Health Care Law Posts

COVID-19 Telehealth: What Providers Need to Know

April 5, 2020
By: Robin Locke Nagele and Kerry E. Maloney

Through the CARES Act¹ and a series of Section 1135 Waivers and policy statements, the federal government has authorized expansive use of telehealth during the COVID-19 Public Health Emergency,² creating an opportunity for the use of telehealth/telemedicine in providing healthcare services on the front lines of the COVID-19 pandemic. The CARES Act allocates $200 million to help the healthcare industry develop greater telehealth capabilities, and directs HHS to both expand reimbursement under the Medicare program and take steps to relax regulatory barriers that have inhibited telehealth expansion. But, to take full advantage, providers need to stay on top of a number of issues that will enable them to provide services that are both legally compliant and reimbursable under federal, state, and/or commercial insurance programs. In a series of posts, we will be discussing various aspects of the new telehealth landscape and providing links to helpful resources.

Payment Considerations

Before launching any telehealth program, providers must consider who will pay for their services and under what conditions. For Medicare patients, CMS, through a Section 1135 Waiver, has expanded reimbursement for services provided via telehealth technologies during the declared COVID-19 emergency.3 Effective March 6, 2020, CMS has authorized payment for professional services in any type of healthcare facility (including Federally Qualified Health Centers (FQHC) and Rural Health Clinics (RHC) that were previously ineligible) and in patients’ homes. The range of providers that will be eligible for payment (subject to state law requirements), includes:

• Physicians
• Nurse practitioners
• Physician assistants
• Nurse midwives
• Certified nurse anesthetists,
• Clinical psychologists
• Clinical social workers
• Registered dietitians
• Nutrition professionals.4

The types of eligible services include evaluation and management (E&M) visits, mental health counseling, and preventive health screenings. CMS will pay for three types of covered patient interactions, all of which are already authorized by Medicare in more limited circumstances:

• Medicare Telehealth Visits: An encounter between a provider and patient, either an established or a new patient, using real-time, two-way audiovisual communications equipment.5
• Virtual Check-In: A brief (10-15) minute check-in between patient and provider via telephone or other communications device to decide whether an office visit or other service is needed or a remote evaluation of recorded video and/or images submitted by an established patient.
• E-Visits: A communication between a patient and provider through an online patient portal.

In a related effort to reduce barriers to care, the HHS Office of Inspector General (OIG) has announced that it will not subject practitioners to OIG administrative sanctions for waiving beneficiary cost-sharing amounts for telehealth services furnished consistent with payment and coverage rules that apply during the Public Health Emergency.6 The OIG has also stated that it will not view the provision of free telehealth services during this period, without more, as evidence of an inducement for referrals.7

The CMS and OIG waivers apply only to the Medicare program, but similar policies are being adopted under many state Medicaid programs and commercial insurance programs. Practitioners serving patients covered under these other payment programs must consult the particular payment requirements for each involved plan.

HIPAA Privacy/Security

HHS, through its Office of Civil Rights (OCR), has also expanded access to telehealth services through relaxation of HIPAA privacy and security requirements to allow telemedicine providers to use less secure methods of communication, such as Skype, Apple Facetime, Facebook Messenger, Google Hangouts, Whatsapp, or Zoom to reach patients. Specifically, providers will “not be subject to penalties for violations of HIPAA Privacy, Security and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency.”8 The relaxation extends to all telehealth services provided during the COVID-19 emergency, not just those covered by Medicare. This includes: “the use of electronic information and telecommunications technologies [including videoconferencing, the internet, store-and-forward imaging, streaming media, and landline and wireless communication] to support and promote long-distance clinical health care, patient and professional health-related education and public health and health administration.”

OCR expects that telehealth services will continue to be provided in private settings, and when that is not possible, that providers will use reasonable HIPAA safeguards to limit incidental uses or disclosures of PHI such as, for instance, using lowered voices, avoiding speakerphone, or recommending that patients move a reasonable distance from others when discussing PHI. OCR expects providers to notify patients of the increased risk of privacy violations when using less secure products or venues and OCR continues to prohibit the use of “public-facing” products, such as TikTok, Facebook Live, or a Slack chatroom, because they are designed to be open to the public or allow indiscriminate access to the communication.9 

Unlike the CMS waivers, the OCR’s enforcement policy is not co-terminous with the Public Emergency Declaration, but will continue in place until OCR decides otherwise based on “facts and circumstances.”            

State Licensure

Providers must pay particular attention to whether they are permitted to provide telehealth services under applicable state licensure rules and whether state limitations have been waived during the COVID-19 emergency. Generally, a provider must be licensed both in the state where the patient is located (the “originating site”) and the state where the provider is located (the “distant site”). In many states across the country, it is easy to obtain the additional state licensure needed to provide telemedicine services, through the Interstate Medical Licensure Compact (IMLC).10 Neither Pennsylvania nor New Jersey, however, actively participates in the IMLC, so in those states practitioners must obtain a license using traditional means. Both states have made it easier to do so during the COVID-19 emergency.

Pennsylvania has suspended a number of requirements for out-of-state practitioners to obtain a temporary license during the COVID-19 emergency. The requirements include:

• State Board of Medicine: Several administrative requirements have been suspended to obtain a temporary license, including the requirements for letters of good standing, criminal history record checks, National Practitioner Data Bank Reports, and continuing education requirements.11   
• State Board of Osteopathic Medicine: The same administrative requirements as for the Board of Medicine are suspended, but the application process is for an unrestricted license or a short-term camp license, because there is no temporary license option. For the short-term camp license, the Board will waive the requirement that practice be limited to camps, as well as the 3-month limitation of the term of licensure, extending licensure to October 31, 2020.
• State Board of Nursing: Temporary permits for nurses licensed in other states can be issued immediately upon application, once licensure in the applicant’s home state is verified through NURSYS. Continuing education requirements for these applicants will be waived.12

Although these are not specifically identified as telemedicine provisions, they facilitate the provision of telehealth services across state lines. Notably, however, Pennsylvania does not have legislation in place expressly permitting or regulating telehealth, which creates additional uncertainty for practitioners.

New Jersey, on the other hand, has a robust and expansive telehealth/telemedicine Statute, which authorizes practitioners to provide telehealth services in New Jersey in any specialty area for which a license or certificate can be obtained under New Jersey law.13 New Jersey has passed two pieces of emergency legislation that will make it easier for out-of-state practitioners to provide telehealth services to New Jersey patients. The first is a rule modification passed in New Jersey that allows out of state-licensed health care providers to provide services within the scope of their practice to patients in New Jersey during the public health emergency. One caveat is that, unless the healthcare provider has a preexisting relationship with the patient that is unrelated to COVID-19, the health care services provided can only be related to services related to screening for, diagnosing, or treating COVID-19. The second is a statute that allows expedited processing of out of state health care providers applying to become licensed in New Jersey. This allows licensed out-of-state providers to provide services to patients in New Jersey via telehealth even if they do not have a preexisting relationship. As in Pennsylvania, a number of administrative requirements are waived – such as criminal history background checks, licensing fees, and provisions pertaining to minimum malpractice insurance. Individual Boards are waiving additional requirements as well.14  

The Federation of State Medical Boards has issued a state-by-state resource indicating the waivers and licensure requirements relating to COVID-19.15

Other Issues

There are a host of other issues that providers need to consider in providing telehealth services, such as hospital/facility credentialing, professional liability/immunity statutes, consent, and special new rules pertaining to Long Term Care Facilities, End Stage Renal Disease Facilities, and Behavioral Health. These will be discussed in more detail in future posts.

Related Resources

Note: On Monday, April 20, 2020 at 12:00 pm ET, Ms. Nagele will present on this topic on the Pennsylvania Bar Institute (PBI) Webinar, "Telehealth: What Providers Need to Know." For more information and/or to register, click here.

Footnotes: