On March 17, 2020, the Office for Civil Rights (OCR), under the United States Department of Health and Human Services (HHS), issued a “Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency” (Notification). The OCR generally is charged with enforcement of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA). In an effort to encourage the availability of communication options between health care providers and their patients, the Notification provides that OCR will exercise discretion and not impose penalties for noncompliance with HIPAA for providers providing certain telehealth services.
HIPAA traditionally prohibits the use of many common forms of technology to share patient protected health information (PHI). As of the Notification date, providers, in good faith, “can use any non-public facing remote communication product that is available to communicate with patients.” The use of these communication methods apply whether or not related to a COVID-19 issue. Providers should inform patients before providing telehealth services through these platforms that there may be potential privacy and security risks that cannot be managed, giving patients the opportunity to object or restrict what information is transmitted.
Examples of vendors that are deemed not to be public-facing include, but are not limited to:
- Skype for Business
- Apple FaceTime
- Facebook Messenger Video Chat
- Updox
- VSee
- Zoom for Healthcare
- Doxy.me
- Google G Suite Hangouts Meet
The following vendors are considered public-facing and should not be used to provide telehealth services:
- Facebook Live
- Twitch
- TikTok (and similar video communication applications)
Where possible, providers are encouraged to provide telehealth services through a vendor that will enter into a HIPAA-compliant business associate agreement (BAA). The OCR will not issue penalties, however, if a provider fails to enter into a BAA with video communication vendors or otherwise is non-compliant with HIPAA related “to the good faith provision of telehealth services during the COVID-19 nationwide public health emergency.”
It is important to note the Notification does not impact payor rules related to telehealth services. Providers should review whether a particular telehealth service meets payor reimbursement requirements before submitting a claim.
