en en id en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en es en en en en en en en en en en en en en en en en en en en en
COVID-19: HHS Issues FAQs on HIPAA and Telehealth to Help Providers Maintain Access to Care During the Pandemic | Data Privacy + Cybersecurity Insider
Leveraging Knowledge to Manage Your Data Risks
By Conor Duffy & Guest Contributor on March 23, 2020
On March 20, the U.S. Department of Health and Human Services (HHS) issued additional guidance in the form of Frequently Asked Questions (FAQs) on HIPAA and telehealth services to help providers furnish care during the COVID-19 pandemic.
The FAQs follow and provide further information on the Notification of Enforcement Discretion issued by HHS on March 17 (Notification), in which HHS indicated that it would not penalize providers for using popular video chat applications, such as FaceTime and Skype, in good faith to provide telehealth services amid the COVID-19 pandemic.  HHS has emphasized, however, that the Notification does not allow the use of public-facing communications products, such as Facebook live or other livestreaming applications.
In the FAQs, HHS first provides an important reminder that while the term telehealth refers to the “use of electronic information and telecommunications technologies” for remote health care and patient education, certain payors – including Medicare – place restrictions on the types of technologies that can be used in order for the services to be reimbursed.  HHS notes that such restrictions do not limit the scope of the Notification.
HHS then provides the following additional information on the Notification and telehealth generally:
The Notification applies to all health care providers that are covered by HIPAA and provide telehealth services during the COVID-19 emergency, with no limitations on the patients served via telehealth;
The Notification applies to all services that a provider believes, in his or her professional judgment, can be provided via telehealth under the circumstances of the emergency;
The Notification does not apply to health insurance companies that just pay for telehealth services;
The Notification applies to HIPAA’s Security Rule, Privacy Rule, and Breach Notification Rule regulations;
The Notification does not apply to substance use disorder records or communications covered by 42 C.F.R. Part 2;
The Notification does not have an expiration date;
Health care providers are expected to conduct telehealth services in private settings, and providers should implement reasonable safeguards to limit incidental uses or disclosures of protected health information;
The Notification applies only to the “good faith” provision of telehealth services, which HHS assesses via a facts and circumstances test, and examples of what would not qualify as good faith include the provision of telehealth services in furtherance of a criminal scheme, or to violate state licensure law, or the use of public-facing communications products such as Facebook live; and
Non-public facing remote communication products can include FaceTime, Skype, Facebook messenger video, Whatsapp video chat, or Google hangouts video, but do not include livestreaming products.
HHS concluded the FAQs by stating that if a provider uses telehealth services during the COVID-19 pandemic and protected health information is intercepted during transmission, HHS will not pursue otherwise applicable penalties for any such breach.
Notably, in furtherance of the government’s efforts to promote the use of telehealth services to combat the COVID-19 pandemic, on March 23 HHS’s Centers for Medicare and Medicaid Services issued telehealth toolkits for providers available here (for general practitioners) and here (for ESRD providers).
This post was co-authored Lisa Thompson and is also being shared on our Health Law Diagnosis blog. If you’re interested in getting updates on developments affecting health information privacy and HIPAA related topics, we invite you to subscribe to the blog.
Tags: coronavirus, covid-19, Facebook, FaceTime, HHS, HIPPA, OCR, Office for Civil Rights, Skype, TELEHEALTH, TELEMEDICINE
Email this postTweet this postLike this postShare this post on LinkedIn
Conor Duffy is a member of Robinson+Cole’s Health Law Group and the firm’s Data Privacy and Security Team. Conor advises hospitals, physician groups, community providers, and other health care entities on general corporate matters and health care issues. He provides legal counsel on…
Conor Duffy is a member of Robinson+Cole’s Health Law Group and the firm’s Data Privacy and Security Team. Conor advises hospitals, physician groups, community providers, and other health care entities on general corporate matters and health care issues. He provides legal counsel on a full range of transactional and regulatory health law issues, including contracting, licensure, mergers and acquisitions, Medicare and Medicaid fraud and abuse laws and regulations, HIPAA compliance, and other data privacy and security matters. Read his rc.com bio here.
Read more about Conor Duffy
Show more Show less
Florida Board of Medicine allows prescribing controlled substances through telemedicine for psychiatric treatment
Connecticut enacts Act concerning the facilitation of telehealth
Follow us on Twitter Follow us on Twitter
Follow Us on Facebook Follow Us on Facebook
View Our Linkedin Profile View Our Linkedin Profile
Data Privacy + Cybersecurity Insider
Follow us on Twitter Follow Us on Facebook View Our Linkedin Profile RSS
Robinson+Cole is a law firm serving regional, national and global clients from nine offices throughout the Northeast. Our Data Privacy + Security Team brings together lawyers from the firm’s Intellectual Property and Technology, Commercial Litigation, and E-Commerce Groups.
Topics Select Category Artificial Intelligence Autonomous Machines Autonomous Systems Autonomous Vehicles Blockchain Cannabis CCPA Children’s Privacy Coronavirus Cybersecurity Data Breach Data Privacy Data Security Digital Assets Drone Privacy Drones e-Discovery Enforcement + Litigation Events Geolocation Guest Posts Health Information Privacy HIPAA and Health Information Information Governance Insurance Coverage International Privacy Laws Internet of Things Mergers & Acquisitions New + Now Privacy Tips Public-Private Partnerships with Cyber Security Safe Harbor Social Media State Laws Relating to Data Telehealth Telephone Consumer Protection Act Uncategorized Virtual Currency Websites
Archives Select Month September 2022 August 2022 July 2022 June 2022 May 2022 April 2022 March 2022 February 2022 January 2022 December 2021 November 2021 October 2021 September 2021 August 2021 July 2021 June 2021 May 2021 April 2021 March 2021 February 2021 January 2021 December 2020 November 2020 October 2020 September 2020 August 2020 July 2020 June 2020 May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 February 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 April 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 June 2017 May 2017 April 2017 March 2017 February 2017 January 2017 December 2016 November 2016 October 2016 September 2016 August 2016 July 2016 June 2016 May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015