, the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) has announced that they are relaxing enforcement of certain HIPAA rules as it relates to providing telehealth.[1] While this relaxing of enforcement was meant to be helpful, (to be clear, it is helpful) it is also confusing for many professionals, because yet again the rules are changing. This article seeks to remove mystery from the new regulation and provide clarification on how telehealth works in the world of masks and social distancing.

On its most basic level, OCR has stated that they will not prosecute or enforce violations of HIPAA rules if they are violated in a good faith effort to communicate with patients and provide care through remote communication systems.[2] There is a lot to unpack there, but the skinny is this: Healthcare professionals can provide telehealth to patients as long as they are trying to follow the rules. That seems simple enough. However, there are a few caveats and things that healthcare professionals must keep in mind:

First is that there are limitations for which video services providers and patients can use. OCR has stated that, even under the relaxed rules, not just any video service will be sufficient. Video services must be private facing, and not public facing.[3] This means that FaceTime, Hangouts, Zoom, and Facebook Messenger video are all ok to use. However, apps like Facebook live streaming, TikTok, and Twitch are not allowed for telehealth services, because they all broadcast to the public. Providers would also do well to inform their patients that provide telehealth services may not be completely private.

Next is that a wide variety of services can be provided through telehealth. OCR and HHS made it clear that this does not just apply to COVID patient. Medical professionals can consult with potential COVID patients, as well as patients regarding other health issues, such as a sprained ankle, dental consultation, or even a mental health consultation. In reality, OCR and HHS have stated that a provider can really provide any sort of services that they feel like 1- the patient needs, and 2- can reasonably be provided remotely. [4] This means that the services listed above can all be provided remotely, but that a physician probably cannot in good faith give a patient instruction on how to operate on themselves over a video or phone call.

As well, providers should bear in mind that this is not a sudden free-for-all to relax their standards regarding PHI, or chart or note taking (more on that in a bit). Providers should still treat PHI very seriously, and use all reasonable measures to continue to protect it. Part of the ‘good faith effort’ required by OCR is that providers continue to follow other rules related to PHI. It seems obvious, but it bears pointing out that this is not an excuse to suddenly start giving away or selling PHI, seeing several patients simultaneously, or start giving prescriptions to anybody who wants them.[5]

And that is a great transition to our last note here. Even with the relaxed standards for telehealth, these are still considered patient visits. Providers must continue to have scheduled and set aside time for patients, take all proper chart notes, document symptoms, do proper workup for prescriptions, and do anything and everything else that they ordinarily would with a patient encounter. In fact, these charting may be more important now than ever, as scrutiny for prescriptions will likely be increased greatly with the continued increase in telehealth services.

That covers the basics of the relaxed telehealth rules as it relates to HIPAA. These rules are here for as long as the pandemic lasts, and currently do not have an expiration date.[6] There are other rules that we will review at another time, such as with Medicare,[7] but the information contained here covers the initial ideas.

At Irvine Legal, we have vast experience with healthcare law, and would be happy to answer any questions that you have as it relates to telehealth, or anything else healthcare related. All the best, and stay safe.

[1] https://www.hhs.gov/hipaa/for-professionals/faq/3023/what-may-constitute-bad-faith-in-the-provision-of-telehealth-by-a-covered-health-care-provider-which-would-not-be-covered-by-the-notification-of-enforcement-discretion-regarding-covid-19-and-remote-telehealth/index.html

[2] Id.

[4] https://www.hhs.gov/hipaa/for-professionals/faq/3022/what-telehealth-services-are-covered-by-the-notification-of-enforcement-discretion-regarding-covid-19-and-remote-telehealth-communications/index.html

[5] See https://www.hhs.gov/hipaa/for-professionals/faq/3023/what-may-constitute-bad-faith-in-the-provision-of-telehealth-by-a-covered-health-care-provider-which-would-not-be-covered-by-the-notification-of-enforcement-discretion-regarding-covid-19-and-remote-telehealth/index.html

[6] https://www.hhs.gov/hipaa/for-professionals/faq/3020/when-does-the-notification-of-enforcement-discretion-regarding-covid-19-and-remote-telehealth-communications-expire/index.html

[7] For a very high level overview, see here: https://www.hhs.gov/coronavirus/telehealth/index.html