In the midst of the coronavirus outbreak, the Centers for Medicare & Medicaid Services (CMS) has taken steps to make healthcare services more accessible through telehealth, particularly for those who are at high-risk of complications from the virus. CMS and commercial payors have opened a viable path for healthcare providers to continue to provide care to high risk patients and other patients and receive reimbursement for services to current and new patients.

The Telehealth Services During Emergency Periods Act, part of the Coronavirus Appropriations Act of 2020, expands the use of telehealth for Medicare beneficiaries during the emergency declaration period. The bill allows HHS to waive the originating site requirement for telehealth services provided to Medicare beneficiaries in areas under public health emergency orders permitting delivery of care to patients as they “shelter at home”, and it allows telehealth services to be provided to Medicare beneficiaries via phone, given the phone allows for audio-video interaction. CMS will not enforce sanctions based on any prior relationship requirement. Telehealth provides medical and dental providers that are currently restricted from providing office-based services with a means to continue care for their current patient base and develop new patient relationships.

CMS has also expanded the use of telehealth in Medicare Advantage plans, Part D and Medicaid/CHIP. In addition, most commercial payors have expanded use of telehealth to address the need to triage and monitor patients remotely. CMS has also provided CMS-MLN educational guidance on billing for telehealth services.

OCR has waived penalties for violations of the HIPAA Privacy, Security and Breach Notification Rules through “good-faith provision of telehealth during the COVI-19 nationwide public health emergency.” The enforcement waiver is limited to telehealth.

Part 2 enforcement related to privacy of substance use disorder patient information is alsonotincluded in the waiver. For behavioral health and SUD treatment facilities who use telehealth is treating patients, this waiver does not apply to the Part 2 disclosures of information.

What is “good-faith provision of telehealth”? OCR has provided FAQs on Telehealthguidance on its waiver and provided the following examples of bad faith:

• Criminal acts, such as fraud, identity theft, and intentional invasion of privacy;
• Uses or disclosures of patient data that are prohibited by the HIPAA Privacy Rule not related to treatment, payment or public health authority disclosures such as sale of the data, or use of the data for marketing without authorization;
• Violations of state licensing laws or professional ethical standards that result in disciplinary actions related to the treatment offered or provided via telehealth (i.e., based on documented findings of a health care licensing or professional ethics board); or
• Use of public-facing remote communication products, such as TikTok, Facebook Live, Twitch, or a chat room like Slack, which OCR has identified in the Notification as unacceptable forms of remote communication for telehealth because they are designed to be open to the public or allow wide or indiscriminate access to the communication.

Click here to read more.