Until recently, telehealth was not commonplace here in CT. Not only has the public health emergency forced widespread adoption of telehealth, but it also triggered a flurry of piecemeal rules and executive orders in rapid-fire succession causing substantial confusion. The most confusing of those rules relate to the delivery of telehealth services via telephone.
Keeping track of the flurry of rules and changes related to telehealth during this COVID-19 public health emergency has been challenging. I offer the timeline below as a resource with links to all the underlying sources. I will update this timeline as changes come about.
It’s now a familiar scene. News coverage regularly includes video footage capturing exhausted healthcare workers, lifeless bodies in hospital beds and COVID-19 treatment areas. OCR reminds healthcare providers that allowing media access to patient care areas without patient authorization violates HIPAA, regardless of the COVID-19 public health emergency. In the past, hospitals have paid millions of dollars in settlements for permitting access without proper authorization and increased enforcement on this issue may be on the horizon.
While preparing for a Connecticut Bar Association webinar this week on privacy and security basics for video conferencing, I found myself making a list of video conferencing pet peeves. Here’s a summary: no one wants to look up your nose or at the side of your head; find the mute button and learn how to use it; everyone can read your pop-up messages when you are sharing your screen; and despite what you think, you are not good at multi-tasking.
In line with its other Notices of Enforcement Discretion, OCR announced today that it will not enforce HIPAA rules against healthcare providers and their business associates for HIPAA violations that occur during the good faith operation of a community-based COVID-19 specimen collection and testing site, such as a mobile, drive-through or walk-up site.
The CARES Act made important changes to 42 CFR Part 2 rules by aligning use and disclosure rules more closely with HIPAA. This is an important development and will require some operational tweaks by Part 2 Providers such as obtaining initial consent and ensuring the use of a Notice of Privacy Practices.
Yesterday, Connecticut’s Commissioner of Public Health issued an order suspending licensure requirements for certain healthcare providers licensed in other states for a period of 60 days. This order continues to expand access to telehealth opportunities as out of state providers can now provide telehealth services to Connecticut residents.
Late Friday, the Office for Civil Rights (OCR) issued FAQs on telehealth and HIPAA as a follow up to DHHS’ announcement that OCR would use “enforcement discretion” for HIPAA non-compliance related to the good faith roll out of telehealth services during the COVID-19 emergency. The FAQs provide useful information about the types of applications that can be used for telehealth as well as examples of bad faith conduct.
Earlier this week, more than 30 businesses sent a letter to California’s Attorney General requesting a temporary deferral in enforcement of the California Consumer Privacy Act (CCPA) until January 1, 2021 due to the COVID-19 pandemic and the lack of final regulations. CCPA enforcement is set to begin on July 1, 2020. But regulations directing the implementation of the CCPA remain incomplete and continue to change substantively. The regulations are not likely to be finalized for several weeks, which, under normal conditions, would leave businesses scrambling to comply before the enforcement deadline. But there is nothing normal about current conditions.
By executive order late yesterday, Governor Ned Lamont expanded permission to offer “audio-only” telehealth services to commercial insurer’s in-network providers furnishing covered telehealth services. Two days ago, the Governor granted this permission to Medicaid providers serving Medicaid beneficiaries. The Executive Order also addresses licensure and location requirements and conditions for other providers wishing to offer telehealth services. Additionally, the order assures providers that compliance with federal agency guidance on HIPAA is adequate to meet state law.