OCR Issues Notice of Enforcement Discretion in Regard to Telehealth

/in /by

The Office for Civil Rights has issued a document titled Notification of Enforcement Discretion for Telehealth Remote Communications during the COVID-19 Nationwide Public Health Emergency that communicates a relaxation in compliance requirements during these challenging times. The document states “OCR will exercise its enforcement discretion and will not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency…This exercise of discretion applies to telehealth provided for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19.”

Health care providers are permitted to use any audio or video applications to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with HIPAA requirements during the public health emergency. However, the OCR does encourage providers to notify patients that use of third-party applications may pose privacy risks.  

We recommend that our clients use Form 7.34-Patient Authorization for Disclosure of PHI via Alternative Means* to communicate this risk to patients and to obtain the contact information (cell phone number, email address, etc.) that is needed to initiate the communication.

The OCR document lists several vendors that represent that they provide HIPAA-compliant video communication products and that they will enter into a HIPAA business associate agreement (BAA). These vendors should be used if available to the practice and feasible for the patients involved. However, the OCR notice clearly states that it “will not impose penalties against covered health care providers for the lack of a BAA with video communication vendors or any other noncompliance with the HIPAA Rules that relates to the good faith provision of telehealth services during the COVID-19 nationwide public health emergency.”

Your practice may accept the BAA that is provided by video communication vendors or, if none is offered, you may seek to obtain a signature on Form 7.22-Business Associate Agreement*.

Use of encryption is normally required in any transmission of PHI over an open electronic network (i.e. the Internet), and if encryption or other privacy modes are available in a particular application they should be used. However, if these security measures are not available in the particular app that is chosen for telehealth, the OCR will not take enforcement action against the healthcare provider according to the statement in the above paragraph.

Please refer to the OCR document in its entirety here:

https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html

* The forms mentioned in this article may be found in the Forms section of Eagle Associates’ HIPAA Policy Manual or in the Member Services area of our website. Forms are provided in Microsoft Word™ format in the Member Services area if you wish to modify the form with a specific telehealth application or other relevant information.

Please note that this enforcement discretion applies only to the provision of telehealth during the current nationwide public health emergency. The OCR will otherwise continue to enforce the Privacy and Security Rules during the emergency.

If you have any questions about telehealth or other compliance matters, our Consultants remain available by phone (800) 777-2337 or email at: info@eagleassociates.net.

Coronavirus (COVID-19) Update

/in /by

The March issue of the Advisor® included information on COVID-19.  You are encouraged to read the article on page 4 of the March issue to obtain information on signs and symptoms, prevention, and coordination with public health departments.  OSHA does not have a Standard for COVID-19 at this time, but has released guidance, and also refers to the Centers for Disease Control and Prevention (CDC) guidance.  The main CDC web page providing coronavirus guidance can be found here:

https://www.cdc.gov/coronavirus/2019-ncov/index.html

The virus has been named “SARS-CoV-2,” and the disease it causes has been named “coronavirus disease 2019” (COVID-19).  SARS-CoV has been found to cause severe illness in some people, although the complete clinical picture is not yet fully understood. Reported illnesses have ranged from mild to severe, including illness resulting in death. Although current data suggests that most COVID-19 illness is mild, data out of China suggests serious illness occurs in 16% of cases. Older people and people with certain underlying health conditions like heart disease, lung disease and diabetes, for example, seem to be at greater risk of serious illness.

As of March 12, 2020, the virus was confirmed in 43 states and District of Columbia, with 1,215 confirmed cases and 36 deaths in the US.  Testing is just now beginning at the local public health department level in some areas, so those numbers are expected to rise rapidly.  There is evidence of person-to-person transmission of COVID-19 in the US in at least 29 cases as of 3/9/2020.  The CDC will be updating numbers regularly at noon Mondays through Fridays here:  https://www.cdc.gov/coronavirus/2019-ncov/cases-in-us.html.  

Precautions

Appropriate hand hygiene, cough etiquette, social distancing, and reducing face-to-face contact with potential COVID-19 cases are needed to slow disease transmission and reduce the number of people who get sick.  If you are a subscriber to the Custom Safety Program, refer to Influenza Safety policies in Section 1.35 through 1.49.  These policies, when followed, will also help to reduce transmission of COVID-19.  For staff awareness and training, refer back to the Influenza Safety training from the September 2019 issue of the Advisor® if you have not recently conducted training.

If you find yourself in an area with an outbreak of COVID-19, consult with local public health departments for assistance and coordination, and follow the CDC guidance for healthcare facilities at the following URL:

https://www.cdc.gov/coronavirus/2019-ncov/healthcare-facilities/guidance-hcf.html

Patient Screening and Management

Screen patients and visitors for symptoms of acute respiratory illness (e.g., fever, cough, difficulty breathing) before entering your healthcare facility.  Place a facemask on suspected/confirmed patients and isolate them in an Airborne Infection Isolation Room (AIIR) if available.  Expedite treatment and disinfect exam rooms/operatories after the patient leaves the facility.

  • Provide visual alerts (signs, posters) at entrances and in strategic places providing instruction on hand hygiene, respiratory hygiene, and cough etiquette.
  • Ensure supplies are available (tissues, waste receptacles, alcohol-based hand sanitizer)
  • Facemasks should be available at triage for patients with respiratory symptoms.
  • If possible, create an area for spatially separating patients with respiratory symptoms. Ideally patients would be >6 feet apart in waiting areas.

We will continue to provide further updates and guidance on COVID-19 as the situation develops.

Update:

OSHA has just released guidance for workplaces on preparing for COVID-19.  See the link below:
https://www.osha.gov/Publications/OSHA3990.pdf