OCR Releases FAQs Clarifying Telehealth Enforcement Discretion During COVID-19

On March 20, 2020, the Office for Civil Rights at the U.S. Department of Health and Human Services (“OCR”) released guidance in the form of FAQs¹ clarifying its notification earlier in the week that it would not penalize health care providers for noncompliance with HIPAA rules in the good faith provision of telehealth during the nationwide COVID-19 public health emergency (the “Notification of Enforcement Discretion” or “Notification”).²

The FAQs clarify that the scope of OCR’s enforcement discretion is “all health care providers that are covered by HIPAA and provide telehealth services during the emergency”,³ and clarifies a number of additional topics, most notably: where telehealth can be conducted; what services can be provided; what constitutes bad faith; and permissible communication products. Importantly, OCR also specifically notes that the Notification applies to “all HIPAA-covered health care providers, with no limitation on the patients they serve with telehealth, including those patients that receive Medicare or Medicaid benefits, and those that do not.”

Where Telehealth Can Be Conducted 

OCR notes that health care providers “ordinarily” conduct telehealth in private settings, and patients should not receive telehealth services in public or semi-public settings, “absent patient consent or exigent circumstances.” However, if services cannot be provided in a private setting, health care providers should continue to implement reasonable HIPAA safeguards to limit incidental uses or disclosures of protected health information (e.g., lowered voices, not using speakerphone, and recommending that patients move to a reasonable distance from others).

What Services Can Be Provided 

The FAQs, like the Notification, defers to a physician’s professional judgment in determining what services can be provided, stating that enforcement discretion applies to all telehealth services that a health care provider, in their professional judgement, believes can be provided through telehealth “in the given circumstances of the current emergency,” whether or not related to COVID-19. (Relatedly, a separate guidance seems to suggest that substance use disorder information can be disclosed for telehealth treatment.)⁴

What Constitutes Bad Faith 

OCR’s enforcement discretion is limited to “good faith” provision of telehealth. In the FAQs, OCR states that it would consider “all facts and circumstances” to determine good faith, but gave some examples of what it might consider bad faith: 

• Conduct or furtherance of a criminal act, such as fraud, identity theft, and intentional invasion of privacy;
• Further uses or disclosures of patient data transmitted during telehealth that are prohibited (e.g., sale of the data, or use of the data for marketing without authorization);
• Violations of state licensing laws or professional ethical standards that result in disciplinary actions; or
• Use of public-facing remote communication products that OCR has identified as unacceptable.

The limitation related to state licensing laws may continue to create barriers for telehealth. States frequently limit telehealth to providers with in-state licenses (though many states are acting to permit telehealth within the state by out-of-state providers during the COVID-19 public health emergency).⁵ The Centers for Medicare & Medicaid Services (“CMS”) has waived locational licensing requirements for Medicare and Medicaid reimbursement purposes (permitting providers licensed in one state to receive reimbursement for services provided in another),⁶ but state licensing restrictions continue to apply. In listing “violations of state licensing laws” as an example of bad faith, OCR may be suggesting that if a state took disciplinary action against an out-of-state provider for not having in-state licensing, that action could then also subject the out-of-state provider to OCR penalties.

Permissible Communication Products

OCR enforcement discretion applies to “non-public-facing” remote communication products, which the FAQs define as products that, “as a default, allow[] only the intended parties to participate in the communication.” The FAQs include as examples platforms such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, or Skype, as well as texting applications such as Signal, Jabber, Facebook Messenger, Google Hangouts, Whatsapp, or iMessage.

OCR noted that these products often employ end-to-end encryption, which allows only the two participating individuals to see what is transmitted. The platforms also support individual user accounts, logins, and passcodes to verify participants and limit access. In addition, participants have some control over capabilities such as recording, muting, or turning off an audio or video signal.

The FAQs reiterate that public-facing products (such as Facebook Live, Twitch, TikTok, and “a chat room like Slack”) are not permissible, and that a provider using these products would not be covered by the Notification. For example, a provider hosting a public presentation should not identify patients or provide individual patient advice in such a livestream.

Other Clarifications

Other FAQs in the guidance clarify that the enforcement discretion applies to:

• all patients, whether or not they are covered by Medicare or Medicaid;⁷
• all health care providers covered by HIPAA that provide telehealth, but not health insurance companies that pay for telehealth services;
• all types of telehealth, whether or not payors impose reimbursement restrictions;
• noncompliance with the HIPAA privacy, security, and breach notification rules, but no impact on HHS regulations related to confidentiality of substance abuse disorders;⁸ and
• even when the telehealth session is breached (hacked).

OCR emphasized, as in the Notification, that providers should notify patients that third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications. Finally, the FAQs note that there is no expiration date to the enforcement discretion; OCR will issue a notice when it is no longer exercising enforcement discretion “based upon the latest facts and circumstances.”

A full list of the FAQs is available here.