by U.S. Department of Health & Human Services
Jul 7th, 2022
Covered entities (healthcare providers and health plans) can use remote communications, called telehealth, to provide services to patients as long as they follow certain guidelines. The guidelines were developed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Privacy, Security, and Breach Notification Rules (HIPAA Rules), and the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) to help covered entities understand how they can use remote communication technologies.
Audio-Only Telehealth Clarifications
Because certain populations may have difficulty using audio-video telehealth, HHS is now issuing this guidance on audio-only telehealth in direct response to the Executive Order on Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government (E.O. 14058). This guidance will help ensure that individuals can continue to benefit from audio-only telehealth by clarifying how covered entities can provide telehealth services and improve public confidence that covered entities are protecting the privacy and security of patients' health information.
Some of the reasons these populations may have difficulty accessing or be unable to access technologies used for audio-video telehealth include the following: financial resources, limited English proficiency, disability, internet access, availability of sufficient broadband, and cell coverage in the geographic area. Audio-only telehealth, especially using technologies that do not require broadband availability, can help address the needs of some of these individuals.
Due to the coronavirus Public Health Emergency (PHE) of March 2020, the OCR issued a Telehealth Notification to assist the healthcare industry’s response to the PHE; and to quickly expand the use of remote healthcare services needed to treat patients without public facing contact. The notification is still in use. It will be in use until the PHE no longer exists or the notification expires, which will be determined by the secretary of the HHS at some later date.
New Audio-Only Telehealth Guidance to Meet HIPAA Rules
The following guidance will assist covered entities in complying with the HIPAA Rules when OCR’s Telehealth Notification is no longer in effect.
-
HIPAA covered entities can use remote communications technologies to provide telehealth services including audio-only services in compliance with the HIPAA Privacy Rule.
-
The HIPAA Security Rule applies to electronic protected health information (ePHI), which is PHI transmitted by, or maintained in electronic media.
-
The HIPAA Rules require a covered entity to enter into a business associate agreement (BAA) with a telecommunication service provider (TSP) only when the vendor is acting as a business associate. As explained in previous guidance, a covered entity using a telephone to communicate with patients is not required to enter into a BAA with a TSP that has only transient access to the PHI it transmits because the vendor is acting merely as a conduit for the PHI. If the TSP is not also creating, receiving or maintaining PHI on behalf of the covered entity, and the TSP does not require access on a routine basis to the PHI it transmits in the call, no business associate relationship has been created. Therefore, a BAA is not needed.
-
Covered healthcare providers may offer audio-only telehealth services using remote communication technologies consistent with the requirements of the HIPAA Rules, regardless of whether any health plan covers or pays for those services. Health plan coverage and payment policies for healthcare services delivered via telehealth are separate from questions about compliance with the HIPAA Rules and are not addressed in this document.
Resources
OCR Telehealth Resources List
-
FAQs on Telehealth and HIPAA during the COVID-19 nationwide public health emergency - PDF
-
HHS Security Risk Assessment Tool (jointly developed by OCR and the Office of the National Coordinator for Health Information Technology (ONC))
HHS Telehealth Resources List
-
Telehealth resources are available at https://telehealth.hhs.gov/ and https://www.hhs.gov/coronavirus/telehealth/index.html
-
HHS information about Medicare and Medicaid coverage and billing for telehealth services is available at https://telehealth.hhs.gov/providers/billing-and-reimbursement/
-
CMS Telehealth Resources about Medicare and Medicaid coverage
-
https://www.medicaid.gov/medicaid/benefits/telemedicine/index.html
-
https://www.cms.gov/Medicare/Medicare-general-information/telehealth
-
SAMHSA Guidance regarding telehealth and Confidentiality of Substance Use Disorder Treatment Records regulations (42 CFR Part 2)
Quick, Current, Complete - www.findacode.com