On June 13, 2022, the U.S. Division of Well being and Human Products and services, Administrative center for Civil Rights (“OCR”), issued steerage on how coated entities and industry friends can use faraway communique applied sciences for audio-only telehealth in a HIPAA-compliant way following the top of the nationwide COVID-19 public well being emergency (“PHE”).  OCR had prior to now issued steerage in 2020 informing the general public that it will now not impose consequences towards well being care suppliers for noncompliance with the HIPAA regulations in reference to the great religion provision of telehealth products and services throughout the COVID-19 PHE. The brand new steerage is issued to fortify the continuation of expanded get admission to to care by means of audio-only telehealth products and services.

The brand new steerage comprises responses to 4 continuously requested questions (“FAQs”) relating to compliance with the HIPAA privateness and safety regulations in reference to audio-only telehealth products and services. Those FAQs quilt the next subjects:

1. Whether or not the HIPAA Privateness Rule allows well being care suppliers and well being plans to make use of faraway communique applied sciences to supply audio-only telehealth products and services?
   • The OCR clarified that such observe is permissible only if cheap safeguards for shielding the privateness of safe well being data (“PHI”) from impermissible makes use of or disclosures are applied when offering telehealth products and services. Examples of such safeguards come with the availability of telehealth products and services in non-public settings, now not the use of speakerphone and the use of diminished voices to restrict incidental makes use of or disclosures of PHI. As well as, verification of the affected person’s id is needed, that may be carried out both orally or in writing (together with the use of digital strategies).
2. Whether or not well being care suppliers and well being plans have to satisfy HIPAA Safety Rule necessities to make use of faraway communique applied sciences to supply audio-only telehealth products and services?
   • The OCR clarified that the HIPAA Safety Rule does now not follow to audio-only telehealth products and services supplied the use of a phone landline for the reason that data transmitted isn’t digital. Alternatively, the HIPAA Safety Rule does follow to the usage of digital communique applied sciences, reminiscent of communique apps on a smartphone or different computing instrument, Voice over Web Protocol (VoIP) applied sciences, applied sciences that electronically file or transcribe a telehealth consultation, and messaging products and services that electronically retailer audio messages. Thus, coated entities wish to cope with safety dangers and vulnerabilities to digital PHI when the use of those applied sciences as a part of the danger research and possibility control processes.
3. Whether or not a physician or a well being plan would possibly habits audio-only telehealth the use of faraway communique applied sciences with no industry affiliate settlement (“BAA”) with the seller?
   • In keeping with its prior place at the factor, the OCR mentioned that HIPAA does now not require a BAA between a supplier and dealer the place the seller solely has temporary get admission to to PHI it transmits throughout a choice for the reason that dealer is simply appearing as a conduit for the PHI and isn’t growing, receiving, or keeping up PHI on behalf of the supplier. As an example, a BAA isn’t required the place a supplier conducts an audio-only telehealth consultation with a affected person the use of a smartphone and the seller’s sole position is connecting the decision. Alternatively, a supplier wishes to go into right into a BAA with a dealer this is greater than an insignificant conduit for PHI. For instance, a BAA is needed the place the seller’s smartphone app shops PHI (e.g., recordings, transcripts) or interprets oral communications to any other language (and subsequently creates and receives PHI) to supply significant get admission to to people with restricted English skillability.
4. Whether or not well being care suppliers would possibly use faraway communique applied sciences to supply audio-only telehealth if a person’s well being plan does now not supply protection for the ones products and services?
   • OCR famous that suppliers would possibly be offering audio-only telehealth products and services the use of faraway communique applied sciences in line with the necessities of the HIPAA Laws, irrespective of whether or not any well being plan covers or can pay for the ones provider.

OCR’s new HIPAA steerage on the use of faraway communique applied sciences for audio-only telehealth may also be discovered right here.

Milada Goturi and Kevin Kifer are contributors of Thompson Coburn’s well being care observe.