MDS Alert

Telehealth Privacy:

Keep These HIPAA Rules Handy for Telehealth Encounters

CMS tries to make things easier on providers, and nursing facilities can benefit.

The realities of COVID-19’s infection rate and spread has upended norms across the long-term care industry, but the declaration of a public health emergency (PHE) has allowed for the cutting of some red tape.

Luckily, the various telehealth expansion measures the Centers for Medicare & Medicaid Services (CMS) enacted can make some aspects of nurse assessment coordinators’ (NACs) jobs a little bit easier. One silver lining? NACs are rejoicing, in an informal MDS coordinators Facebook group, that their care planning meetings, now conducted through audiovisual programs instead of in person, have never been shorter or more efficient.

While everyone is adjusting to this new normal, it’s important to remember that some rules and regulations have been adjusted, but others are still as strict as ever. Don’t jeopardize your residents’ privacy and security rights through inadvertently violating HIPAA measures.

Look to Expanded Telehealth Services

On March 17, CMS announced an expansion of telehealth benefits for specific providers and their patients. The changes allow clinicians to provide telehealth visits to patients anywhere, not just in rural areas, and in their homes rather than at a healthcare facility.

“Patients will now be able to access their doctors using a wider range of communication tools including telephones that have audio and video capabilities, making it easier for beneficiaries and doctors to connect,” CMS says in its telehealth expansion release.

These updates are useful for long-term care facilities worried about limiting the flow of people in and out.

Remember: CMS and the Centers for Disease Control and Prevention (CDC) have specified which staff and auxiliary workers are essential, but know that there have also been some suspected incidents of healthcare personnel and organization staff moving between facilities — and bringing SARS-CoV-2, the virus that causes COVID-19, with them.

Consider These Popular Apps During PHE

If you’re struggling to figure out how to connect with residents’ representatives easily and compliantly, a recent clarification should be welcome news.

The HHS Office for Civil Rights (OCR) issued a notification of HIPAA enforcement discretion. The agency will “not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered healthcare providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency,” OCR said.

See the March 17 notification at www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html.

The feds further clarified that non-public-facing technologies like FaceTime and Skype can be used for telehealth visits, but public-facing technologies like TikTok, Facebook Live, or Instagram Live cannot.

“We are empowering medical providers to serve patients wherever they are during this national public health emergency,” said Roger Severino, director of OCR. “We are especially concerned about reaching those most at risk, including older persons and persons with disabilities,” Severino added.

Next: On March 20, OCR followed up its first notification of enforcement discretion with FAQs on the intersection of HIPAA and telehealth. The guidelines include telehealth definitions, which covered entities (CEs) are impacted, a breakdown of the Rules the notification affects, and more.

Many NACs are finding that technology like Zoom provides a user-friendly way to connect people in different locations, including residents’ representatives. For more information on how some nursing facility staff can remain compliant but work remotely, see the reader question “People in This Staff Role Can Work Remotely,” page 47.

Review the FAQs at www.hhs.gov/sites/default/files/telehealth-faqs-508.pdf.

Reminder: The telehealth visit doesn’t have to be for COVID-19 reasons to qualify for the expansion and exemptions. “OCR emphasized the need to ensure remote access to care for patients, especially those most at risk, regardless of whether or not the service is related to COVID-19,” note attorneys Rebecca Schaeffer and Cheryl Choice with law firm K&L Gates in online analysis. “Increasing access to telehealth will reduce the need for healthy or [asymptomatic] individuals to travel to facilities for health care, which in turn will help interpersonal interactions and further reduce transmission.”

Stay Abreast of HIPAA Updates

The constant flow of changes, rollbacks, and revisions across all local, state, and federal sites has been overwhelming, and many find it challenging it to stay on top of the updates. Since its initial telehealth enforcement changes, OCR has released HIPAA briefs that impact a variety of organizations and entities, including nursing facilities.

First responders and transfers: On March 24, OCR released HIPAA privacy guidance on how CEs, including nursing facilities, should disclose the protected health information (PHI) of patients with or exposed to COVID-19 to law enforcement, paramedics, other first responders, and public health authorities, a release suggests. CMS and the CDC have noted that facilities should alert first responders and the respective hospital before transferring a COVID-19-positive resident for further care.

Following the HIPAA Privacy Rule is still vitally important, and facilities should remember that every effort must be made to protect residents while helping to stem the spread of the virus by sharing data with first responders, OCR reminds.

Read the guidance at www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf.

Civil rights: “On March 28, OCR issued a bulletin focused on Section 1557 of the Affordable Care Act and Section 504 of the Rehabilitation Act, which prohibits discrimination on the basis of disability in HHS-funded health care programs,” explain attorneys Chris Bennington and Allen Killworth with Bricker & Eckler LLP in online analysis. “The bulletin noted that these and other civil rights laws remain in effect during the pandemic, and providers must make decisions regarding whether a person is a candidate for treatment based on an individualized assessment of the best available objective medical evidence.”

Find the bulletin at www.hhs.gov/sites/default/files/ocr-bulletin-3-28-20.pdf.

Business associates: On April 2, OCR announced in its second COVID-19-inspired notification of enforcement discretion that it will not impose penalties on CEs or their business associates (BAs) for “certain provisions of the HIPAA Privacy Rule” when patients’ (or residents’) PHI is used or disclosed for PHE-related matters “in good faith.” This particularly concerns CE and BA interactions with CMS, the CDC, or state and local health agencies.

“Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives,” Severino stressed in a release.

Note that some state health departments, like New York, have stricter reporting requirements for facilities and require daily reporting of positive cases, deaths, and even personal protective equipment (PPE) stocks.

Resource: For a compendium of COVID-19-related telehealth resources for long-term care facilities, check out this CMS guide: www.cms.gov/files/document/covid-19-nursing-home-telehealth-toolkit.pdf.