Healthcare Law Alert: DHHS OCR Issues Q&A Guidance for HIPAA and Telehealth Communications During COVID-19 Crisis

BACK TO INSIGHTS     Alerts

March 23, 2020 – On March 19, 2020, we published a Healthcare Law Alert titled, “DHHS OCR Issues Notification of Enforcement Discretion to Enhance Telehealth Communications During COVID-19 Crisis.” In the prior alert, we provided information about the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) notification advising HIPAA covered healthcare providers that the OCR will be exercising its enforcement discretion and will not impose penalties for non-compliance with HIPAA in connection with the “good-faith provision” of telehealth during the national public health emergency, including telehealth services unrelated to COVID-19.

OCR Will Exercise Enforcement Discretion

The OCR recognizes that, during the COVID-19 national emergency, HIPAA-covered healthcare providers may seek to communicate with patients, and provide telehealth services, through remote communication technologies, some of which may not be fully HIPAA compliant. In its prior notification, the OCR stated that a healthcare provider that wants to use audio or video communication technology to provide telehealth to patients during the COVID-19 nationwide public health emergency may use any non-public-facing remote communication product that is available to communicate with patients, even if not fully HIPAA compliant. The OCR provided a list of vendors that represent they provide HIPAA-compliant video communication products and that they will enter into a HIPAA business associate agreement, including Skype for Business, Updox, VSee, Zoom for Healthcare, Doxy.me and Google G Suite Hangouts Meet. The OCR warned healthcare providers not to use public-facing applications, including Facebook Live, Twitch, TikTok, and similar public-facing communication applications.

OCR Q&A Concerning Telehealth and HIPAA During COVID-10 Public Health Emergency

In the OCR’s new March 20, 2020 notification, the OCR provides new guidance in the form of Q&As to clarify how the OCR is applying its enforcement discretion to support the “good faith provision” of telehealth during the national crisis. The OCR answers the following questions:

  • What is telehealth?
  • What entities are included and excluded under the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?
  • What patients can a covered healthcare provider treat under the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications and does it include Medicare and Medicaid patients?
  • Which parts of the HIPAA Rules are included in the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?
  • Does the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications apply to violations of 42 CFR Part 2, the HHS regulation that protects the confidentiality of substance use disorder patient records?
  • When does the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications expire?
  • Where can healthcare providers conduct telehealth?
  • What telehealth services are covered by the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?
  • What may constitute bad faith in the provision of telehealth by a covered healthcare provider, which would not be covered by the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?
  • What is a “non-public facing” remote communication product?
  • If a covered healthcare provider uses telehealth services during the COVID-19 outbreak and electronic protected health information is intercepted during transmission, will OCR impose a penalty on the provider for violating the HIPAA Security Rule?

For additional information or assistance with your HIPAA compliance program, contact Lani M. Dornfeld at 973-403-3136 or ldornfeld@bracheichler.com.

*This is intended to provide general information, not legal advice. Please contact the authors if you need specific advice.

Related Practices:   Healthcare Law

Related Attorney:   Lani M. Dornfeld