Telehealth use has increased rapidly in the past five years, but social distancing measures necessitated by COVID-19 have placed it at the forefront of clinicians’ minds for care continuation and infection mitigation. Also because of COVID-19, CMS announced a major expansion of permitted uses of telehealth for providers who accept Medicare during the public health emergency. This post will review telehealth from logistical, legal, and compliance perspectives to help providers assess whether it is a good option for their practice.
What is Telehealth?
Telehealth is the use of any telecommunications technology to provide health care services to persons who are at some distance from the provider. A variety of modalities exist, but telephone and video conferencing are typical. The term “telemedicine” is often used interchangeably with “telehealth,” but the latter is preferred as it captures a variety of disciplines beyond medicine.
Law of Telehealth
From a legal and regulatory perspective, the clinical practice of telehealth is regulated by states. Practice regulation is often broken down into two scenarios: 1) service to a patient provided by a clinician when both are located in the same state, and 2) service provided to an in-state patient by an out-of-state clinician.
For providers who seek reimbursement from Medicare and Medicaid there are, naturally, a number of regulations that pertain to reimbursement (not all of which will be addressed here).
In 2019, Florida enacted Fla. Stat. § 456.47, which governs telehealth services provided by a wide array licensed disciplines. These include the following:
|Behavior analysts (§ 393.17)||Pharmacists (§ 465)||Orthotists & Prosthetists (part XIV of § 468)|
|Emergency medical technicians (part III of § 401)||Dentists (§ 466)||Electrologists (§ 478)|
|Acupuncturists (§ 457)||Midwives (§ 467||Massage Therapists (§ 480)|
|Medical doctors (§ 458)||Speech Therapists (part I of § 468)||Clinical Laboratory Personnel (part II of § 483)|
|Osteopathic physicians (§ 459)||Occupational Therapists (part III of § 468)||Medical Physicists (part III of § 483)|
|Chiropractic physicians (§ 460)||Radiological Personnel (part IV of § 468)||Opticians (§ 484)|
|Podiatric physicians (§ 461)||Respiratory Therapists (part V of § 468)||Physical Therapists (§ 486)|
|Optometrists (§ 463)||Dieticians (part X of § 468)||Psychologists (§ 490)|
|Nurses (§ 464)||Athletic Trainers (part XIII of § 468)||Clinical Social Workers (§ 491)|
For in-state clinicians servicing in-state patients, the statute generally grants the right to a variety of clinicians to perform telehealth services in the state, subject to the regulations of their practice boards. Out-of-state physicians treating Florida patients must meet several criteria and register with a respective practice board or Florida Department of Health prior to beginning services.
In early days, CMS did not reimburse telehealth services. Within the last several years, CMS has published extensive guidance as to what types of services are reimbursed and under what circumstances. Currently, CMS allows reimbursement for the following types of practitioners:
- Nurse practitioners (NPs)
- Physician assistants (PAs)
- Clinical nurse specialists (CNSs)
- Certified registered nurse anesthetists
- Clinical psychologists (CPs)
- Clinical social workers (CSWs)
- Registered dietitians or nutrition professional
An important caveat: in ordinary circumstances, reimbursable services have to be conducted with the patient located at a qualified “originating site,” which has been mostly limited to rural areas and rarely within the a patient’s home. The services also have to be performed by the qualified practitioner at a qualifying “distant site.”
However, in light of the public health emergency presented by COVID-19, CMS has announced an expansion of telehealth services to increase access but, currently, only during the public health emergency. Notably, this expansion now allows telehealth services beyond mostly rural areas and allows patients “to receive telehealth services in any healthcare facility including a physician’s office, hospital, nursing home or rural health clinic, as well as from their homes.” Additionally, during the public health emergency, the Office of Civil Rights will allow covered health care providers to use a variety of non-public facing remote communication products to communicate with patients that may otherwise not comply with HIPAA. OCR guidance specifically endorses some services, and prohibits use of others as follows:
|Endorsed Services||Prohibited Services|
|Apple FaceTime||Facebook Live|
|Facebook Messenger video chat||Twitch|
|Google Hangouts video||TikTok|
|Skype||“and similar video communication”|
Thus, before starting Medicare-reimbursed telehealth services, it is critical for clinicians to ensure the correct 1) provider, 2) service, 3) patient and provider location, and 4) means of communication.
While telehealth provides advantages in terms of convenience and access, it is not an absolute substitute for in-person care. Many practice-specific organizations have published guidance on the ethics and efficacy of telehealth and a growing base of clinical research has evaluated the efficacy of telehealth among various disciplines. Check with your practice board and certifying organizations for guidance and citations to research specific to your discipline.
Most importantly, patients should provide informed consent to the use of telehealth services prior to use. The informed consent can be a stand-alone addendum to the general patient consent, or part of the original consent to treatment. As with any informed consent, the risks and benefits specific to the intended services should be discussed with the patient and described in the signed consent.
Privacy and Security
Especially for videoconferencing, providers need to not only select a modality that supports HIPAA compliance, but also execute a HIPAA compliant business associate agreement (BAA) with the service provider. One example is Google’s G-suite of services, which includes Google Hangouts Meet, a popular video conferencing application. Meet can be HIPAA compliant, so long as it is appropriately configured and the provider completes a BAA. Another HIPAA compatible option geared specifically to telehealth is Zoom. (4/3/20 update: recent investigative reports have revealed that Zoom has falsely claimed that it supports end-to-end encryption. Despite an initial defense, Zoom recently conceded it does not. Zoom does support TLS encryption and will sign a BAA, thus it is technically HIPAA-compliant).
In addition to selecting a HIPAA compatible videoconferencing provider, clinicians must also make sure their equipment and internet connections are secure. At a minimum, make sure to update any device used for telehealth services to the latest operating system; install reputable anti-malware application, if applicable; and ensure access to the internet is secure whether using Wi-Fi or LAN router. When in doubt, tap experienced IT expertise.
Is it Right for my Practice?
Ultimately, providers and practice groups need evaluate several sets of questions before implementing telehealth:
- What modality will best suit my practice? Is simpler, e.g., telephone, better? What kinds of features, limitations, and expenses come with videoconferencing technology?
- Can it be done efficaciously? Will the quality of treatment be similar? Are there certain evaluative or diagnostic tasks that cannot be safely or efficaciously performed if the patient is not seen in-person?
- Does your practice have a secure, HIPAA-compliant means of communicating with the patient? Have you configured the application or device to support either end-to-end encryption or other means of in-transit encryption? Have you also executed a HIPAA-compliant business associate agreement with the provider? Note that recent guidance has expanded use of telehealth during the COVID-19 national emergency, but it is not currently clear to what extent these policies will continue beyond the emergency.
- Has the patient provided a signed informed consent to the use of telehealth services? Have you clearly identified the risks and benefits of telehealth for the patient, versus traditional evaluation and treatment? Is the patient aware that use of telemedicine comes with a risk of unwanted interruption or interception of the communications?
- How will your practice bill differently for telehealth services, if it does bill differently? Do patient insurance plans reimburse differently for telehealth services, or even allow them? Do you have compliance and billing SOPs in place to ensure telehealth services are appropriately billed?
Have questions about this or another legal issue? Contact Bush Health Law for a free initial consultation.
This post is for general information purposes and is not meant, by itself, to create an attorney-client relationship or constitute legal, accounting, or other professional advice.
Bush Health Law PLLC is law firm that offers legal counsel to clinicians, researchers, and organizations to support the mission of quality, innovative healthcare. With offices in Gainesville, Florida, the firm serves healthcare clients throughout Florida. Copyright © 2019-2020 Bush Health Law PLLC. All rights reserved.