HHS issues guidance on audio-only telehealth, HIPAA rules

As the national public health emergency (PHE) appears likely to be extended, federal regulators issue guidance on HIPAA compliance and audio-only telehealth services via remote communication technologies.

Released by the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) on June 13, the guidance helps ensure patients’ continued access to audio-only telehealth services while also clarifying covered entities’ responsibilities for safeguarding protected health information (PHI) under HIPAA. The latest guidance comes as the COVID-19 PHE is currently set to expire July 15, at which point—or with the HHS Secretary’s declaration—the OCR’s temporary HIPAA enforcement discretion for such services would cease.

“Audio telehealth is an important tool to reach patients in rural communities, individuals with disabilities and others seeking the convenience of remote options,” noted Lisa Pino, OCR director, in a news release. “This guidance explains how the HIPAA Rules permit health care providers and plans to offer audio telehealth while protecting the privacy and security of individuals’ health information.”

The OCR published a set of FAQs to assist covered entities in complying with the HIPAA Rules when OCR’s Notification of Enforcement Discretion for Telehealth Remote Communications (Telehealth Notification) is no longer in effect, including:

1. The HIPAA Privacy Rule does allow for audio-only telehealth, provided that covered entities apply “reasonable safeguards” to protect PHI from unauthorized use or disclosures. OCR expects audio-only telehealth to be conducted in a private setting to the extent feasible. When not available, such as a shared office with a colleague, health care providers must make attempts to establish privacy. Additionally, identities of participating parties must be verified either orally or in writing, and reasonable assistance should be provided to those with disabilities or limited English proficiency.
2. The HIPAA Security Rule does not apply to audio-only telehealth used via a landline because it doesn’t constitute electronic communication. However, it does apply when an entity uses electronic communication technologies, e.g., Voice over Internet Protocol (VoIP), Wi-Fi, smart phone apps or computing devices, etc. OCR notes that potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI when using these technologies must be identified, assessed and addressed as part of the entity’s risk analysis and management processes.
3. HIPAA Rules allow audio-only telehealth without a business associate agreement in certain circumstances, including (1) when the telecommunication service provider (TSP) has only transient access to the PHI it transmits; (2) if the TSP is not creating, receiving or maintaining PHI on behalf of the covered entity; and (3) if the TSP does not require access to the PHI that is transmitted.
4. HIPAA Rules allow for audio-only telehealth if the patient’s plan does not provide coverage or payment for those services.

Although the current COVID-19 PHE is set to expire July 15, it is expected that HHS will extend it another 90 days, through Oct. 13, 2022.

Medicare’s temporary telehealth expansion

In March 2020, the Centers for Medicare & Medicaid Services (CMS) invoked its 1135 waiver authority with the evolving COVID-19 PHE to temporarily expand Medicare’s coverage of telehealth and issued new guidance for how these visits would be furnished and paid. The OCR issued its Telehealth Notification to assist the health care industry’s response and to quickly expand the use of remote health care services.

Concurrently, the AOA helped translate this new direction into actionable information that many optometry practices adopted. In fact, as many as 46% of doctors of optometry elected to provide clinical patient care via telehealth at the height of pandemic restrictions with a quarter of doctors continuing to do so as 2020 ended.

In that first year alone, more than 28 million Medicare beneficiaries took advantage of the temporary telehealth allowances, per an HHS report, yet telehealth usage has since declined from its 2020 peak. Congress continues to mull codifying these temporary telehealth flexibilities that are set to expire once the PHE concludes.

Defining telemedicine’s role in optometry

As Congress actively considers its next move regarding a Medicare telehealth expansion, the AOA continues to emphasize that certain safeguards are necessary to ensuring patients’ eye health and vision care needs are sufficiently addressed. Likewise, remote care cannot supplant the necessity for in-person, comprehensive eye care.

“From the AOA’s perspective, it’s about the quality of patient care,” noted Jerry Neidigh, O.D., AOA Telehealth Council member, in the March/April 2022 issue of AOA Focus magazine. “Making sure that any telemedicine that is being delivered equals or exceeds the level of care you get from an in-person visit.”

In December 2021, the AOA Telehealth Council convened a body of stakeholders to build on nearly two years’ perspective of telemedicine use to see what has changed, what is working and what is coming. This ‘patient experience summit’ provided the AOA an opportunity to hear directly from industry about technologies in the works and ensuring the future remains patient focused.

“Telemedicine is here; you’re either going to be a part of it or be cut out of it,” Dr. Neidigh says. “Wisely, the AOA has taken the position that we need to shape what it looks like for our profession and ensure our patients’ care doesn’t suffer.”

Would you like to share your thoughts, comments or concerns about telemedicine in optometry? Send an email to president@aoa.org.