Skip Navigation LinksHome | Editors' Blog | Post

HIPAA COVID-19 exception applies to all patients and communications-based services

You can use readily available communications apps such as Google Hangouts and Skype to provide telehealth and communications-based services to all patients during the COVID-19 emergency, the HHS Office for Civil Rights (OCR) has clarified. But make sure the app or platform you use meets OCR’s guidelines.

Providers may use a variety of communications apps to provide telehealth services without fear of being penalized for HIPAA violations, the OCR announced March 17. A follow-up FAQ released March 20 makes it clear that the notice of enforcement discretion goes beyond Medicare’s designated telehealth services and includes remote services such as online E/M and virtual check-ins.
For the purposes of the OCR waiver technologies that providers may use include texts, “videoconferencing, the internet, store-and-forward imaging, streaming media, and landline and wireless communications.” The OCR specifically states that restrictions under Medicare and Medicaid “do not limit the scope of the HIPAA Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications.”
In addition, the notice applies to “all HIPAA-covered health care providers, with no limitation on the patients they serve with telehealth, including those patients that receive Medicare or Medicaid benefits, and those that do not,” the OCR states.
The notice allows practices to use apps they and their patients likely have on their computers or phones to provide telehealth and communications-based services, but it must be a non-public facing app that “as a default, allows only the intended parties to participate in the communication.” Video communications platforms that meet OCR's standards include Google Hangouts video, Facetime, and Skype. Permissible texting platforms include Google Hangouts, Jabber and Signal. Practices that use public-facing platforms such as Tik-Tok, Twitch or Facebook Live are not covered by the exception.
Finally, the OCR reminds practices to protect patient privacy by ensuring the services are performed when the clinician and the patient are in private settings. When that isn’t possible the clinician should take reasonable steps to prevent incidental disclosures of protected health information. For example, suggest that the patient not use a speaker phone or to move away from other people who might overhear.
Webinar alert: Register today for Telehealth During the COVID-19 Crisis: Protect Patients, Maintain Continuity of Care and Sustain Revenue, Tues., April 21, 1-2 p.m. ET. On-demand access is free with each purchase of the live presentation. For more information or to register by phone: 1-855-CALL-DH1.
To comment, login here.
Reader Comments (0)


User Name:
Welcome to the new Part B News Online. If you are a returning user having trouble logging in, please click here.
Back to top