The use of remote health care services, broadly classified as telehealth, has had many fans in the medical world. Some programs, like a pilot in California, pair primary care and specialty physicians together for patients with limited access.[1] Others, like Intermountain Healthcare, have launched larger scale programs or “virtual hospitals.”[2]
But with the Centers for Medicare & Medicaid Services and the HHS Office for Civil Rights (OCR) both taking actions to facilitate telehealth during the COVID-19 pandemic, over a two-week period or so, the field expanded to a place it had not reached over the past decade.
Still, experts warn that the administrative waivers and expressions of enforcement discretion are time-limited, and that covered entities (CEs) and their business associates (BAs) should really try to follow as many routine HIPAA practices as they can to shield protected health information (PHI).
“I always recommend being as compliant as possible when setting up a telehealth or any other new program,” says attorney Richelle Marting. CEs and BAs are in for a tough go of it, especially now, she says, with so much regulatory change and the unknown of what requirements will be after the national health emergency.
OCR Offered Some Dos and Don’ts
On March 17, OCR Director Roger Severino announced the agency would “exercise its enforcement discretion and will not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency.”[3] OCR also issued a related FAQ document.[4]
The discretion is necessary to enable telehealth, the agency said, because some “remote communication technologies” that providers use “and the manner in which they are used by HIPAA covered health care providers…may not fully comply with the requirements of the HIPAA Rules.”
But OCR advised that “Facebook Live, Twitch, TikTok, and similar video communication applications are public facing, and should not be used in the provision of telehealth by covered health care providers.”
Instead, during the emergency, “providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency,” the agency said.
While a business associate agreement (BAA) would be standard with a telehealth vendor, during the emergency OCR isn’t demanding one and won’t pursue enforcement if one is lacking (again, just during the emergency). But it provided a list of “some” vendors who are ready to sign BAAs and purport to be HIPAA compliant, OCR said, for those CEs desiring “additional privacy protections for telehealth.”
These include Skype for Business, Updox, VSee, Zoom for Healthcare and Doxy.me.
Additionally, CEs are “encouraged to notify patients that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications,” OCR said.
