Health care providers will continue to receive instructions, guidance and recommendations on how to handle the COVID-19 pandemic from the Centers for Disease Control and Prevention (“CDC”), the U.S. Department of Health and Human Services (“HHS”), state and local health departments and other governmental agencies.[1]  As our country navigates this new environment, our Dickinson Wright health care law attorneys are actively assisting health care providers with understanding their legal obligations on matters relating to the COVID-19 pandemic.  This document sets forth frequently asked questions from health care providers regarding these legal obligations and our recommendations.  We will update this article as laws, orders and other rules continue to change in response to the COVID-19 pandemic.

1. What steps must my facility or practice take to reduce exposure to patients within the facility?

Providers have a legal obligation to comply with the standard of care and use all reasonable care in reducing/minimizing their patients’ exposure to communicable diseases within their own health care office.[2]  In furtherance of this standard, providers must closely review all risk assessment guidance published by state and federal public health authorities on public health management of persons with potential COVID-19 exposures.  Providers should follow the guidelines to the extent reasonably possible under the circumstances and comply with at least industry standard precautions to minimize the risk of inadvertent transmission of COVID-19 within a provider’s off, including for example:

• Place appropriate signage on the front doors of the office, at the front desk and at key locations throughout (such as elevators) to provide patients with instructions as to appropriate hand hygiene and social distancing etiquette.
• Institute and train personnel on patient triage and screening protocols for every patient that enters the office.
• Ensure that a patient’s travel history is received at check-in
• Install physical barriers between triage areas and potentially infectious patients. Identify a separate, well-ventilated space that allows waiting patients to be separated by six or more feet, with easy access to hygiene supplies. Providers should allow medically stable patients to wait in a personal vehicle or outside the health care provider’s office where they can be contacted by mobile phone when it is their turn to be evaluated.  Some practices may be able to establish areas within or outside of the office as screening areas, to evaluate potentially infectious patients separate from other patients and/or visitors.
• Health care providers should also determine whether it is possible to create an airborne isolation infection room for patients suspected to have been infected with COVID-19. At a minimum, providers should place such patients in a private room with a facemask on and close the door.  The private room’s air should not be recirculated without appropriate HEPA filtration.
• Develop a phone triage protocol when a patient calls with suspected symptoms.
• Promptly and properly disinfect all waiting and patient treatment rooms. Ensure that cleaning staff are following consistent and correct cleaning and disinfection procedures (such as using an EPA-registered, hospital-grade disinfectant with an emerging viral pathogens claim).
• Reschedule non-urgent visits when necessary and possible, including for patients in vulnerable populations (e.g., people 65 or older, those with compromised immune systems, pregnant women, etc.). Practices should also consider eliminating penalties for cancellation or missed appointments by patients, to encourage patients not in urgent need of care to stay home.

2. What steps is my practice legally required to take to reduce COVID-19 exposure to our workforce members?[3]

Under the Occupational Safety and Health Administration (“OSHA”), employers have a duty to provide a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.” OSHA has also set up a site to help employers during the coronavirus outbreak: https://www.osha.gov/SLTC/covid-19/. If you haven’t done so already, developing a plan now to address the coronavirus outbreak in the U.S. may help to keep employees healthy, alleviate public concern, and reduce corporate liability.  Employees of health care providers are in a particularly precarious position with respect to the COVID-19 pandemic.

The CDC has developed interim guidance specifically for businesses and employers to reduce transmission and prepare for potential consequences related to the spread of the coronavirus.[4]  Recommended corporate actions include the following:

• Actively encourage sick employees or employees with sick family members to stay home. Encourage telecommuting for all positions possible;
• Test employees involved in patient care if symptoms warrant as provided herein;
• Send home employees who are sick or who become sick during the workday;
• Educate employees on coronavirus risk assessments and encourage sick employees to seek medical care;
• Ensure sick leave policies are flexible and consistent with federal, state, and local laws and guidance. Do not discipline employees who are absent due to illness or care for sick family members (note that legislation is proposed and/or pending across the U.S. to provide for additional paid sick leave for employees). Understand that you may have to make policy exceptions for unique situations;
• Provide awareness of modified, suspended, or active sick leave policies to employees immediately and often;
• Educate employees on respiratory etiquette (cough and sneeze cover) and hand hygiene (printable resources are available on the CDC website: https://www.cdc.gov/coronavirus/2019-ncov/communication/factsheets.html);
• Perform additional and special routine environmental cleaning and provide disposable wipes for employee cleaning use during the day. Encourage cleaning stations at the beginning and end of each day and between all shift changes;
• Comply with travel bans. Cancel all non-essential business travel, including domestically. Discourage all employee personal travel. https://www.cdc.gov/coronavirus/2019-ncov/travelers/index.html.
• Cancel all non-essential large work-related meetings or events. Gatherings over 250 people are prohibited; more narrow restrictions are expected;
• Identify essential business functions, jobs or roles, and elements within your supply chains required to maintain business operations. Plan for how your business will operate if there is increasing absenteeism or supply chains are interrupted; and
• Create (or refresh) an infectious disease outbreak response plan in writing now, recognizing that the plan’s scope and procedures may vary depending on unique business operations and needs.
• Prepare to equip your workforce to handle increasingly high volumes of patient needs and plan for increased coverage accordingly.

Health care providers in particular should take action to determine whether they have sufficient personal protective equipment on hand for their staff and ensure that staff is properly trained on the use of the equipment (including how to don and doff the equipment).  Such equipment includes respirators, fit-tested N95 mask or PAPR or better, gloves, gowns, goggles, and face shields.  Instruct staff on the proper manner of donning and doffing such equipment.

When performing procedures that could produce or induce coughing or collecting specimens, health care providers must proceed with caution and should instruct employees to wear an N95 or higher respirator, eye protection, gloves, and gowns. The number of providers necessary to perform the procedure should be limited to minimum necessary and others, including family members, should not be present.

Additionally, health care employers, in particular, should stay up to date on expansion of unemployment benefits during this period.  For example, under Executive Order 2020-10, Michigan Governor Gretchen Whitmer expanded unemployment benefits for first responders in the public health community who become ill or are quarantined due to exposure to COVID-19, among other categories of workers.[5]

3. What controls over access to our office or facility are legally required or permissible?

Health care providers who submit claims to federal health care programs are required by law to develop access policies and procedures.  It is recommended that all visitors be screened for symptoms of respiratory illness (e.g., coughing, fever, etc.) prior to being permitted to enter the office.  Facilities, such as hospitals, should encourage alternatives to in-person visitations (e.g., telehealth, as set forth below) whenever possible and appropriate.

With respect to nursing homes, on March 13, 2020, the Centers for Medicare and Medicaid Services (“CMS”) issued guidance to all nursing homes on restricting visitation of all visitors and non-essential health care personnel, except for certain compassionate care situations, such as end-of-life situations.  It is likely that CMS will issue further guidance to other types of facilities and providers on access controls.

In Michigan, Governor Gretchen Whitmer recently issued the following special order (violation of which is a misdemeanor):[6]

• Beginning on March 14, 2020, at 9:00 a.m. and continuing through April 5, 2020, at 5:00 p.m., all health care facilities, residential care facilities, congregate care facilities, and juvenile justice facilities must prohibit from entering their facilities any visitors that are not necessary for the provision of medical care or the support of activities of daily living, or that are not visiting under exigent circumstances, such as grave illness or imminent death of a family member under care in the facility.
• Beginning as soon as possible but no later than March 16, 2020, at 9:00 a.m. and continuing through April 5, 2020, at 5:00 p.m. all health care facilities, residential care facilities, congregate care facilities, and juvenile justice facilities must perform a health evaluation of all individuals that are not under the care of the facility each time the individual seeks to enter the facility, and must deny entry to those individuals who do not meet the evaluation criteria. The evaluation criteria must include: symptoms of a respiratory infection, such as fever, cough, shortness of breath, or sore throat; and contact in the last 14 days with someone with a confirmed diagnosis of COVID-19.

In Tennessee, Governor Bill Lee issued Executive Order 14 to facilitate treatment and containment of COVID-19 which includes the following:

• Permits health care professionals licensed in other states to provide health care services in Tennessee related to COVID-19;
• Allows pharmacists to dispense an extra 30-day supply of maintenance prescriptions as needed in response to COVID-19;
• Allows health care professionals to provide localized treatment to patients in temporary residences;
• Expands testing sites for COVID-19;
• Allows the construction of temporary health care structures in response to COVID-19;
• Implements price-gouging protections on medical and emergency supplies;
• Suspends restrictions on vehicles transporting emergency supplies to areas affected by COVID-19;
• Permits the waiver of certain regulations on childcare centers as needed to respond to the effect of COVID-19;
• Authorizes TennCare policy changes to ensure that covered individuals receive medically necessary services without disruption; and
• Directs coordination with health insurance plans to improve access to screening, testing, and treatment for COVID-19.

4. What steps can my practice take to better protect my patients and workforce members in a shared office building that we do not own?

If a health care provider is located in a shared office building having space in common with other tenants, it is important to discuss with the landlord the full extent of what can be done within the building to further protect its patients and workforce.  It is important to note the Lease may be silent in this respect.  For example, the health care provider should discuss with the property owner the following:

• Whether the property owner or landlord will agree to limit access entry points into the building and direct all visitors into a specific entrance;
• Temperature checks of all visitors entering the building (not just the health care provider’s patients);
• Enhanced cleaning efforts such as frequent sanitization of common areas, bathrooms, and elevators, which are not otherwise under the health care provider’s control.

In these situations, we believe the best approach would be a shared obligation between the health care provider, the property owner/landlord and other businesses located within the same building.

5. When does HIPAA allow health care providers to share information about patients suspected or confirmed to have COVID-19?[7]

The Privacy Rule of the Health Insurance Portability and Accountability Act of 2006 (the “HIPAA Privacy Rule”), to the extent applicable to your practice[8], sets forth strict rules surrounding when health care providers may share identifiable information relating to their patients (such as name, address, medical record number, and any other information that may reasonably lead to identification of the patient).  However, there are several situations where the HIPAA Privacy Rule will permit disclosures relating to cases of COVID-19 when necessary, including:

• To public health authorities, such as the CDC or a state or local health department, that are authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability. This allows health care providers to disclose to the CDC and their local health authorities information needed to report all cases of patients exposed to or suspected or confirmed to have COVID-19.
• To disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts, for the purpose of coordinating the notification of family members or other persons involved in the patient’s care, of the patient’s location, general condition, or death.
• As necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public – consistent with applicable law (such as state statutes, regulations, or case law) and the provider’s standards of ethical conduct. Under this, providers may disclose a patient’s health information to anyone who is in a position to prevent or lessen the serious and imminent threat, including family, friends, caregivers, and law enforcement without a patient’s permission. The HIPAA Privacy Rule expressly defers to the professional judgment of health professionals in making determinations about the nature and severity of the threat to health and safety. It is advised that such a determination be made in coordination with legal counsel.
• To family, friends, and others involved in the patient’s care who have been identified by the patient as involved in his or her care. Ideally, health care providers have secured from the patient a written list of those individuals on the patient’s intake form.  Health care providers may also rely on a verbal list of those individuals (and in such situation, it would be best for the provider to incorporate that verbal list into the patient’s medical record).   Otherwise, if necessary the health care provider may make a disclosure if the health care provider is able to reasonably infer that the patient would not object to disclosure to family, friends or others whom the health care provider is aware has been involved in the patient’s care.
• Regarding patients who are unconscious or incapacitated, health care providers may share certain minimum and relevant information with the patient’s family, friends, or others involved in the patient’s care or payment for care, if the health care provider determines, based on professional judgment, that doing so is in the best interests of the patient.
• Also as a reminder, disclosures to other health care providers are permitted when necessary to treat the patient or a different patient. This includes, by way of example, coordinating or managing health care and related services by one or more health care providers, consulting between providers and referring patients for treatment for COVID-19.

6. When are we legally required to report a case or suspected case of COVID-19?

Under Michigan law, physicians and clinical laboratories are required to report known or suspected cases of COVID-19 to the appropriate local health department.[9]    The appropriate local health department is the department located in the county in which the patient resides or the provider is located.  Reports of COVID-19 must be made to the appropriate local health department within 24 hours of discovery.[10]  Providers must ensure they have plans in place to work with and report to public health authorities.

When a physician or a laboratory suspects a patient has COVID-19, but does not have sufficient information to be certain of the diagnosis, the physician or laboratory must report the possibility of infection as suspected. Upon confirmation of the disease or presence of the agent, the physician shall further report the confirmation to the local health department as a case.  In addition to physicians and clinical laboratories, all of the following individuals are specifically authorized to report COVID-19 to local health authorities:

• An administrator, epidemiologist, or infection control practitioner from a health care facility or other institution
• A dentist
• A nurse
• A pharmacist
• A physician’s assistant
• A veterinarian
• Any other health professional

7. How can we promote the use of a telehealth program to curb the spread of COVID-19?

The use of telehealth technology for providing health care services implicates various laws, regulations, licensing, and payor billing and reimbursement rules.  However, the recent passage of new laws and orders surrounding telehealth for the purpose of curbing the COVID-19 outbreak will start to make it easier to use telehealth at this time.  For example:

• On March 6, 2020, Congress signed the Coronavirus Preparedness and Response Supplemental Appropriations Act which grants the Secretary of Health and Human Services (“HHS”) power to dismiss telehealth restrictions for Medicare beneficiaries. Policymakers intended for the law to create a new pathway for seniors to receive care during COVID-19.
• On March 10, 2020, CMS issued a Memorandum to permit Medicare Advantage Organizations to waive or reduce enrollee certain cost-sharing for beneficiaries impacted by the outbreak. CMS also authorized Medicare Advantage Organizations to provide access to telehealth services in any geographic area and a variety of places, including beneficiaries’ homes. CMS also advised Part D Sponsors that they may relax “refill-too-soon” edits if circumstances are reasonably expected to result in disruption in access to medications and relax policies restricting mail or home delivery. CMS also authorized Part D sponsors to reimburse enrollees for prescriptions obtained from out-of-network pharmacies. For Medicare Advantage Organizations and Part D sponsors, plans may choose to waive prior authorizations for medications or services. https://www.cms.gov/files/document/hpms-memo-covid-information-plans.pdf. These actions are considered permissive on the part of Medicare Advantage Organizations and Part D sponsors, not required at this time.
• In Michigan, Governor Gretchen Whitmer announced expanded access to telemedicine by immediately allowing Medicaid beneficiaries to receive services in their home in an effort to halt the spread of the coronavirus pandemic.
• On March 13, 2020, President Donald Trump in response to the COVID-19 Pandemic declared a national emergency to open access to up to $50 billion in funding for states, territories, and localities. President Trump requested every hospital to activate emergency preparedness plans to meet the needs of patients.  Additionally, President Trump issued broad new authority to the Secretary of HHS to immediately waive provisions of applicable laws and regulations to give doctors, all hospitals and health care providers maximum flexibility to respond to the virus and care for patients.  This broad new authority and funding will likely impact the use of and laws surrounding telehealth services.

Telehealth is particularly well suited for the initial screening of patients and providing quicker and safer access to providers.  Telehealth includes, for example, the use of real-time video interaction, “store and forward” technology, remote patient monitoring or online chat groups and internet sites, provided that HIPAA privacy and security rules still apply.  When using these technologies a health care provider must ensure HIPAA compliant security levels (for example, the use of Skype is not likely to be considered HIPAA compliant) to avoid inadvertently triggering a breach under the HIPAA rules.[11]

The CDC has issued the following guidelines on promoting the increased use of telehealth:

• Health care facilities can increase the use of telephone management and other remote methods of triaging, assessing and caring for all patients to decrease the volume of persons seeking care in facilities.
• If a formal “telehealth” system is not available, health care providers can still communicate with patients by telephone (instead of visits), reducing the number of those who seek face-to-face care.
• Health plans, health care systems, and insurers/payors should message beneficiaries to promote the availability of covered telehealth, telemedicine, or nurse advice line services

8. What should be done with regard to developing or revising my emergency preparedness plan?

It is necessary for every health care provider to develop, review and follow an emergency preparedness plan with respect to the COVID-19 pandemic.  In fact, CMS now requires all Medicare-participating providers and suppliers to implement emergency preparedness regulations.[12]  Such plans should be developed in coordination with legal counsel.

[1] On March 11, 2020, the World Health Organization (“WHO”) declared COVID-19, the disease caused by the coronavirus, a pandemic. As this situation continues developing, the guidelines in this article will be updated by our health care attorneys and re-posted.  These guidelines should not be used in lieu of a comprehensive emergency preparedness plan as providers should consult the most up-to-date guidance issued by the Centers for Disease Control and Prevention (“CDC”), the U.S. Department of Health and Human Services (“HHS”), and state and local health departments.

See, CDC Guidance on the Steps Health care Facilities can take: https://www.cdc.gov/coronavirus/2019-ncov/health care-facilities/index.html

[2] See also CDC guidelines, at https://www.cdc.gov/coronavirus/2019-ncov/health care-facilities/index.html

[3] Response to this question is in coordination with Dickinson Wright’s employment and labor law attorneys.  In particular, see Coronavirus (COVID-19) Precautions for Employers, at http://healthlawblog.dickinson-wright.com/2020/03/coronavirus-covid-19-precautions-for-employers/

[4] Employers are encouraged to study the CDC’s guidance for businesses and employers available on the CDC’s webpage: https://www.cdc.gov/coronavirus/2019-ncov/specific-groups/guidance-business-response.html

[5] Those categories include:

• Workers who have an unanticipated family care responsibility, including those who have childcare responsibilities due to school closures, or those who are forced to care for loved ones who become ill.
• Workers who are sick, quarantined, or immuno-compromised and who do not have access to paid family and medical leave or are laid off.
• First responders in the public health community who become ill or are quarantined due to exposure to COVID-19.

[6] https://www.michigan.gov/whitmer/0,9309,7-387-90499_90705-521676–,00.html

[7] If you are not a health care provider but become aware of a case or suspected case of COVID-19, you should contact the local health department regarding the recommended steps as to when and how it is recommended you notify others and/or identify the person at issue.

[8] The determination of whether HIPAA applies to a health care provider requires an analysis of the definition of “Covered Entity” under HIPAA.  Many, but not all, providers of health care services are Covered Entities under HIPAA.

[9]https://www.michigan.gov/documents/mdhhs/MDHHS_CDC_PUI_Form_and_Cover_Sheet_Fillable_v02.03.2020_680230_7.pdf

[10] https://www.michigan.gov/documents/mdch/Reportable_Diseases_Michigan_by_Pathogen_478489_7.pdf

[11] To date, no law or order has been issued that would specifically change a health care provider’s HIPAA privacy and security obligations surrounding the use of technology to share protected health information with respect to COVID-19.

[12] See https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/Emergency-Prep-Rule