Our Health Care Group discusses the just-signed Coronavirus Aid, Relief, and Economic Security (CARES) Act and what it means for telehealth in the midst of the coronavirus (COVID-19) pandemic.

• Telehealth expansion during the emergency and expanded waiver authority under Section 1135
• OCR telehealth guidance: HIPAA enforcement discretion
• OIG nonenforcement of administrative sanctions for cost-sharing reductions to telehealth services

On March 27, the massive Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law, including provisions granting the Centers for Medicare & Medicaid Services (CMS) sweeping waiver authority to expand the use of telehealth for Medicare with unprecedented latitude during the COVID-19 public health emergency.

Earlier in the month, the March 6, 2020 Coronavirus Preparedness and Response Supplemental Appropriations Act permitted the Department of Health and Human Services (HHS) to waive originating site and technology restrictions for Medicare Part B telehealth.

In response, on March 17, CMS announced blanket waivers for telehealth originating site rules—allowing patients to connect with care providers from their homes, even in urban areas—and state licensure requirements. The same day, the HHS Office of Inspector General (OIG) announced nonenforcement of rules limiting providers’ ability to waive cost sharing for telehealth and other remote health care modalities, and the HHS Office of Civil Rights (OCR) announced nonenforcement of Health Insurance Portability and Accountability Act (HIPAA) requirements for telehealth services provided in good faith during the public health emergency.

When Congress passed the Families First Coronavirus Response Act on March 19, the telehealth waiver authority was amended to broaden a requirement that Medicare beneficiaries have a preexisting relationship with their telehealth providers. However, CMS also announced nonenforcement of the preexisting patient relationship requirements in its March 17 guidance.

Amending the Secretary’s new telehealth waiver authority yet again, the CARES Act sets the stage for wholesale waiver of telehealth restrictions under Medicare as well as specific new telehealth rules during the public health emergency. The CARES Act also includes new funds for telehealth infrastructure.

Telehealth Expansion During the Emergency and Expanded Waiver Authority Under Section 1135

The CARES Act includes notable revisions of existing telehealth restrictions and significantly expands HHS’s waiver authority.

Part B services

HHS now has authority to waive all statutory requirements for telehealth services under Section 1834(m) of the Social Security Act, including all five usual elements of Medicare reimbursable telehealth services (originating site, rural area, distant site practitioner, qualifying technology, and eligible service).

Now, for example, CMS could extend Medicare benefits to additional types of services delivered via telehealth, allow other types of individual non-physician practitioners to provide care to patients via telehealth, or expand the list of services that may be provided via telehealth. The preexisting patient requirement for providing telehealth services pursuant to a waiver (which CMS already announced it would not enforce) has been removed; distant site providers may now provide care to patients via telehealth pursuant to the waivers, regardless of whether the provider had a preexisting relationship with the patient. Note that health care providers (or states or associations on their behalf) must still request and be granted such a waiver pursuant to Section 1135 unless CMS announces any broader blanket waivers.

Rural health clinics and federally qualified health centers

During the current public health emergency, rural health clinics (RHCs) and federally qualified health centers (FQHCs) may now serve as distant site providers for telehealth services and may bill (under special rules to be developed by CMS) for their services when provided via telehealth. Absent this provision, only eligible individual practitioners may bill as distant site providers.

Home dialysis

Face-to-face visits between physicians and patients receiving home dialysis treatment may be waived during the public health emergency, permitting physicians to conduct periodic evaluations remotely, both expanding access to care for particularly vulnerable patients and mitigating the spread of the coronavirus.

Hospice

Physicians and nurse practitioners may conduct recertification encounters for hospice care patients via telehealth during the public health emergency.

Home health

While not providing new authority, the CARES Act instructs HHS to consider ways to encourage the use of telehealth communications systems, including remote patient monitoring (or other communications or monitoring services), as part of a home health care plan during the public health emergency.

Funding streams

Significant funding streams in the CARES Act will also go toward enhancing telehealth and the communications infrastructure, including:

• USDA – Rural Development Programs
  • $25 million for distance learning, telemedicine, and broadband in rural areas.
  • $100 million available until September 30, 2021 in grants for the costs of construction, improvement, or acquisition of facilities and equipment needed to provide broadband service in eligible rural areas (i.e., 90 percent of households to be served by a project receiving a grant must be in a rural area without sufficient access to broadband) (the ReConnect Program).
• Federal Communications Commission (FCC)
  • $200 million available to support health care provider efforts to provide telecommunications services, information services, and devices necessary to enable the provision of telehealth.
  • The FCC may rely on existing regulations (47 C.F.R. Part 54) in administering this funding if it determines that administration is in the public interest.

In addition to the substantial emergency telehealth expansion, two federal agencies also announced last week that they would not enforce certain federal laws against providers using telehealth in good faith to combat the coronavirus pandemic.

OCR Telehealth Guidance: HIPAA Enforcement Discretion

The HHS OCR issued a Notification of Enforcement Discretion on March 17 (with additional guidance on March 20) announcing that it will not impose penalties for noncompliance with HIPAA privacy, security, and breach notification requirements against practitioners who provide telehealth services in good faith during the current public health emergency. Unlike the Medicare rules, the OCR guidance is relevant for care provided outside Medicare as well.

With this guidance, telehealth services provided for any reason—related to COVID-19 or not—can now take place over a number of applications that allow for video chat, including FaceTime, Facebook Messenger, Google Hangouts, Skype, or other platforms, without the practitioner risking penalties for noncompliance with HIPAA rules. The OCR still encourages practitioners to use available encryption and privacy modes and to notify patients that the applications may introduce privacy risks. Note that some limitations remain on the medium for providing telehealth services; for example, according to the OCR’s published FAQs on Telehealth and HIPAA during the COVID-19 nationwide public health emergency, “public-facing products such as TikTok, Facebook Live, Twitch, or … Slack are not acceptable forms of remote communication for telehealth” because they are open to the public and allow wide access to the communication.

Also note that the temporary relaxation of HIPAA rules applies to telehealth services only; at this time, whether this notification of enforcement discretion applies to other remote-based services, such as virtual check-ins, remote patient monitoring, or e-visits, remains a gray area.

OIG Nonenforcement of Administrative Sanctions for Cost-Sharing Reductions Related to Telehealth Services

The OIG also announced on March 17 that it will not subject telehealth providers to sanctions for reductions or waivers of beneficiary cost-sharing obligations for telehealth services furnished during the public health emergency. Ordinarily, a waiver or reduction of a federal program beneficiary’s cost-sharing obligation could potentially implicate the federal anti-kickback statute and the beneficiary inducement civil monetary penalty statute. The OIG will not subject physicians and other practitioners to the administrative sanctions if the arrangements meet both of the following conditions:

• A physician or other practitioner reduces or waives cost-sharing obligations (i.e., coinsurance and deductibles) that a beneficiary may owe for telehealth services furnished consistent with the then-applicable coverage and payment rules.
• The telehealth services are furnished during the public health emergency declared by the HHS Secretary.

The OIG later issued clarifying guidance that extended the cost-sharing nonenforcement to all non-face-to-face services, including telehealth as well as virtual check-ins, e-visits, remote patient monitoring, and remote care management.

Download PDF of Advisory

[View source.]