Practical Tips for Implementing Telehealth During the COVID-19 Pandemic

While some “direct-to-consumer” companies and large hospital systems have leveraged telehealth for years, unprecedented numbers of medical practices, solo practitioners, and others are now relying upon remote professional services for the first time. Given that so many providers are currently transitioning to remote practices, this article provides an overview of telehealth along with practical tips for operating a compliant remote practice during this time.

Telehealth Overview

There is no standardized definition of “telehealth.” By way of example, California law defines telehealth as the “mode of delivering health care services and public health via information and communication technologies to facilitate the diagnosis, consultation, treatment, education, care management, and self-management of a patient’s health care while the patient is at the originating site and the health care provider is at a distant site.”^[2] California’s definition of telehealth includes both synchronous interactions (meaning real time interaction between patient and provider) and asynchronous (meaning store and forward transfers of patient information). Not unlike the delivery of traditional in-person professional services, telehealth requires healthcare professionals follow the accepted standards of practice and use their professional judgment to determine whether a particular health care service should be provided by telehealth. Historically, several barriers have inhibited the uptake of telehealth use, both by patients and providers, including the general lack of coverage and reimbursement both by private and public payers, as well as the ability to prescribe both non-controlled and controlled drugs requiring a prescription.

Additional Flexibility in Response to COVID-19

In response to calls for flexibility and broadening access to telehealth services during the COVID-19 public health emergency, certain federal and state laws and regulations have been relaxed and payment policies expanded to encourage healthcare professionals to shift to remote practice. For example, CMS issued a waiver relaxing the “originating site” requirement for Medicare fee-for-service (FFS) beneficiaries, meaning that telehealth consultations between a provider and a FFS beneficiary may now take place while the patient is in his or her home or at a healthcare facility, regardless of whether the patient is located in a rural area. Moreover, CMS clarified that patients can use personal smart phones to receive treatment via telehealth as long as the communication is synchronous. To assist in this transition, a number of the otherwise existing restrictions or limitations have been lifted during this current state of emergency. A summary of key developments follows:

• Reimbursement and Coverage by Government Payers: Traditionally, health care professionals were permitted to bill Medicare for telehealth services^[3] provided to FFS beneficiaries only when the patient was located in a rural area and received services at an approved type of facility (e.g., a doctor’s office, skilled nursing facility, or hospital). In addition, the services would not be covered generally if the beneficiary received telehealth services in their home. As a result of the pandemic, CMS waived these restrictions and agreed to temporarily pay designated healthcare professionals to provide telehealth services for beneficiaries residing across the entire country, even from the confines of the patient’s own home and using their own smart phone. The use of telehealth does not change the out-of-pocket costs for Medicare FFS beneficiaries, who remain responsible for their deductible and coinsurance; however, the HHS Office of Inspector General (OIG) has stated in guidance that it is “providing flexibility for healthcare providers to reduce or waive cost-sharing for telehealth visits paid by federal healthcare programs.” (For more information on CMS’s waiver, see our alert here.)Medicare Advantage plans, on the other hand, have long been able to cover telehealth services beyond the list of “Medicare telehealth services” offered to FFS beneficiaries. On March 10, CMS informed Medicare Advantage Organizations that if they wish to expand coverage of telehealth services beyond what has already been approved, CMS will exercise its enforcement discretion until it is determined that it is no longer necessary in conjunction with the COVID-19 outbreak. Ultimately, Medicare Advantage plans have some flexibility to expand their coverage of telehealth beyond what they currently do, though they are not necessarily obligated to do so.Lastly, CMS has encouraged state Medicaid programs to take advantage of waivers and Medicaid expansion strategies in order to deal with the pandemic by increasing coverage and reimbursement of telehealth services. Many state programs have done so in response, such as in Missouri, Delaware, and Washington, D.C.

• Commercial Payers: Some state agencies have also taken action to require payment parity by commercial payers, requiring the same level of reimbursement to providers when providing services via telehealth as would be paid when providing the same services in-person. This is significant, since the differential between reimbursement amounts for services delivered in-person versus via telehealth can be large in states without “payment parity” laws. For example, see the California Department of Managed Health Care’s March 18 All Plan Letter 20-009 – Reimbursement for Telehealth Services and Massachusetts Governor Charlie Baker’s March 15 Order Expanding Access to Telehealth Services and to Protect Health Care Providers.
• Prescribing of Controlled Substances: Earlier last week, the DEA issued guidance that loosens the restrictions established under the Ryan Haight Act around health care professionals prescribing controlled substances to patients using telehealth technology during the national emergency. Specifically, during this public health emergency, healthcare professionals are no longer required to conduct an in-person evaluation of the patient before being able to prescribe, and instead can do so via telehealth as long as the prescription is issued for a legitimate medical purpose by the health care professional acting in the usual course of his/her practice and in accordance with federal and state law, and the communication is conducted using an audio-visual, real-time, two-way interactive communication system (a synchronous interaction). The Ryan Haight Act offers an exception to the in-person exam requirement for professionals engaged in the “practice of telemedicine,” which actually refers to seven separate, and technical exceptions (meaning that professionals should not assume the exception applies to them). As relevant here, one of the exceptions becomes available after the Secretary of the U.S. Department of Health and Human Services has declared a public health emergency, which occurred earlier this year. (Note that there are other exceptions that may also normally apply, including treatment via telehealth while the patient is being treated by, and physically located in, a hospital or clinic, by a registered DEA health care professional acting in the usual course of his or her practice and in accordance with applicable state law).
• State Licensure Requirements: With limited exceptions, states typically require that a physician or other professional be licensed in the state to provide services to individuals that reside in the state. However, HHS has been encouraging states to provide additional flexibility, and many states have done so, either by waiving the licensure requirement, or providing a process for an expedited, temporary emergency license, when certain conditions are met. For more information, see our prior alert on additional flexibility practicing across state lines. This is a rapidly developing area which we are monitoring closely.  Ultimately, providers should engage in a state-by-state analysis to determine whether they can practice in a particular state.
• Privacy and Security of Patient Information: The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS), the agency responsible for enforcing certain regulations issued under HIPAA, issued a Notification of Enforcement Discretion with respect to remote communications. In this notification, OCR states that it will “exercise its enforcement discretion and will not impose penalties” for noncompliance with the HIPAA Privacy, Security, and Breach Notification Rules against health care providers that are in good faith providing services via telehealth during the COVID-19 nationwide emergency. The notice applies to covered entity health care providers that use any non-public facing remote communication to communicate with patients. Providers are encouraged to advise patients of the risk and to seek the use of platforms by vendors that will sign business associate agreements (BAAs), but will not be penalized for failure to do so. On March 20, OCR issued a document with Frequently Asked Questions which provides additional guidance, including more detail on the scope and limitations of this notification.

Practical Tips to Operate a Compliant Remote Practice. Utilization of telehealth throughout the United States has skyrocketed due to COVID-19. For those clinicians and facilities treating patients via telehealth for the first time, there are a range of legal issues to consider, the most important of which are outlined below.

• Patient Consent: Many states require clinicians to obtain a patient’s consent before rendering services via telehealth. However, even among states which do require such consent, details vary considerably. For instance, clinicians must obtain consent before providing services via telehealth to patients in California, but California law does not specify what the consent must include – only that it must be written consent or verbal consent that is otherwise documented.^[4] Providers should also note that state Medicaid programs often have their own consent requirements, separate from what is mandated under state law.
• Information Security: Telehealth is not a clinical discipline, but rather a way to deliver clinical services to patients. As such, the same federal and state privacy laws (including but not limited to HIPAA in many cases and other federal and state privacy laws) apply when providing services via telehealth. Unsecure electronic communications create some risk, such as interception by a third party that results in patient information falling into the wrong hands. Therefore, when selecting a telehealth platform vendor, it is important to assess the security safeguards that the vendor has in place; and, if subject to HIPAA, entering into a business associate agreement with the vendor when required. That said, as noted above, during the current public health emergency OCR is exercising its non-enforcement discretion with respect to non-public facing remote communications.

• Clinical Considerations: Like any other clinical encounter, professional judgment must guide providers in determining whether or not it is appropriate to treat a patient via telehealth. And, as noted above, telehealth is simply a way to deliver clinical services, and the standard of care applicable to clinicians for in-person treatment also applies when treating patients via telehealth. As such, it is important to document the services provided to patients in the medical record, just as one would do during an in-person visit. A good rule of thumb for clinicians is that, aside from the communication technology utilized, a telehealth encounter should not feel different than an in-person encounter.

• Technology Utilized: While “telehealth” most commonly refers to synchronous audio-video interactions, there is no standardized definition of “telehealth,” and vendors use the term to reference many different types of communication technology. When deploying “telehealth” technology, providers should verify that the specific technology they plan to use is permitted under applicable state law. For instance, some vendors characterize “smart questionnaires” as “telehealth,” but some states, such as Arkansas, explicitly prohibit providers from treating patients through such technology, despite permitting clinicians to practice via synchronous audio-video telehealth communications.^[5] While the Medical Board of California has stated that telehealth “is not a telephone conversation,” California’s definition of telehealth does not explicitly exclude synchronous telephone conversations.^[6]

• Malpractice insurance: Some malpractice insurance policies are drafted to limit coverage to services provided in-person, or to services provided to patients located in a particular state. Thus, when transitioning to a remote medical practice, it is important to verify that a clinician’s malpractice insurance covers services provided via telehealth and, to the extent that the clinician may be treating patients physically located in another state, that the policy also covers services provided to patients located in that state.

Conclusion. Telehealth laws and reimbursement requirements have evolved slowly throughout the United States since Congress established the parameters surrounding “Medicare telehealth services” in 1997. That landscape has evolved rapidly in response to COVID-19, but it is important to understand that most of these changes are only temporary. When the public health emergency ends, HHS and state governments may return to substantially more restrictive rules. Additionally, it is important to note that regulators’ announcements that they will be exercising enforcement discretion are not the same as a complete waiver. Providers should continue to monitor these developments – particularly when measures adding regulatory flexibility terminate – closely. Moreover, before providing services in reliance upon waivers or other government announcements described above, providers are advised to read such policies in full, as many require providers to meet specific technical requirements.

HLB’s Coronavirus Task Force is monitoring developments closely. For federal and state resources on COVID-19, please refer to our COVID-19 Resource Page.

For further information, please contact Amy Joseph and Jeremy Sherer in Boston, Katrina Pagonis or Andrea Frey in San Francisco, Nina Adatia Marsden or Alicia Macklin in Los Angeles, or your regular Hooper, Lundy & Bookman contact.

_________________________________________

^{[1] As discussed herein, there is no industry-standardized definition of “telehealth.” This article refers to “telehealth” both as the services that providers render utilizing telecommunications technology and the technology itself.
[2] Cal. Bus. & Prof. Code, Sec. 2290.5.
[3] “Telehealth services” for purposes of the Medicare program has a specific defined meaning which we do not address herein. For purposes of this article, “telehealth services” is used more broadly throughout the article to reflect the more common understanding of the term.
[4] Cal. Bus. & Prof. Code, Sec. 2290.5.
[5] Ar. Code Sec. 17-92-1003(14)(B).
[6] Medical Board of California, “Practicing Medicine Through Telehealth Technology,” Cal. Bus. and Prof. Code Sec. 2290.5(b).}