The HHS Office for Civil Rights (OCR) recently issued a Notification of Enforcement Discretion (Notification) announcing OCR will waive potential HIPAA penalties against healthcare providers in connection with their good faith provision of telehealth using communication technologies during the COVID-19 nationwide public health emergency. This applies to all healthcare providers covered by HIPAA providing telehealth services during the emergency, for any reason, regardless of whether it is related to the diagnosis and treatment of health conditions related to COVID-19, and with no limitation on the patients served (including those receiving Medicare or Medicaid benefits). Note, however, the Notification does not affect the application of the HIPAA Rules to other areas of healthcare outside of telehealth during the emergency.
The OCR has issued additional, new guidance is in the form of eleven frequently asked questions (FAQs) and clarifies how OCR is applying the Notification to support the good faith provision of telehealth. Some of the FAQs include:
- What covered entities are included and excluded under the Notification?
- Which parts of the HIPAA Rules are included in the Notification?
- Does the Notification apply to violations of the HHS regulation that protects the confidentiality of substance use disorder patient records?
- When does the Notification expire?
- Where can healthcare providers conduct telehealth?
- What is a “non-public facing” remote communication product?
Telehealth technologies include videoconferencing, the internet, store-and-forward imaging, streaming media, and landline and wireless communications. Telehealth services may be provided, for example, through audio, text messaging, or video communication technology, including videoconferencing software. Among other issues, the FAQs discuss acceptable/unacceptable forms of remote communication when providing telehealth.
The Notification can be found here and the FAQs can be found here.
