July 14, 2022
Executive Summary
On June 13, 2022, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) released guidance on the application of the Health Insurance Portability and Accountability Act of 1996 to audio-only telehealth. The new guidance addresses how audio-only telehealth can be provided after the expiration of COVID-19 era policies. The guidance is in response to Executive Order 14058, which called upon HHS to develop guidance for telehealth services after the public health emergency (PHE) expires. Covered entities providing audio-only telehealth and their business associates should review their policies and agreements to ensure compliance with the new guidance.
At the beginning of the PHE, the OCR issued a notice of enforcement discretion stating that it would not impose penalties for noncompliance with HIPAA against providers if providing telehealth during the PHE in good faith (the HIPAA waiver). The HIPAA waiver allows healthcare providers to use nonpublic facing audio and remote communications technologies that are not in strict compliance with HIPAA, such as Apple FaceTime, Zoom and Skype, to conduct telehealth visits with patients. The waiver will expire on the expiration of the PHE. The COVID-19 PHE continues through July 15, 2022; however, Biden administration officials have said the administration plans to continue the PHE declaration for up to another 90 days until October 2022 and will give 60 days’ notice if it plans to expire the PHE at that time.
During the PHE, telehealth services have been critical to address gaps in care, but certain populations continue to have difficulty accessing or are reluctant to use video during telehealth sessions, due to factors such as financial resources, disability, limited English proficiency and lack of sufficient broadband coverage. For example, some elderly patients are reluctant to use video, in addition to audio, given lack of familiarity with an app or difficultly troubleshooting issues. Audio-only telehealth helps address these otherwise unmet needs.
The guidance describes how providers can ensure compliance with HIPAA when providing audio-only telehealth. For example:
Notably, on Nov. 2, 2021, CMS announced its 2022 Physician Fee Schedule final rule that permanently expanded Medicare reimbursement for certain mental and behavioral health services via audio-only telephone calls, including counseling and therapy services and treatment of substance use disorders. The audio-only calls are reimbursable if the patient doesn’t have the technical capacity or the availability of real-time audio and visual interactive telecommunications, or doesn’t consent to the use of real-time video technology.
The COVID-19 PHE served as a catalyst to accelerate the acceptance and expansion of audio-only telehealth services. All covered entities providing audio-only telehealth services should ensure their services comply with the guidance, including applying reasonable safeguards to protect PHI, identifying whether the Security Rule applies, and implementing or reviewing BAAs.
McGuireWoods attorneys track updates in digital health and healthcare privacy. For more information on how this new guidance may apply to you and the potential implications, please contact the authors of this article.
The authors thank McGuireWoods summer associates Renee Kumon and Jonathan Wrobel for assistance preparing this legal alert. They are not licensed to practice law.
McGuireWoods has published additional thought leadership analyzing how companies across industries can address crucial business and legal issues related to COVID-19.