Is Your Telehealth Solution HIPAA Compliant?

The Notification of Enforcement Discretion

On March 30, 2020, the Department of Health and Human Services (HHS) issued a Notification of Enforcement Discretion for telehealth remote communications during the COVID-19 Nationwide Public Health Emergency. (1) In the notice, HHS stated they “will not impose penalties for noncompliance… in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency.” Specifically, then Secretary Azar waived sanctions and penalties for the following provisions of the HIPAA Privacy Rule:

• the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care. (2)
• the requirement to honor a request to opt out of the facility directory. (3)
• the requirement to distribute a notice of privacy practices (NPP). (4)
• the patient's right to request privacy restrictions. (5)
• the patient's right to request confidential communications. (6)

HHS also published a series of guidance and Frequently Asked Questions (FAQ) on its website. (7)

‍

Steps to Ensure Your Telehealth is HIPAA Compliant

Now that the public health emergency is set to end on May 11, 2023, healthcare providers should review these five areas and compare them to their current practices. Specifically, providers should revisit any new technology implemented to provide telehealth services.

Surveying the different providers and compiling a list of all telehealth platforms in use would be a good place to start. There could be platforms being used that did not go through the typical vendor vetting process. According to the notice of discretion, Facebook Live, Twitch, TikTok, and other similar public-facing video communication platforms should not be used. If you identify the use of any system expressly prohibited by HHS, you should evaluate if a breach has occurred and stop using that platform as soon as possible.

The next step will be to review the coordinating contracts or subscription agreements to determine what terms may have already been agreed upon. Some contracts and subscription agreements often contain Business Associate Agreement (BAA) language. If you identify the lack of a BAA for any platform you will be keeping, you should work with the vendor to resolve this as soon as possible. HHS has sample language on its website if you do not have a BAA template or need to review a vendor’s agreement.⁸ The preference should be to have vendors sign your agreement. The sample BAA should help you negotiate terms if you need to negotiate an agreement. Many terms in a BAA can be negotiated, and understanding what is negotiable and not negotiable is essential.

Suppose the vendor refuses to sign a BAA. In that case, you should identify how to terminate any signed agreements, negotiate the return or destruction of electronic Protected Health Information (ePHI), and communicate decisions to providers. You should also consider the potential effects of contract termination on patients and patient care.

HIPAA requires that patients are provided a copy of the Notice of Privacy Practice (NPP) no later than the date of the first service delivery, including service delivered electronically. This requirement was one (1) of the five (5) privacy provisions in the notice of discretion. It is likely that this process, overall, has fallen out of compliance. Conduct an audit to ensure your patients are being provided a copy of your NPP and that you are obtaining an acknowledgment.

Lastly, the telehealth application should be added to your subsequent security risk analysis (SRA). In accordance with the security rule, providers must accurately and thoroughly analyze any threats to the confidentiality, availability, and integrity of electronically protected health.⁹ One of the first steps to conducting an SRA is identifying all applications that store, receive, or transmit ePHI.

Many healthcare providers rushed to implement telehealth in the wake of the pandemic. When HHS issued its notice of enforcement discretion, providers could move more quickly without worrying about facing financial penalties for failing to comply with HIPAA. However, now is the time to prepare for the enforcement discretion to end.

If you need assistance mapping out the next steps to ensure your telehealth solution is HIPAA compliant, contact us today to evaluate your options.

Request a Strategy Call

‍

References

1. 45 CFR 164.510(b)
2. 45 CFR 164.510(a)
3. 45 CFR 164.520
4. 45 CFR 164.522(a)
5. 45 CFR 164.522(b)
6. S. Department of Health & Human Services. Notification of enforcement discretion for telehealth. Accessed March 21, 2023. https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html.
7. S. Department of Health & Human Services. Guidance: How the HIPAA rules permit covered healthcare providers and health plans to use remote communication technologies for audio-only telehealth. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html. Accessed March 22, 2023.
8. S. Department of Health & Human Services. Business associate contracts. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html. Accessed March 22, 2023.
9. 45 CFR 164.308(a)(1)(ii)(A)

‍

Reprinted with Permission from Healthcare Administration Leadership & Management Journal, Volume 1, Issue 2, pages 53-54, Copyright © 2023, American Association for Physician Leadership, (800) 562-8088; www.physicianleaders.org.