Skip to main content

What Every Telehealth Provider Needs to Know

The COVID-19 pandemic has led to a massive boom in telehealth, according to Heidi Kocher, Esq, Partner, Liles Parker, PLLC, Plano, TX. When lockdowns began to be enforced around the world, providers needed to make rapid and unprecedented changes to the way they delivered care, and healthcare teams and patients alike were required to quickly adapt to telehealth and telemedicine.

“This is a time of very rapid change in telehealth and telemedicine,” Ms Kocher said. “Because of COVID-19, the states and the federal government are constantly evaluating and re-evaluating how to make telehealth work for providers and beneficiaries.”

At the virtual 2020 Healthcare Administration Alliance Conference, Ms Kocher took a deep dive into the various challenges posed by telehealth and telemedicine, the state and federal laws that govern the use of these modalities, and the flexibilities that have been granted in light of the global pandemic.

Telemedicine Versus Telehealth

According to Ms Kocher, people tend to use the terms “telemedicine” and “telehealth” interchangeably, but they are in fact rather different. Telemedicine refers to remote clinical services (ie, diagnosis, assessment, consultation, treatment), usually provided in real time, by a licensed physician or healthcare professional acting under physician supervision.

Telehealth, on the other hand, refers to all healthcare interactions that are not done in person (ie, electronic information and telecommunications technologies that support long-distance clinical healthcare, public health, and health administration). Telehealth is a broader term than telemedicine because it can include things such as nonclinical services, provider training, administrative meetings and matters, continuing education, and quality improvement activities.

State Issues

When it comes to telemedicine and telehealth, greater importance than usual is placed on state-level considerations. As a result, providers need to understand their state’s requirements and stay up-to-date and in compliance with their state’s individual laws and regulations. This is because laws and regulations, especially at the state level, contain subtle differences and distinctions that affect the ability to provide services and obtain reimbursement, Ms Kocher explained. Public health emergencies, such as the COVID-19 pandemic, do allow for and permit flexibilities, but these may or may not persist once the public health emergency expires.

“One of the major issues is licensure,” said Ms Kocher. “Some states explicitly include telemedicine in their licensure statutes, while other states only imply telemedicine is acceptable.” This may also differ by licensing board, specialty, field, or practice area.

Another issue is cross-state border practice; in some states it is explicitly permitted without licensure, whereas others require limited partial licensure, and some require full in-state licensure. “And again, through executive orders in the time of COVID, some of these laws have been temporarily waived or modified,” she noted. “You need to check with your own state.”

Another major state issue is that of the provider−patient relationship. All states now allow for the establishment of a physician–patient relationship via telemedicine, but there may be limitations or special requirements (ie, only at an established medical site or with particular technology). Some states outright discourage telemedicine until after the provider–patient relationship is established (eg, Virginia), and some specialties may have special rules for the establishment of a provider–patient relationship, as is the case with psychologists in Texas.

“Again, very state-specific,” Ms Kocher stressed. “The big issue with the provider–patient relationship in telemedicine is thinking through how you’re going to establish the identity of the patient and the provider, obtain consent, and review medical history.”

Patient consent should always be obtained before conducting telemedicine and should always be documented in the patient record. Although individual state laws vary around what is required and what constitutes consent, according to Ms Kocher, best practice is explicit written consent. “This is not something that is likely to have been waived with COVID-19 executive orders,” she said.

Other telemedicine issues that vary state-to-state include defining the site of service (ie, patient place of residence qualifies as an originating site during the pandemic), credentialing (ie, the process of establishing and verifying qualifications and experience of providers), and privileging (ie, after credentials are established, granting provider authorization to provide specific kinds and scope of services). More importantly, many of the companies that provide telemedicine services require credentialing and privileging, using the Centers for Medicare & Medicaid Services/Joint Commission standards.

“Proper credentialing and privileging will help address some of the risk of telemedicine from a malpractice and cyber-liability standpoint,” Ms Kocher said. “But again, look into what is permitted in your state in light of COVID-19.”

E-prescribing, online prescribing, and Internet prescribing is another integral aspect of telemedicine and telehealth. E-prescribing is simply sending a prescription electronically to a pharmacy, whereas online prescribing involves writing a prescription based solely on an online patient interaction. Before online prescribing, all requirements of establishing the provider–patient relationship must be met.

“The concern underlying online prescribing is that it allows for improper prescribing (ie, pill mills) and there’s a big question about whether the patient has sufficient information to decide upon the treatment, which is really a question of informed consent,” Ms Kocher said. Although a provider–patient relationship based solely on an online interaction is prohibited in some states, some flexibility has been granted due to the pandemic.

“But you need to be very cautious about whether or not you’re going to enter into a new provider–patient relationship solely based on an online interaction, particularly if you’re going to be prescribing schedule 2 drugs and narcotics,” Ms Kocher cautioned.

Internet prescribing is permitted pursuant to a telemedicine relationship if certain conditions are met. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 placed the prescribing of controlled substances via telemedicine under the jurisdiction of the Drug Enforcement Administration, and this has not changed in light of the pandemic. “But again, different states have different requirements, so check with your state,” she said. “This is my refrain during this presentation.”

Federal Issues

“Believe it or not, telemedicine and telehealth may actually result in antitrust issues,” Ms Kocher said.

Because telemedicine crosses state boundaries, it is considered “interstate commerce” and is therefore subject to federal regulations. Examples of potential telemedicine antitrust issues that may arise include access to confidential pricing information (ie, through the electronic health record), or provision of telemedicine equipment to rural areas at below market prices, thus creating a monopoly. Numerous exceptions to antitrust law exist, but these are complex, she noted.

According to Ms Kocher, providers should be aware that most aspects of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) still apply to telemedicine and telehealth.

Due to the nature of telemedicine, security rule issues under HIPAA are of particular importance (ie, ensure full encryption of any and all data transmissions, no storage of video transmissions, and secure peer-to-peer networks and connections). Although some waivers have been put in place because of the ongoing pandemic, Ms Kocher stressed that these waivers are temporary and may not apply in all circumstances.

For example, effective March 17, 2020, and during the public health crisis, the Office for Civil Rights (OCR) will exercise enforcement discretion and will not impose penalties for the use of noncompliant “nonpublic” facing telehealth technologies. This applies to the use of telehealth for any reason, regardless of whether the services rendered are related to COVID-19. So, for the time being and with patient consent, the OCR explicitly permits Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, Skype, GoToMeeting, and WebEx. “But when the public health emergency ends, these may go away,” Ms Kocher warned. “So, don’t get too comfortable.”

Other potential HIPAA issues include the use of unsecured mobile phones or systems (eg, e-mail, text message), insufficient training for staff about technology and HIPAA-compliance, and the lack of a Business Associate Agreement with a telemedicine provider.

“You also need to put telemedicine information in your Notice of Privacy Practices; this is key,” Ms Kocher said. “Make sure your HIPAA policies address telemedicine, and make sure you’re training your staff. So many issues have become even more important because of the explosion of telemedicine.”

Final Tips Regarding the Use of Telemedicine Systems

With the use of telemedicine systems, updating software and firewalls is of paramount importance, Ms Kocher noted. And do not forget about data breaches, how to detect them, how to report them, and how to remediate them.

“Make sure your malpractice insurance covers telemedicine,” Ms Kocher noted. “Do not assume that it does. You may need to purchase a separate rider.” Cyber-liability insurance should also be sufficient, and providers should note that technology issues such as low video resolution and image quality may cause liability risks.

In many ways, telemedicine documentation is the same as for a face-to-face visit, but policies on documentation should explicitly address telemedicine. Practices should ensure they have protocols in place for what services are acceptable to provide via telehealth, what conditions can be diagnosed and treated via telemedicine, and what modalities must be used. Finally, providers should always have protocols in place to identify when to escalate and require an in-person visit.

Related Items