On Friday night, the Office of Civil Rights (“OCR”) issued additional guidance for covered entities looking to expand telehealth services in response to the COVID-19 public health emergency. The guidance, issued in the form of a bulletin with FAQs, is a follow-up to OCR’s Notification of Enforcement Discretion issued earlier this week, encouraging “good faith” expansion of telehealth services using non-public facing platforms that are not HIPAA compliant.
OCR clarified in its guidance that health insurers are not covered by the Notification. In addition, while covered entity health care providers are encouraged to sign a business associate agreement where possible, OCR will not impose penalties against covered health care providers for the lack of a business associate agreement with video communication vendors.
OCR also explained what may constitute bad faith in the provision of telehealth by a covered health care provider, including the sale or use of PHI for marketing purposes without patient authorization.
OCR’s Notification of Enforcement Discretion for telehealth remote communications during the COVID-19 nationwide public health emergency is available here:
https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html
FAQs on Telehealth and HIPAA during the COVID-19 nationwide public health emergency are available here:
https://www.hhs.gov/sites/default/files/telehealth-faqs-508.pdf
