Do you remember where you were when the COVID-19 Public Health Emergency (PHE) was declared on Jan. 31, 2020? While it may seem like yesterday, you would be forgiven for not recalling your exact location over three years ago during what felt like an incredible whirlwind for the healthcare industry. One possible location you may have found yourself in was a meeting room, quickly trying to make adjustments to how you would deliver care during the pandemic. What emerged was a pleasant surprise. Not only did healthcare providers implement telehealth to respond to the pandemic, but it was largely successful—and popular.
For clinicians, that meant any number of routes could be used to conduct a telehealth service. As long as the platform did not post the service to a public area of the internet, such as someone’s Facebook page, it could be used for telehealth.
This enforcement discretion has ended, and clinicians will need to use HIPAA-compliant platforms and have a Business Associate Agreement (BAA) in place with that platform’s operators. On April 11, 2023, the OCR released a statement that it would institute a 90-calendar-day transition period for covered healthcare providers to come into compliance with HIPAA rules. The OCR’s enforcement discretion will continue from the period of May 12, 2023, until Aug. 9, 2023, after which, the OCR will no longer exercise enforcement discretion and will resume the imposition of penalties for noncompliance.
Several platforms are available, so if you are not sure which one you use, seek counsel to ensure your platform and the BAA are HIPAA compliant post-PHE.
Prescriptions
Another exception that expired at the end of the PHE is the Drug Enforcement Administration (DEA) exception to requirements for separate DEA registrations in all states where patients being prescribed controlled substances by telehealth are located.
During the PHE, if a clinician was registered with the DEA in any state, they did not need to register in other states where they were prescribing or dispensing controlled substances via telehealth, if state law allows. When the PHE expired, clinicians again need to register with the DEA in all states in which their patients are located.
An in-person medical evaluation is also again required to prescribe Schedule 2–5 substances via telehealth.
Delayed Changes
Happily, many more telehealth changes post-PHE won’t take effect until the end of 2024. One telehealth policy that will remain through Dec. 31, 2024, is the ability to provide telehealth services to patients regardless of their geographic location. The ability to provide services across state lines has been a popular option for some practices during the pandemic; however, the HHS cautions that this allowance is subject to state laws, which may prevent interstate telehealth services.
Also extended until Dec. 31, 2024, is the ability to provide telehealth services to Medicare patients in their homes, as well as audio-only telehealth services to patients. The HHS has provided guidance for how audio-only telehealth can remain compliant after the OCR’s enforcement discretion ends.
Importantly, clinicians should note that landlines will not violate HIPAA, whereas cell phones or other electronic communication technologies may.
Clinicians should also take reasonable steps to ensure their audio-only service is private, that the patient’s identity is verified and that auxiliary aids or services be used as appropriate to ensure the effectiveness of the communications.
No Change Expected
Some telehealth changes made as a result of the PHE will remain in place permanently. Most of these deal with the provision of behavioral health or mental health services. However, with any of the changes made as a result of the PHE, it is important to stay informed as to any other extensions or guidance that may be implemented even after the end of 2024. As industries adjust their businesses post-PHE, additional action may be taken by federal or state governments to preserve popular telehealth changes.
As the PHE comes to an end, it is a convenient time to consider telehealth best practices. Over time, enforcement agencies may be less sympathetic to claims of “trying to do one’s best” when it comes to telehealth services. To prepare, take time now to review your telehealth policies, procedures and training, and ensure you have adequate privacy and security for telehealth services.
Now is also a good time to review the clinical outcomes and patient satisfaction scores for telehealth services. If there are any concerns, take action to modify practices so you can improve your metrics.
Finally, as the post-PHE telehealth landscape comes into focus, determine whether additional opportunities exist to expand your business via telehealth.
The PHE is a federal declaration, which means state laws still must be considered when reviewing your telehealth program. As each state has unique telehealth regulatory frameworks, it will be important for clinicians to review the regulations in each state they provide services in. To ensure state compliance, be sure to review the requirements surrounding licensure, informed consent, standards of care, prescriptions and reimbursement.
While no one in the healthcare industry would have chosen the COVID-19 pandemic as the route through which telehealth gained serious traction, clinicians and patients alike have found numerous advantages to the use of the technologies. As the world tilts steadily back toward more familiar times, clinicians have a chance to reflect on their experience with telehealth during the PHE, transition successfully out of the PHE exceptions and push forward toward a rewarding future with telehealth.
Emily A. Johnson, JD, is a nationally recognized attorney, author and speaker with McDonald Hopkins LLC. Email her at [email protected].
