COVID-19 Public Health Emergency and HIPAA Telehealth Flexibilities Extended
The Secretary of the Department of Health and Human Services, Xavier Becerra, extended the COVID-19 Public Health Emergency (PHE) today (October 13, 2022) for the 11th time. The COVID-19 PHE was first declared in January 2020 by then HHS Secretary, Alex Azar II, with the previous extension issued by Becerra on July 15, 2022. The latest extension of the COVID-19 PHE is for a further 90 days, making the next deadline January 11, 2023.
Update: The PHE was extended once again, but that will be the final extension – The flexibilities will end on May 11, 2023, at 11:59 pm. However, there will be a transition period of 90 days, so the absolute deadline is August 11, 2023.
Several flexibilities were introduced in response to the COVID-19 PHE, including changes to Medicare to expand coverage of telehealth services during the pandemic. Coverage was extended to include Medicare beneficiaries in any geographic region, not just beneficiaries in rural areas. Beneficiaries were permitted to remain in their homes for telehealth visits, the visits could be delivered via smartphones, and Medicare expanded the list of services that could be provided virtually.
The Department of Health and Human Services’ Office for Civil Rights also issued a Notice of Enforcement Discretion with respect to the good faith provision of telehealth services. “OCR will exercise its enforcement discretion and will not impose penalties for non-compliance with the regulatory requirements under the HIPAA Rules against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency,” explained OCR in its COVID-19 telehealth guidance.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under OCR’s Notice of Enforcement Discretion, healthcare providers are permitted to use “any non-public facing remote communication product that is available to communicate with patients,” even if the technology would not normally be permitted under HIPAA, such as if the provider will not enter into a business associate agreement with the healthcare provider.
“The Notification of Enforcement Discretion will remain in effect until the Secretary of HHS declares that the public health emergency no longer exists, or upon the expiration date of the declared public health emergency, including any extensions, whichever occurs first,” explained OCR. “OCR will issue a notice to the public when it is no longer exercising its enforcement discretion based upon the latest facts and circumstances.”
The HHS has previously committed to providing a 60-day notice to states before the expiration of the COVID-19 PHE or the termination of the HIPAA telehealth flexibilities to give them time to prepare. The HHS is also due to notify healthcare groups in advance to allow them to prepare their members. The absence of any such notifications makes it almost certain that a further extension will be announced. Should the decision be made not to extend the COVID-19 further past January 2023, the 60-day notice period will need to be issued by mid-November.
It is important for healthcare providers to be aware that while the COVID-19 public health emergency has been repeatedly extended, these extensions will not continue indefinitely. When the COVID-19 PHE is declared over, the HIPAA telehealth flexibilities will come to an end. It is therefore recommended that healthcare organizations prepare for the end of the COVID-19 PHE and start evaluating HIPAA-compliant telehealth solutions – Solutions that have the necessary safeguards to comply with the HIPAA Security Rule and are provided by vendors willing to enter into a business associate agreement. Healthcare providers should consider transitioning to those solutions ahead of the HHS announcement of the end of the COVID-19 PHE, or ensure that they develop a plan that can be implemented immediately when notice is provided that the PHE will end.
