Legal & Practical Considerations for Telemedicine
By CINDY SANDERS
AHLA Panel Looks at Current, Post-Pandemic Landscape
In the face of a global health crisis that called for limiting close, in-person contact, it's not surprising telemedicine has enjoyed skyrocketing popularity in 2020. In addition to the practicality of such medical appointments, emergency orders loosening tight regulatory mandates around the field has made it possible for more providers to offer services to a larger patient population.
Nothing, however, lasts forever.
Turning an eye to a post-pandemic landscape, the Physician Organizations Practice Group of the American Health Law Association recently hosted a webinar looking at both legal and practical considerations of telemedicine now and moving forward. The regulatory changes currently in place are in effect throughout the public health emergency. When that designation is removed, rules and regulations revert to pre-pandemic status unless there is further action at the federal level.
On March 13 of this year, President Donald Trump made an emergency declaration in regard to the COVID-19 pandemic under the Stafford Act and the National Emergencies Act. That declaration of a public health emergency (PHE) set into motion authority for various federal agencies to issue waivers providing flexibility to meet the unique challenges of COVID-19.
Within days, changes went into effect across Health and Human Services. The Office for Civil Rights (OCR) issued new HIPAA guidance allowing covered providers, "in good faith, (to) provide telehealth services to patients using remote communication technologies, such as commonly used apps - including FaceTime, Facebook Messenger, Google Hangouts, Zoom, or Skype - for telehealth services, even if the application does not fully comply with HIPAA rules."
CMS issued a number of waivers making it easier for those enrolled in Medicare, Medicaid and the Children's Health Insurance Program (CHIP) to access care through telehealth platforms during the crisis. Changes have allowed providers to conduct telehealth visits with patients inside their homes and outside of designated rural areas. In many cases, providers could practice even across state lines. Telemedicine could be used for both established and new patients, and the appointments have been billable as if the visit was in person. Additional waivers specifically addressed Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs), including easing some physician supervision requirements for nurse practitioners to the extent permitted by state law.
Transformation of Telemedicine
Ronnen Isakov serves as managing director of healthcare advisory services for Medic Management Group, which provides operational, management, financial and revenue services for practices. He noted CMS added 135 allowable services and CPT codes under the emergency orders, immediately doubling what had been available at the beginning of the year.
The healthcare industry, said Isakov, is notoriously slow-moving when it comes to transformation. "For our rules to change takes a long process," he pointed out. "The pandemic kick-started the digitalization of healthcare." Isakov added telehealth saw a decade of regulatory changes in a matter of a days and weeks.
Similarly, the medium saw an explosion in usage. Isakov said the normal number of telemedicine visits in March had been about 13,000 Medicare beneficiaries per week. "During the last week of April, in a six-week period, that number jumped to 1.7 million beneficiaries," he noted. For those keeping score, that's a 15,354 percent increase.
Isakov added that pre-pandemic, McKinsey estimated the total annual revenue of all American telehealth companies to be $3 billion. The company now estimates $250 billion of the nation's health spend could ultimately be digitized. Similarly, Frost & Sullivan now predicts a seven-fold growth in telehealth by 2025.
From the operational viewpoint, Isakov said telehealth has focused on ease of access. "For our rural practices and facilities, it was an immediate way to solve some patient transportation issues," he added of the relaxed RHC regulations.
On the flip side, Isakov noted, "There's still a lot of perceived quality of care concerns." He also said smaller practices continue to worry about the financial investment required long-term, coupled with reimbursement uncertainty once temporary waivers expire. While it remains to be seen if payers continue to reimburse adequately, Isakov said there is a lot of pushback for expanded services to continue.
"We really believe it's unlikely to see telehealth volumes go back to the pre-March numbers but that some form of telehealth is here to stay," he concluded.
Kyle Sharp, interim associate vice president and executive director of OSU Physicians at Ohio State University, said the huge system utilized telemedicine for about 100 visits per month for a total of 0.04 percent of overall patient visits prior to COVID-19.
Looking at telehealth vs. in-person visits, Sharp said telehealth didn't even register in the numbers pre-pandemic. By March, a little more than 13,000 visits were conducted remotely. In April and May, telehealth visits outnumbered in-person visits with 44,591 telehealth visits in April and 40,898 in May. "During the peak of the pandemic, 90 percent of our providers were using telehealth," he said. At this point, Sharp added, they have had telehealth visits from 49 states, although the majority of remote visits have been in a four-state region.
As clinics slowly reopened and expanded services throughout the summer, Sharp said in-person visits began to rebound with total number of patient visits nearing pre-COVID projections. While telehealth visits have decreased, they have remained a significant percentage of overall visits. In August 2020, in-person visits accounted for 82,866 patient encounters, but telehealth added another 26,429 visits - a far cry from the 100 per month before the pandemic.
Coming out of COVID, Sharp said their ongoing telehealth targets are for about 30 percent of primary care, 20 percent of medical specialty and 10 percent of surgical visits to be conducted via telehealth. Sustaining momentum, he added, will require some additional patient education. "Our Medicare population did not resonate with our telehealth platforms as did our other populations," he noted.
Evolving Telehealth Law
Kate Hickner, a partner in the Cleveland office of Brennan Manna & Diamond and chair of AHLA's Physician Organizations Practice Group, noted telemedicine first came on the scene in 1997 as part of the Balanced Budget Act. There have been multiple tweaks to the law, some quite significant, over the ensuing two decades.
Hickner said the Medicare Telehealth Benefit is outlined in section 1834(m) of the Social Security Act, which includes specific geographic, location, service, technology and provider requirements, albeit with some exceptions. "Even though Medicare has implemented waivers, 1834(m) of the Social Security Act is still the law," she pointed out.
Hickner said Congress will have to address the changes that have been put in place when the public health emergency declaration expires. She added there does seem to be a will to expand telehealth access. "There is a White House directive to CMS to look at telehealth efforts in rural health areas," Hickner noted. She added the proposed 2021 physician fee schedule adds nine telehealth codes permanently, removes 74 at the end of the year in which the public health emergency declaration expires, and includes 13 codes to add to the list of telehealth services. However, she pointed out, any changes at this point are still in the proposed stage.
During the PHE, Hickner noted the HHS Office of the Inspector General (OIG) has created increased flexibility to allow providers to waive copays and deductibles for telehealth. Under normal circumstances, such a move to reduce or waive costs owed by federal healthcare program beneficiaries could be seen as inducement under the anti-kickback statute. However, OIG has said they will not enforce the statutes if providers choose to reduce or waive cost-sharing for telehealth during the COVID-19 emergency.
Other flexibilities around supervision, signature requirements, licensure, credentialling, prescribing and data privacy and security have all been temporarily implemented, as well. Medical documentation for a telehealth visit, she continued, is generally the same as for an in-person visit with two key distinctions: 1) consent to receive telehealth services and 2) notation of the state where the patient is located for the visit and specific location of the rendering provider.
"Regardless of the flexibility offered by CMS, we do need to consider state law," Hickner reminded the audience. "The practice of medicine occurs where the patient is located at the time of service," she continued. If a physician is in Tennessee but caring for a patient in Arkansas, then Arkansas' rules and regulations govern the encounter.
For those who didn't previously have a robust telehealth program in place, Greg Stein, IT and IP counsel for Cleveland Clinic, said now is the time to be thinking about how to move forward post-pandemic.
Currently, the type of technology that can be used has been greatly expanded to include any non-public facing remote communications product including Zoom, FaceTime, Microsoft Teams and other popular platforms. Similarly, private texting applications including Facebook Messenger, Jabber and iMessage are acceptable. However, cautioned Stein, using public-facing technologies like TikTok, Facebook Live or Twitch are prohibited for telehealth.
While penalties aren't being enforced right now for a hack related to the "good faith provision of a telehealth service," Stein said a "bad faith provision" is still in play including an intentional invasion of privacy, use of personal health information (PHI) prohibited by the HIPAA Privacy Rule such as selling data or using PHI for marketing purposes without authorization, telehealth violations of state licensing laws or professional ethical standards, and for using public-facing remote communication products.
"At some point, this moratorium is not going to apply, so practices need to be thinking how telehealth will work within the framework of HIPAA," he said of reverting back to more stringent rules. "With this enforcement discretion in place, it's a really good opportunity to dig into details right now," he continued.
Stein, who served as vice chair of the Data Privacy and Information Security Group as a partner at Ulmer & Berne LLP prior to joining Cleveland Clinic, suggested teaming up with someone who understands the technology in play and the requirements to adequately protect privacy and security to meet stringent HIPAA requirements once the PHE expires. He recommended asking lots of questions or finding an advisor who knows what questions to consider when it comes to negotiating a telehealth agreement and analyzing risk.