As industries rapidly adapt to the COVID-19 pandemic, health care providers continue to embrace a developing medical model that is certain to endure beyond the pandemic: telehealth. Last week, the U.S. Surgeon General called “on all healthcare providers that are in a position to serve, to integrate telemedicine into their practice.” The Surgeon General explained that “working from the safety of home, clinicians are able to perform virtual visits, refill and adjust essential medications, and modify treatments that will preserve and improve conditions that if left untreated, put patients at risk. Moreover, lives can be saved by keeping patients with non-emergent issues out of hospitals and clinics, preventing them from unknowingly exposing themselves or others to COVID-19.”
Congress, the Department of Health and Human Services (HHS), and Centers for Medicare & Medicaid Services (CMS) have also expanded the parameters of telehealth services by providing a variety of regulatory waivers and temporary flexibilities to meet the demands of the present public health emergency (PHE). At the same time, the Department of Justice and plaintiff’s bar continue to monitor and scrutinize telehealth providers where there are allegations or concerns of misuse, fraud, and abuse.
Providers should work carefully to embrace and take advantage of the relaxed restrictions during the pandemic—while also preparing for a return to pre-COVID-19 telehealth requirements after the pandemic ends. Developing a workplan tailored to the appropriate delivery of telehealth services both during and after the PHE is crucial for ensuring compliance and mitigating the legal and regulatory risks that are sure to arise when the PHE ends. Providers should consider the following issues and risks when developing these plans:
- Originating Site Requirements: Telehealth is typically reimbursable by Medicare only when the patient is both in a rural area and at an eligible originating site, such as a hospital, physician clinic, rural health clinic, or skilled nursing facility. Both of these originating site requirements have been waived during the PHE, but outside of a PHE, these statutory requirements can only be changed by an act of Congress. While there remains speculation that data gathered and lessons learned using telehealth to combat COVID-19 could persuade Congress to remove these statutory obstacles, the waivers are currently set to expire upon conclusion of the PHE.
- Practicing Across State Lines: During the PHE, CMS will reimburse practitioners for services provided in states where they do not hold a license, provided the practitioner holds the equivalent license in another state, is otherwise enrolled in Medicare, and is not excluded or debarred from participating in any government health care program. Several states have implemented similar waivers or expedited, temporary licensure programs. Providers taking advantage of these flexibilities should work now to obtain licensure in states where they may continue to operate post-COVID-19 or develop a plan to withdraw from those states after the PHE is lifted.
- Technology: Telehealth generally can be provided only via an interactive, real-time, audio-video telecommunications technology, and explicitly not including telephones. CMS has clarified in recent COVID-19 rulemaking that it does not consider the prohibition against phone use to apply to modern mobile computing devices that are capable of real-time audio-video communications, commonly known as smartphones. Although this was issued in light of the COVID-19 PHE, we expect this clarification, permitting the use of smartphones for telehealth, to apply beyond the PHE.
- HIPAA Privacy and Security: The Health Insurance Portability and Accountability Act (HIPAA), including its Privacy, Security, and Breach Notification Rules, typically applies to any health care provider and their business associates and requires (among other things) secure, encrypted transmission of patient protected health information (PHI) (such as telehealth communications) and HIPAA-compliant business associate agreements with technology vendors that may have access to PHI. HHS announced that it will not enforce these rules against health care providers using telehealth in good faith, opening the door to the use of consumer-friendly videoconferencing applications like Facebook Messenger, Google Hangouts, and Skype. However, providers should be cautioned to use all available security and encryption features, and despite the federal nonenforcement, providers could still be subject to private lawsuits or state enforcement action. Therefore, telehealth providers should work now to execute business associate agreements and ensure that whenever possible, telehealth services are delivered via HIPAA-compliant electronic communication systems.
- Patient Cost-Sharing Obligations: Telehealth services are usually subject to the same copay or deductible requirements as most other services reimbursed by Medicare, and routinely waiving that patient’s cost-sharing obligation can subject the provider to regulatory scrutiny under the federal Ant-Kickback Statute and beneficiary inducement law. However, the HHS Office of Inspector General has relaxed enforcement in this area, both for telehealth services as well as for other remote, technology-based services. Providers should ensure that their post-PHE workplan includes reestablishing the patient cost-sharing obligation and that they do not routinely waive federal program beneficiary copays or deductibles for telehealth or other remote health care modalities.
- Prescribing Controlled Substances: Controlled substances can only be prescribed to patients solely over telehealth pursuant to a specified exception under the federal Ryan Haight Act. One such exception occurs during a declared PHE, but this exception will no longer be available after the current COVID-19 PHE expires.
- RHC and FQHC as Distant Site Providers: Rural health clinics (RHCs) and federally qualified health centers (FQHCs) are, during the PHE, considered eligible telehealth distant site providers. However, after the PHE, these sites should no longer bill as distant site providers, although services provided by RHC and FQHC practitioners who are eligible distant site providers on their own may be billed by the practitioner individually.
- Coding Changes and Site of Service Differential: CMS has announced that it will reimburse distant site telehealth services at the higher, non-facility rate when practitioners use the non-facility place of service code that would have been used if the service had been furnished in person, and to instead use the “95” modifier to indicate that the service was provided via telehealth. This allows for greater reimbursement for the practitioner when the patient is not at an eligible originating site that can bill a facility fee, such as the patient’s home. Although this change was announced on an interim basis only for the period of the PHE, providers should closely monitor telehealth coding requirements coming out of the PHE since uncertainty remains about how much of these coding and reimbursement changes will remain after the PHE.
- New Telehealth-Eligible Services: CMS added several CPT codes to the list of telehealth-eligible services, including emergency department visits, initial/subsequent observation, inpatient hospital care and hospital discharge day management, initial nursing facility visits and nursing facility discharge day management, and home visits. Under current guidance, these are available only for the duration of the PHE, but providers using these codes should monitor CMS guidance to determine if any of the temporarily available codes may continue after the PHE.
- Supervision: Direct supervision, typically required for “incident to” services, usually requires the supervising practitioner be in the same office suite and immediately available. Similarly, supervision of residents performing procedures should typically take place in person. However, during the PHE, CMS is permitting direct supervision and resident supervision to take place through the supervising physician’s virtual presence through real-time audio-video communication technology, when clinically appropriate. Providers should develop protocols to move back to traditional direct supervision after the conclusion of the PHE.
- Other Face-to-Face Requirements: During the PHE, CMS is permitting telehealth to be used in place of certain face-to-face visit requirements for home health, hospice, inpatient rehabilitation facilities, and under other national coverage determination (NCD) and local coverage determination (LCD) guidance. Additionally, telehealth frequency limitations for inpatient hospital visits, nursing facility visits, critical care consultation services, and hands-on end-stage renal disease visits have also been waived during the PHE. Practitioners should pay attention to subsequent guidance pertaining to face-to-face visits in these circumstances in light of potential ongoing risks for COVID-19 after the PHE.
- Non-Telehealth Communication Technology-Based Services: Several types of remote health care services are not considered “telehealth” because they are inherently technology-based and do not replace in-person services. CMS has categorized these services—including chronic care management, remote physiologic monitoring, virtual check-ins, e-visits, and telephone evaluation and management (E/M) services—as communication technology-based services (CTBS).
- Established Patient Requirement – Most CTBS requires a preexisting relationship between the practitioner and patient, but CMS has relaxed enforcement of this requirement during the PHE. Therefore, while providers may take advantage of this regulatory flexibility for now, they should also develop mechanisms for verifying whether the patient meets the definition of an established patient after the PHE.
- Telephone E/M – These services, which can also be performed by practitioners who cannot separately bill for E/M like licensed clinical social workers, physical therapists, and speech-language pathologists, are typically not eligible for reimbursement by Medicare. However, CMS has made these CPT codes available for payment during the current PHE. Providers using these codes during the PHE should develop a plan to transition this care to reimbursable services after the PHE ends.
There are more regulatory flexibilities than those listed above, and still widespread belief that more are yet to come. And it is unclear whether regulatory flexibilities like reimbursement changes for telehealth services will extend beyond the current PHE. However, as providers scramble to take advantage of these flexibilities to provide care remotely during the COVID-19 PHE, they should keep the non-PHE regulatory landscape in mind and develop strategies and workplans for continuing to provide telehealth to patients in a post-COVID-19 world.
It is critical that work plans account for regulatory change and fluid compliance considerations moving forward to mitigate the likelihood of legal and regulatory risks that will arise when the PHE ends.
Alston & Bird has formed a multidisciplinary task force to advise clients on the business and legal implications of the coronavirus (COVID-19). You can view all our work on the coronavirus across industries and subscribe to our future webinars and advisories.