OCR's guidance on HIPAA compliance for telehealth in the post-Covid future

When the Covid pandemic began, many health care providers wanted to make use of telehealth to continue providing care while limiting exposure. However, providers worried that remote communications technologies could violate the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. In March 2020, the Office for Civil Rights (OCR) notified health care providers that it would use enforcement discretion in applying HIPAA so that care could be furnished remotely as long as reasonable precautions were taken to protect confidentiality. However, this notification will expire when the Covid public health emergency (PHE) is no longer in effect.

On June 13, 2022, OCR published guidance on how providers may continue to use audio-only telehealth once the PHE expires. OCR notes that health care providers must use reasonable safeguards to limit incidental disclosures of protected health information (PHI), by using a private office if available, or if not, by avoiding use of a speakerphone. OCR also states that if the patient is not known to the provider, the provider must verify the identity of the patient, either orally or in writing (which could include using electronic methods).

OCR notes that the HIPAA Security Rule does not apply to audio-only telehealth services if the provider is using a landline, because the information transmitted is not electronic. However, electronic communication technologies do require compliance with HIPAA Security. This would include smartphone apps, Voice over Internet Protocol (VoIP) technologies, and messaging services that electronically store audio messages. Providers using these technologies should address the vulnerabilities in their security risk analysis, including whether risks can be mitigated with use of encryption. OCR points out that the HIPAA rules apply only to the health care provider end of the communication: the patient may use any telephone system they choose.

Finally, OCR addressed when a provider must have a business associate agreement (BAA) with a vendor providing telecommunications services (TSP). If the TSP has only transient access to PHI being transmitted, no BAA is required because the TSP is merely a conduit. However, if the service provided by the TSP includes storing recordings or transcripts, then a BAA is needed.

Employer health plans increased telemedicine coverage during 2021

The Kaiser Family Foundation (KFF) released its annual survey of employer-sponsored insurance on November 10, 2021. The survey reflects health benefits offered in 2021 by private and non-federal public employers with three or more workers: over 155 million persons. For 2021, KFF found that 95% of firms with 50 or more employees covered some health care services provided through telemedicine, up from 85% in 2020 and 67% in 2018.

Among firms offering telemedicine benefits, 79% of large firms (200 or more employees) and 61% of small firms made some changes to their telemedicine benefits. Many employers (66% of large employers and 47% of small firms) increased employee communication about telemedicine resources. Benefit changes included expanding the number of services covered through telemedicine (35% of large firms and 19% of small firms); expanding the number or types of telemedicine providers (33% of large firms and 19% of small firms); expanding coverage for additional modes of delivering telemedicine, such as by phone (36% of large firms and 30% of small firms; and expanding the settings or locations where covered persons may use telemedicine (28% of large firms and 22% of small firms). Some employers eliminated or reduced cost-sharing for telemedicine services (27% of large firms and 15% of small firms).

OIG reports most Medicare beneficiaries using telehealth had an established relationship with a provider

The Office of Inspector General (OIG) of the Department of Health and Human Services published a data snapshot dated October 2021, examining telehealth utilization by Medicare beneficiaries from March to December 2020. During this period, 26 million Medicare beneficiaries (39% of all Medicare beneficiaries) received at least one telehealth service. The OIG found that 84% of Medicare beneficiaries received all their telehealth services from providers with whom they had an established relationship. For office visits, 83% of beneficiaries had an established relationship. Office visits were the most common type of telehealth service, accounting for nearly half of all telehealth services (45.5 million office visits). Beneficiaries receiving home visits via telehealth were the least likely to have an established relationship with their provider (34%). However, home visits were only 1% of all services provided via telehealth.

There were some differences in telehealth utilization between beneficiaries in traditional Medicare and Medicare Advantage plan enrollees. This is not unexpected, since Medicare Advantage plans had greater flexibility to cover telehealth services prior to the pandemic. During the study period, one third of beneficiaries in traditional Medicare received telehealth services compared to 45% of Medicare Advantage enrollees. A slightly larger percentage of traditional Medicare beneficiaries (86% compared to 81%) had an established relationship with the telehealth provider compared to Medicare Advantage enrollees, except for physical, occupational and speech therapy. Both traditional Medicare and Medicare Advantage beneficiaries with established provider relationships had an in-person visit with the provider an average of four months prior to the first telehealth service.

Comment: this study should be reassuring to policymakers who worry that expanding telehealth eligibility permanently would open the floodgates to Medicare fraud. It suggests that Medicare beneficiaries are generally using telehealth as an adjunct to regular provider relationships.

American Board of Telehealth offers online certificate program

The American Board of Telehealth is offering a online certificate program called the CORE (clinical, operational, regulatory and ethics) Concepts in Telehealth. The organization also offers teleprimary care and telebehavioral health certificate programs.

HRSA awards $19 million for telehealth

The Health Resources & Services Administration (HRSA) awarded $19 million in grants to 36 recipients to improve telehealth in rural and underserved communities. The largest awards of $3,250,000 each went to two academic medical centers (the University of Mississippi Medical Center and the Medical University of South Carolina) for the establishment of telehealth centers of excellence (COEs). The intent is that the COEs will assess strategies to use telehealth to improve health care in rural medically underserved areas, establish an evidence base for telehealth programs, serve as incubators to pilot new telehealth services and publish research on outcomes for telehealth.

 

Applicants for the Telehealth Technology-Enabled Learning Program were awarded $4,242,350 to build sustainable tele-mentoring programs and networks in rural and medically underserved communities. The purpose of the program is to connect specialists at academic medical centers with primary care providers in rural and other underserved areas to help treat patients with complex conditions, including long-haul COVID and substance use disorders. These awards will go to the American Academy of Pediatrics and eight academic and research institutions. Two national telehealth resource centers in Alaska and California each received $325,000 in grants, with twelve awards totaling $3,900,000 going to regional telehealth resource centers. The two national centers will provide expert resources on telehealth policy (including reimbursement, licensing and privacy) and telehealth technology. The regional resource centers will provide assistance to organizations providing telehealth services to patients, focusing on local community needs. Finally, eleven awards totaling $3,812,826 will be directed to the Evidence-Based Direct to Consumer Telehealth Network Program.

Australia continues expanded telehealth coverage until December 31, 2021

The Australian government appropriated an additional AUS$114 million to extend coverage of telehealth services until the end of calendar year 2021. Expanded telehealth coverage had originally been scheduled to expire on June 30, 2021.

Illinois expands access to telehealth services and mandates certain insurance coverage

A new Illinois law, P.A. 102-0104 effective July 22, 2021, expands and modernizes the definition of telehealth services. The law also requires insurers issuing individual or group policies in the state after the effective date to cover certain types of telehealth services. (As with most state insurance regulation, self-funded employer plans would not be affected.)

 

Telehealth was defined in prior law as the evaluation, diagnosis or interpretation of electronically transmitted patient-specific data between a remote location and a licensed health care professional that generates interaction or treatment recommendations. The new definition of telehealth services retains this definition, but adds a specific reference to mental health treatment and substance use disorder treatment services to a patient, regardless of patient location. The definition of telehealth services also includes asynchronous store and forward systems, remote patient monitoring technologies, e-visits and virtual check-ins. An asynchronous store and forward system involves transmission of a patient's medical information through electronic communications from an originating site to a health care professional or facility at a distant site that does not include real-time interaction. Remote patient monitoring means the use of connected digital technologies or mobile medical devices to collect medical and other health data from a patient at one location and electronically transmit the data to a health care professional or facility at a different location.

Read more ...

View LinkedIn Profile

Shack Cookies Restrict

This website uses cookies to properly administer the site and improve your experience. Continuing to use this website indicates your acceptance. Please click "accept" to remove this message.