In March of 2020 OCR released the Notification of Enforcement Discretion for Telehealth to help doctors and patients continue appointments during the COVID-19 pandemic. The Notification does not have an expiration date currently but is expected to be lifted in the near future. In preparation for the Notification of Enforcement Discretion for Telehealth to be lifted, HHS released guidance on how covered entities can continue to provide audio-only telehealth and remain compliant with HIPAA Rules.
- “Does the HIPAA Privacy Rule permit covered health care providers and health plans to use remote communication technologies to provide audio-only telehealth services?”
- “Do covered health care providers and health plans have to meet the requirements of the HIPAA Security Rule in order to use remote communication technologies to provide audio-only telehealth services?”
- “Do the HIPAA Rules permit a covered health care provider or a health plan to conduct audio-only telehealth using remote communication technologies without a business associate agreement in place with the vendor?”
- “Do the HIPAA Rules allow covered health care providers to use remote communication technologies to provide audio-only telehealth if an individual’s health plan does not provide coverage or payment for those services?”
HHS states, in a recent email to subscribers, their reason for continuing to allow audio-only telehealth is due to the difficulty some populations have with accessing audio-video resources. In HHS’ recent communication they include this statement by OCR Director, Lisa J. Pino, “Audio telehealth is an important tool to reach patients in rural communities, individuals with disabilities, and others seeking the convenience of remote options. This guidance explains how the HIPAA Rules permit health care providers and plans to offer audio telehealth while protecting the privacy and security of individuals’ health information.”
Take a moment to ensure that your organization is using audio-only telehealth in a HIPAA compliant manor!
