HHS Issues Notification of Enforcement Discretion for Provision of Telehealth Services During COVID-19 Pandemic

On April 21, 2020, the Department of Health and Human Services (HHS) published a Notification of Enforcement Discretion (the “Notification”) regarding the provision of telehealth services during the COVID-19 public health emergency in the Federal Register. The Notification codifies guidance previously issued by the HHS Office of Civil Rights (OCR) on March 17, 2020. This is an update to a previously posted blog detailing the OCR’s guidance and applicable requirements, available here.

As an overview, the OCR is responsible for enforcing certain regulations issued under HIPAA, including the HIPAA Privacy, Security and Breach Notification Rules (the “HIPAA Rules”). The Notification codifies the OCR’s guidance, which provides the OCR will not impose penalties for noncompliance with regulatory requirements under the HIPAA Rules if the provider is providing telehealth services in good faith and utilizing a non-public facing remote communication product (e.g., Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom and Skype). Note that public facing products (e.g., Facebook Live, Twitch and TikTok) should not be used by healthcare providers providing telehealth services.

Prior to utilizing any such audio or video communications, providers should: (1) enable all available encryption and privacy modes; and (2) notify the patient that the third-party applications pose potential privacy risks. For additional security precautions, healthcare professionals may seek video communication vendors that are HIPAA-compliant and agree to enter into a HIPAA business associate agreement (e.g., Zoom for Healthcare, VSee; Skype for Business/Microsoft Teams, etc.). However, OCR will not impose any penalties against healthcare providers for lack of a business associate agreement.

Additionally, note that the Notification is not limited to telehealth services provided to assess or treat COVID-19. Rather, the Notification provides that the OCR’s discretion extends to telehealth services provided to patients to assess or treat any medical condition (COVID-19-related or not) during the effective period of the Notification. The Notification went into effect on March 17, 2020 and will remain in effect until the public health emergency no longer exists or the declaration of the public health emergency expires, whichever occurs first.

For more information regarding HHS’ Notification of Enforcement Action regarding telehealth, please contact your regular HLP attorney, or Partners@thehlp.com, or call (248) 996-8510.