HIPAA Guidelines on Telemedicine: A Complete Guide

Telemedicine allows healthcare professionals to use technology to provide healthcare services remotely. However, amid the convenience and efficiency of telehealth, the safeguarding of patient privacy remains extremely important. The Health Insurance Portability and Accountability Act (HIPAA) provides a crucial framework for ensuring the security and confidentiality of sensitive health information, even online.

In this comprehensive guide, we navigate the intricate intersection of telemedicine and HIPAA, exploring the guidelines and considerations essential for healthcare providers and professionals venturing into the realm of virtual care.

Navigating the New Frontier of Telemedicine: The Role of HIPAA in a Pandemic-Driven Era

Prior to March of 2020, telemedicine faced an uphill battle riddled with regulatory barriers and logistical nightmares. Patients and providers who traversed this hill navigated inconsistent reimbursement policies, location and technology restrictions, and privacy regulations demanding costly investments in secure communication technology. While these obstacles seemed insurmountable, patient reception of this technological advancement proved to be favorable, but questions about the security of personal data remained.

The onset of the COVID-19 pandemic marked a turning point in the realm of healthcare, catapulting telemedicine from a convenience to a necessity. According to the Journal of the American Medical Association, usage lept from a modest 840,000 in 2019 to an astonishing 52.7 million by 2020. This surge not only reshaped how providers deliver healthcare but also underscored the importance of adhering to the Health Insurance Portability and Accountability Act (HIPAA) in a rapidly evolving digital healthcare environment.

What Is Telehealth?

Telehealth leverages electronic and telecommunication technologies to deliver long-distance health care and education. It encompasses a variety of services, including audio, text, and video consultations, breaking down geographical barriers, and connecting patients with clinical services via digital devices like computers and smartphones.

While it started this way, the acceptance of telehealth is not just a temporary shift; with 63% of users planning to continue post-pandemic and 77% expressing satisfaction with the service, telehealth is here to stay. The Biden-Harris Administration's significant $19 million investment actively enhances telehealth access in rural areas, reflecting the sector's growing momentum.

Likewise, 76% of employers expanded telehealth offerings during the pandemic, signaling a rally behind this healthcare delivery method. The burgeoning popularity of telehealth, coupled with its potential for continued post-pandemic use, underscores the importance of regulatory oversight in this evolving domain.

Agencies and Regulations Overseeing Telehealth Services

Several government agencies, including the United States Department of Health and Human Services (HHS) and the Federal Communications Commission (FCC), actively regulate and enhance access to telehealth services. During the pandemic, Congress expanded the FCC’s role in telehealth through the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). This Act allocated $200 million to the FCC to expand telehealth services across the U.S. The FCC used these funds to support healthcare providers in addressing the pandemic by providing necessary telecommunications services, information services, and devices for telehealth.

Additionally, the CARES Act and subsequent 1135 waiver promoted the expansion of telemedicine in general through 2025 and ensured reimbursement for specific telehealth services for seniors on Social Security. It also urged the Secretary of Veterans Affairs to forge contracts boosting telehealth services for veterans. Despite the FCC's telehealth regulation initially focusing on the pandemic, the surge in telehealth services suggests a need for ongoing regulation post-pandemic. The CARES Act's diverse provisions, aiming to widen telehealth services, hint at its continued prominence in healthcare.

HIPPA Guidelines on Telemedicine

Recognizing that HIPAA's rules might sometimes appear broad or intricate, entities involved in remote healthcare services must seek clarity and regularly update their knowledge. This proactive approach ensures compliance and the secure handling of patient information in a telehealth setting.

What is ePHI?

In today's digital healthcare landscape, a comprehensive understanding of Protected Health Information (PHI) and electronic PHI (ePHI) stands at the forefront of privacy and security concerns. PHI encompasses a wide range of personal details about a patient's health, billing, and other confidential data. This includes sensitive information like:

• Patient names
• Billing details
• Contact information
• Social Security numbers
• Fingerprints
• Home addresses

As healthcare increasingly moves online, ePHI – which refers to any PHI that is stored or transmitted electronically, be it through emails, digital files, or medical reports – comes into the spotlight. The digital transformation of healthcare data, while offering unprecedented convenience, also brings forth increased risks. HIPAA regulations meticulously safeguard both PHI and ePHI, but the inherent vulnerability of digital data means ePHI demands heightened security measures to prevent unauthorized access and breaches. Healthcare providers must be prepared to recognize these risks and implement robust protections to maintain the integrity and confidentiality of patient information in this rapidly evolving digital healthcare environment.

Understanding the HIPAA Security Rule in Telemedicine

Designed to protect digital health information, the HIPAA Security Rule mandates the implementation of comprehensive safeguards. It mandates that covered entities implement robust administrative, technical, and physical safeguards for ePHI protection. This includes ensuring confidentiality, preventing unauthorized access or alterations, and maintaining data integrity and availability. Additionally, these entities must actively guard against anticipated security threats and unauthorized uses or disclosures of ePHI.

While the Security Rule does not prescribe specific telemedicine vendors for covered entities, it emphasizes the importance of exercising prudent judgment in the selection of telecommunication platforms and services. Compliance with the Security Rule across all employee levels is non-negotiable for these entities, underscoring the importance of comprehensive data security in healthcare.

Ensuring ePHI Security: The Critical Role of Technical Safeguards in Telemedicine

Telemedicine providers must rigorously comply with the technical safeguard guidelines to ensure the protection of sensitive patient data, as mandated by the Department of Health and Human Services (HHS). These safeguards include the following:

• Robust User Identification: This critical feature enables healthcare entities to monitor all user activity within their systems, ensuring secure access to ePHI.
• Encryption Protocols: The HIPAA Security Rule introduces encryption as an 'addressable implementation specification,' not a strict requirement. This means healthcare entities can assess whether encryption is a practical safeguard for protecting e-PHI's confidentiality, integrity, and availability. After conducting a risk assessment, if a covered entity finds encryption unsuitable, they must document this decision and, if feasible, implement an alternative security measure. In some cases, neither the suggested specification nor an alternative is necessary, provided the entity justifies how other means sufficiently secure e-PHI under the Security Rule.
• Emergency Access Procedures: Tailored procedures empower healthcare staff to access ePHI swiftly and securely during emergencies, safeguarding patient care continuity.
• Data Integrity Measures: Protecting the integrity of patient data is paramount to prevent unauthorized alteration or destruction of records. This maintains the accuracy and reliability of patient health information.

Fortifying Telemedicine with Essential Physical Safeguards

These measures, taken within the physical confines of a healthcare facility, uphold HIPAA compliance and ensure the security of sensitive information and include the following:

• Comprehensive Facility Security Plan: A well-documented plan outlines specific policies to prevent unauthorized access to patient data and protect against information theft.
• Tailored Access Control and Validation: Implementing strict access control measures ensures that sensitive information is accessible only to authorized personnel based on their specific roles within the organization.
• Diligent Maintenance Records: Keeping detailed records of any security-related repairs or modifications to the facility, such as updates to doors or locks, will help maintain a secure environment.
• Media Management Policies: Establishing clear guidelines for the use, disposal, reuse, or backup of media ensures that all forms of patient data, whether digital or physical, are handled with utmost care and security.
• Stringent Workstation Maintenance: Regular scrutiny and maintenance of all workstations with access to ePHI are crucial. Creating and enforcing policies on data handling and restricting authorized use safeguard against potential breaches.

By rigorously applying these physical safeguards, healthcare providers ensure a fortified environment for telemedicine operations, enhancing the overall trust and reliability of their digital healthcare services.

Telehealth Prescriptions for Controlled Substances: Navigating DEA and Ryan Haight Act Guidelines

Telehealth-based prescriptions of controlled substances are governed by both state and federal laws. Pre-pandemic, Under the Controlled Substances Act, prescribers needed to hold a DEA registration in each state where they prescribe these substances. During the Public Health Emergency (PHE), the DEA relaxed this rule, but this leniency will cease once the PHE concludes.

Understanding the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 is crucial for telehealth providers prescribing controlled substances. This Act restricted the internet-based distribution and dispensing of such substances, impacting telehealth prescriptions. It required establishing an in-person patient-provider relationship before prescribing scheduled medications via telehealth.

Telemedicine providers can bypass the requirement for in-person assessments before prescribing controlled substances if the patient is at a DEA-registered medical facility or with a DEA-registered clinician. This exemption applies when clinicians act within professional norms and state laws and have DEA registration in the state where the patient is located. During the Public Health Emergency (PHE), however, this face-to-face requirement was lifted, with certain guidelines for telehealth prescriptions. The DEA's proposed rules to extend PHE flexibilities are pending public feedback.

Embracing a New Era in Telehealth: Understanding Post-Pandemic HIPAA Changes

As healthcare providers and patients navigated the challenges of social distancing, a wave of critical changes swept through telehealth regulations, reshaping the way healthcare services are delivered and accessed. These adaptations, driven by the CARES Act and CMS 1135 Waiver, have not only expanded the reach and scope of telehealth but also redefined the rules of engagement, offering unprecedented flexibility and inclusivity. In this section, we delve into how these landmark changes have altered the telehealth landscape, ushering in a new era of healthcare delivery that continues to evolve in the post-pandemic world. First, we will see the changes made to Medicare and Medicaid. They are as follows:

1. Eligibility for Providing and Receiving Telehealth Services

• Before March 2020: Telehealth services were primarily restricted to certain licensed providers, with patients required to have a preexisting relationship with these providers.
• After CARES Act and CMS 1135 Waiver: The landscape shifted dramatically, enabling a broader range of clinicians to bill for Medicare services, irrespective of a preexisting patient-provider relationship.

2. Locations Approved for Telehealth

• Before March 2020: Telehealth was confined to specific sites, such as designated rural areas or certain medical facilities. Providers were bound to conduct sessions from their professional practice locations, with cross-state services being largely prohibited.
• After CARES Act and CMS 1135 Waiver: This paradigm shifted to allow healthcare providers to conduct telehealth sessions from their homes, offering services across state lines (with some state-specific restrictions). Telehealth can now originate from any site, including the patient's home, significantly enhancing accessibility.

3. Technology Requirements for Telehealth Visits

• Before March 2020: A stringent requirement for audio-visual capabilities, such as video technology, was in place, limiting telehealth to only approved technology platforms.
• After CARES Act and CMS 1135 Waiver: The requirements evolved to include both audio-visual and audio-only options, with an expanded list of approved platforms embracing widely-used technologies like FaceTime, Skype, and Zoom.

4. Reimbursement Policies for Telehealth

• Before March 2020: Medicare coinsurance and deductibles were applicable to telehealth visits, and reimbursements were generally lower compared to in-person services.
• After CARES Act and CMS 1135 Waiver: There was a significant shift, allowing providers to waive cost-sharing for telehealth services paid by federal programs. Moreover, all telehealth visits, including audio-only sessions, began to be reimbursed at rates equivalent to in-person services.

Recent changes to general telehealth operations include these changes as of May 11, 2023:

• Virtual check-ins and e-visits for new patients will no longer be allowed; these visits will only apply to established patients.
• Certain healthcare common procedures for remote evaluation of patient video/images and virtual check-in services can only be provided to established patients.
• Telehealth via any non-public-facing application. Telehealth visits will continue until December 31, 2024. However, the technology used to conduct a visit must be HIPAA compliant beginning May 12, 2023.
• State laws will continue to govern whether a provider needs to be licensed in the state in which they practice. There is no CMS-based requirement that a provider must be licensed in their state of enrollment.
• Telemedicine services furnished to a hospital's patients through an agreement with an off-site hospital will end.
• If a beneficiary's home was designated as a provider-based department of the hospital for purposes of receiving outpatient services paid under the Hospital Outpatient Prospective Payment System (HOPPS), this designation will end.
• The process of allowing the addition of services to the Medicare Telehealth Services List on a sub-regulatory basis will end. Any requests for services to be added must be made through the rulemaking process.
• Subsequent inpatient visits provided via telehealth, without the limitation of the telehealth visit being once every three days.

BAA Contracts

In the past, when partnering with a Telehealth vendor, HIPAA standards required healthcare providers to establish a Business Associate Agreement (BAA). This contract ensured that all parties, including third-party vendors like insurance companies or Telehealth providers, adhered to HIPAA laws in handling sensitive health information. A BAA sets clear boundaries on how these associates use and access Electronic Protected Health Information (ePHI) or Protected Health Information (PHI), safeguarding patient privacy. A BAA had all of the following roles:

• Outline Usage Parameters for ePHI/PHI: Clearly define how business associates may utilize ePHI and PHI.
• Illegal Disclosure Prohibition: State that disclosing ePHI or PHI beyond legal requirements constitutes a violation.
• Mandate Comprehensive Safeguards: Ensure implementation of both technical and physical safeguards.
• Obligate Security Breach Reporting: Require reporting of any security breaches to appropriate authorities.
• Enforce Disclosure of Health Amendments: Ensure transparency in disclosing health record amendments.
• Adherence to HIPAA Rules: Mandate compliance with HIPAA Privacy and Security regulations.
• Monitor ePHI/PHI Usage: Require reporting of all ePHI and PHI usages to the Health and Human Services (HHS).
• Data Destruction Post-Contract: Obligate destruction of all ePHI/PHI after contract termination.
• Subcontractor Accountability: Ensure that subcontractors also comply with HIPAA guidelines.
• Contract Termination for Violations: Clarify immediate contract termination upon any breach of terms.

During the pandemic, the Office for Civil Rights (OCR) did not mandate that covered entities form business associate agreements (BAAs) with video communication platform vendors. This relaxation might impact patient privacy. Platforms compliant with HIPAA before the pandemic, like those with BAAs, could offer more secure services. However, new platforms for telehealth might not meet HIPAA standards. Despite claims of compliance by vendors like Skype and Zoom, OCR hasn't reviewed their BAAs or officially endorsed them. The high demand for telehealth services during the pandemic may have led many providers to use platforms without confirming HIPAA compliance.

Telehealth users, in the absence of a Business Associate Agreement (BAA), are governed by the privacy policies of individual companies. However, the requirements of BAAs can significantly increase the costs and complexities associated with telehealth software investments. This scenario poses a challenge for healthcare providers seeking telehealth technology partners, especially during a pandemic.

To promote adherence to HIPAA standards through BAAs, the Office for Civil Rights (OCR) could promote transparency by publicly disclosing which companies have committed to these binding agreements. Such candor would motivate platforms to align with HIPAA, leveraging public trust and credibility as a business advantage, ultimately driving more consumers to embrace their technology and services.

Elevate Your HIPAA Expertise: Discover Our Targeted Training Courses

While the adherence to HIPAA guidelines concerning ePHI and BAA has lessened, patient privacy remains a valid concern for continued trust between healthcare providers and the patients themselves. Maintaining HIPAA certification is more important now than ever for your benefit and that of your clients.

Stay ahead in the ever-evolving field of healthcare with our comprehensive online training courses. Whether you're a healthcare worker, business associate, or office manager, our courses offer the latest in HIPAA education, ensuring you're up-to-date with the latest regulations and best practices.

Our HIPAA for Health Care Workers course is tailored for anyone directly involved in patient care, and offers an interactive learning experience that can be completed in just 90 minutes. This course will help you understand the core elements of HIPAA, including the Privacy Rule, Security Rule, and Breach Notification Rule. Upon completion, receive a Certification of Completion to enhance your professional credentials.

Our HIPAA for Business Associates course is designed specifically for individuals who handle protected health information (PHI) but may not directly engage with patients. This 90-minute course covers key aspects of HIPAA compliance, including understanding the responsibilities of Business Associates and the importance of Business Associate Agreements (BAAs). Completing this course earns you a Certificate of Completion and 0.2 CEUs, showcasing your commitment to maintaining high standards of PHI protection.

Ensure you are fully equipped to handle PHI with confidence and compliance. Enroll now and take the first step towards mastering HIPAA regulations!