Editor’s notes: After receiving hundreds of waiver requests from healthcare providers, state governments and state hospital associations during the public health emergency, the Centers for Medicare & Medicaid Services (CMS) temporarily suspended a number of rules, allowing for more than 80 additional services to be furnished via telehealth through interactive apps with audio and video capabilities or audio phones only. These waivers include, but are not limited to, emergency department visits, initial nursing facility and discharge visits, remote patient monitoring services, home visits, and therapy services for both new and established patients.
The CMS is also allowing physicians to supervise clinical staff using virtual technologies when appropriate, instead of requiring in-person presence. However, it should be noted that these changes are temporary and apply only for the duration of the national emergency declaration and that individual state regulations may still be in place. Check with your state medical board for up-to-date information, and review the Federation of State Medical Board’s current list of telehealth waivers by state.
Steven M. Harris, Esq.
Telemedicine has been around for more than 40 years. It started with physician consultations over the telephone and, due to advances in technology, has expanded significantly in how it is used by collaborating physicians and across practice areas to provide various types of treatment. According to the American Hospital Association, approximately 80% of hospitals use telehealth services in some capacity to reach patients.
Recent changes in state and federal laws have made telemedicine services more likely to be covered and reimbursed by insurance companies, benefitting both providers and patients. Now more than ever, patients have the opportunity to receive quick, affordable treatment in virtually any location. However, physicians should be aware that telemedicine coverage and reimbursement varies significantly by state.
Recent reforms have expanded the access and use of telemedicine, but the legal and regulatory framework has many layers and can create compliance hurdles.
What Is Telemedicine?
Telemedicine is the remote diagnosis and treatment of patients provided through the use of telecommunications technology. The most common communication channels for telemedicine include:
Store & forward: An asynchronous way to share patient medical information, such as lab reports, imaging, videos and other records. Twenty-nine states and Washington, D.C., cover store-and-forward telehealth services.
Remote patient monitoring (RPM): RPM allows healthcare professionals to track a patient’s vital signs and activities at a distance and over time. Twenty-two states and Washington, D.C., cover remote patient monitoring, but the type of condition covered varies by state. For example, Texas covers RPM services for cancer, asthma and hypertension, but Arizona covers RPM only for congestive heart failure.
Real time: This category covers synchronous audio or video interaction—what most people actually consider to be telemedicine. All states cover this form of telemedicine, but some states, including Alaska, Maine, New Jersey and Oregon, reimburse for audio-only technology.
Legal & Regulatory Framework
Telemedicine is governed primarily by state laws and regulations, with layers of federal law regarding patient privacy under the Health Insurance Portability and Accountability Act (HIPAA), restrictions on the teleprescribing of controlled substances under the purview of the U.S. Drug Enforcement Administration (DEA), and service location limits under the Centers for Medicare & Medicaid Services (CMS).
State Laws
Medical licensure & corporate practice of medicine—To provide medical services, including telemedicine services, to a resident of a state, the treating physician is generally required to be licensed in that state. There is no comprehensive licensing scheme for telemedicine, so physicians must comply with licensure requirements in every state in which they seek to provide telemedicine services.
According to the American Telemedicine Association (ATA), 41 states have passed laws aimed at improving coverage and reimbursement of telehealth services since 2017. Thirty states have adopted the Federation of State Medical Boards’ Interstate Medical Licensure Compact, which allows for expedited licensure in the participating states.
Alternatively, six states, including Maryland and Virginia, have adopted laws for neighboring state reciprocity, and nine other states have created special telemedicine certificates that can be issued to out-of-state providers. These nine states are: Alabama, Louisiana, Minnesota, Nevada, New Mexico, Ohio, Oregon, Tennessee and Texas. Upon issuance, this certificate enables a provider to engage in telemedicine in accordance with the parameters governing such certificates.
An additional consideration is whether a state has a corporate practice of medicine prohibition, which generally prohibits corporations from practicing medicine or business entities from employing physicians to provide medical services. For example, in California, any business or management decisions that result in control over a physician’s decision making must be made by a licensed California physician and not by an unlicensed person or entity.
Telemedicine can be very expensive, and large corporations are generally in the best position to afford the resources required to provide telemedicine services. Even if there is no corporate practice of medicine prohibition in the state where the corporation is located, the state in which the telemedicine services are provided may have such a prohibition, which effectively precludes the corporation from operating in that state. If telemedicine services are provided by the corporation, it may be in violation of the law and subject to penalties—unless an exception to the law applies.
Standard of care & prescribing—The American Medical Association (AMA) recommends a patient-physician relationship be clearly established before the provision of any telemedicine services to a patient, including teleprescribing. However, each state has different requirements.
Knowing when a physician-patient relationship forms is not only important, it is vital to avoid adverse treatment consequences and, ultimately, malpractice actions. Some states require initial face-to-face encounters prior to the commencement of telemedicine services, while other states permit a consultation with another physician who has an ongoing relationship with the same patient.
Regarding teleprescribing, certain states require a physical exam in person prior to authorizing prescribing, while others allow a telehealth exam before prescribing can occur.
Reported cases in which physician-patient relationships were not clearly established have resulted in patient lawsuits against physicians alleging neglect or abandonment. For this reason, many states also require the physician to agree to supervise the patient’s care, rather than merely to engage in isolated transactions.
Informed consent—The ATA recommends obtaining informed patient consent as a best practice, but it is actually required by law in 39 states, and often before a patient can begin a telemedicine treatment program. Some states require a standard form to be signed, but others permit a patient’s oral statement at the beginning of a telemedicine session.
Not only is failure to obtain proper patient consent a potential issue for malpractice, it is a requirement for reimbursement through some states’ Medicaid plans. Georgia is one state with a robust policy on telemedicine informed consent and provides a good example form in its Medicaid Telehealth Manual.
Federal Laws
HIPAA—Under HIPAA, telemedicine providers should permit only authorized users to have access to protected health information (PHI). This means using business associate agreements (BAAs) with medical billing services, information technology (IT) consultants or other vendors of healthcare services, such as pharmacy benefit managers.
Telemedicine providers are expected to use “reasonable and appropriate safeguards” to prevent PHI breaches, including data and cyber security software programs. Telemedicine providers should consider monitoring access through the use of an external IT company, because providers will engage in live or recorded treatment sessions and communication with patients, which could include the transmission of medical records, visual images, live or recorded video of the patient—all potentially subject to hacking through weak internet networks.
Note: On March 17, the U.S. Department of Health & Human Services (HHS) Office for Civil Rights announced it would waive potential penalties for HIPAA violations against any healthcare providers treating patients through remote technology communication during the COVID-19 health emergency. This OCR penalty discretion permits physicians to use widely available applications, such as Skype, Facebook Messenger or Google Hangouts, to assess and treat patients with suspected COVID-19 symptoms or non-COVID-19 medical conditions for convenience and to help limit the spread of possible infections.
The Ryan Haight Act—Generally, teleprescribing is limited under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, which restricts the prescribing of controlled substances over the internet, but does not consider the use of email or telephone as “telemedicine.”
This law has become a barrier to providers engaged in a variety of practice areas who prescribe controlled substances for seizures, chronic pain or other patient medical conditions, because it requires any provider issuing a prescription for a controlled substance to be in a DEA-registered hospital or clinic and the prescriber must registered with the DEA in every state where a patient is located.
The DEA is expected to release a new, telemedicine registration rule to decrease restrictions on teleprescribing across state lines. It currently provides exceptions only to its registration requirement for teleprescribing under the Veterans Administration benefit plans, for substance abuse treatment or in emergencies. However, the DEA recently released guidance giving flexibility for teleprescribing subject to several conditions, but only for use during the emergency period.
CMS regulations—Since 2018, the CMS has significantly expanded telemedicine services that may be reimbursed by Medicare and now includes remote check-ins, remote patient monitoring and interprofessional or internet consultations. The CMS announced that, starting this year, Medicare Advantage plans can offer patients telehealth and telemental health services as basic benefits under their plans. These Part C telemedicine benefits can be used from any location, including the patient’s home.
With respect to Part B reimbursement for telemedicine services, except for a few limited exceptions, all telemedicine services must originate from an in-person, face-to-face encounter. This is called the originating site requirement and provides that an originating site fee be paid to the originating facility that has a patient consultation on site prior to the start of any telemedicine services. The originating site facility fee is a separately billable Part B payment and is subject to post-payment review.
Note: On March 6, the Telehealth Services During Certain Emergency Periods Act gave the HHS secretary the authority to expand the use of telehealth services during the coronavirus emergency period. As a result, the secretary waived or modified standard restrictions on patient originating sites and telephone use when the telehealth services are furnished by a physician or non-physician practitioner. On April 30, CMS issued a second expansion of telehealth services for certain practitioners and for several types of reimbursement, notably increasing the rate for telephone visits retroactive to March 1, 2020.
Editor’s note: The ACR has telehealth guidance specific to rheumatology practices, including some of the codes to use for billing purposes.
Reimbursement Challenges
The 41 states that have passed laws aimed at improving the provision of telemedicine services have also sought to increase reimbursement for such services. Parity laws account for most of these reforms, which require both private payers and government payers providing Medicaid services to cover or reimburse telemedicine services at the same rate for the same services that would be provided in-person to a patient in an office setting. Coverage rates still vary by policy, as do the covered telemedicine services under each state’s insurance laws and Medicaid regulations.
Private Payer
Currently, 36 states and Washington, D.C., have existing laws that require private insurance companies cover patients’ telemedicine services at equivalent rates to appointments held in person at physician offices, hospitals or other clinical locations.
Sixteen states also have parity laws that require providers be reimbursed for telemedicine services at rates equivalent to services provided in person.
Thirteen states have not adopted parity policies, but telemedicine is nonetheless covered to some degree by primary health insurance companies, including Aetna, Blue Cross Blue Shield, Cigna, Humana and UnitedHealthcare.
Medicaid
Reimbursement for Medicaid covered services, including those with telemedicine applications, must satisfy federal requirements for efficiency, economy and quality of care. Medicaid covers some forms of telemedicine service in every state and offers coverage and reimbursement parity in the majority of states.
Since 2018, the CMS has increased the telehealth services that are eligible for provider reimbursement beyond traditional consultation or inpatient and outpatient visits to include preventive services, education and counseling sessions, and even care management or virtual check-ins.
Like Medicare, Medicaid in some states has an originating site requirement, and 12 states actually consider a patient’s home to be an originating site for payment purposes. Nineteen states have not yet adopted Medicaid parity policies, so changes to the regulations in those states are anticipated at some point.
In addition, many states, such as Ohio, generally don’t consider telephone services to be a reimbursable medium for the provision of telemedicine.
Note: On March 17, the CMS released Medicaid telehealth guidance to the states to help states better understand policy options for paying Medicaid providers using telehealth to deliver patient services in combating the coronavirus. The CMS encouraged providers to use telehealth services due to the benefit of increasing access to care while reducing both the risks for spread of infection and exposure to vulnerable populations.
Is Telemedicine Right For You?
Consider the ways in which using telemedicine may benefit your practice. Many physicians in different practice areas have acknowledged the benefits of physician collaboration for consultation and second opinions; other providers have confirmed significant cost savings by seeing patients remotely and having the ability to reduce overhead costs. Moreover, telemedicine provides a way to expand your patient population to reach those individuals outside a saturated service area or add new patients, while efficiently using available time that would not be possible with in-person patient visits.
The caveat remains—knowing the nuances of state and federal laws is critical to avoid potential malpractice lawsuits, HIPAA or privacy breaches, or fraud and abuse violations, among other things. Review the points below:
The Benefits
- Decreased provider burnout;
- Decreased communicable diseases;
- Increased number of patients reached;
- Increased services to rural areas;
- Reduced equipment and supply costs; and
- Reduced staffing shortages.
Avoid the Pitfalls
- Determine each state’s licensure requirements;
- Enroll in malpractice, cyber and (if applicable) product liability insurance;
- Remember the patient’s state controls the standards of care and informed consent;
- Implement adequate data and cyber security software and monitoring;
- Do not communicate with patients via unencrypted text, email or Skype
- Train yourself and staff on the technology and related programs or devices; and
- Take time to review private and government payer coverage and reimbursement policies for the services you intend to provide in each applicable state.
Review all current laws and regulations before implementing telemedicine in your practice.
Steven M. Harris, Esq., is a nationally recognized healthcare attorney with McDonald Hopkins LLC. Contact him at [email protected].
Updated April 7 to reflect new info from the CMS.
Updated May 5 to reflect more current information.
