Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

Telehealth Flexibility Updates: HIPAA, DEA, and CMS

Client Alert
May 12, 2023

The Covid-19 Public Health Emergency (PHE) officially ended on May 11, 2023.[1] But what does that mean for telehealth, a field that expanded exponentially during the PHE? Fortunately, many of the flexibilities will remain intact, at least temporarily. This client alert presents a brief overview of the timelines that providers need to follow, but for a more comprehensive review of telehealth flexibilities and when they will end, please see my presentation on the same topic here:  https://youtu.be/mIpFaKG7jio.[2]

HIPAA

On May 11, the Notice of Enforcement Discretion issued under HIPAA ended, which means providers must use HIPAA-compliant platforms and patient communication tools for all telehealth appointments. The Office of Civil Rights has released a statement allowing for a 90-day transition period for covered health care providers to come into compliance with the HIPAA rules. After that, providers should expect enforcement to resume.

Medicare

The Centers for Medicare and Medicaid Services (CMS) have extended many of the telehealth flexibilities offered during the pandemic but not all. For example, the waivers regarding telehealth and remote patient monitoring (RPM) cost sharing expired on May 11. [3]  CMS currently reimburses telehealth services at non-facilities at an equivalent rate to in-person rates, but this Medicare payment parity is scheduled to end on December 31, 2023.[4] Also, at the end of 2023, CMS will no longer allow virtual direct supervision.[5] Through the Consolidated Appropriations Act of 2023, many flexibilities were extended through December 31, 2024. [6] These include, among others:

  • FQHCs and RHCs can still serve as distant site providers for non-behavioral and mental telehealth services.
  • Medicare patients may receive telehealth services authorized by the Medicare 2023 physician fee schedule in their homes, and there will be no geographic restriction for the originating site for non-behavioral and mental telehealth services.
  • Certain non-behavioral and mental telehealth services can be delivered using audio-only communication platforms.
  • Providers can use telehealth for recertification of eligibility for hospice care.
  • The acute hospital care at-home program may continue to provide hospital services to patients in their homes using telehealth.

Physical therapists, occupational therapists, speech-language pathologists, or audiologists can still provide telehealth services.

There will be important permanent changes as well including:

  • FQHCs and RHCs can serve as distant site providers for behavioral and mental telehealth services.
  • Medicare beneficiaries can receive telehealth services for behavioral and mental health care in their homes.
  • No geographic restrictions for the originating site for behavioral and mental telehealth services, and services can be delivered using audio-only communication platforms.
  • Rural hospital emergency departments are accepted as originating sites.

DEA – Controlled Substances Prescribing

The DEA proposed new rules for permanent telemedicine flexibilities on Feb. 24, 2023.[1] These rules added flexibility to the Ryan Haight Act, while also trying to guard against any bad actors who are prescribing controlled substances improperly. The new rules would not impact telemedicine consultations that do not involve prescribing controlled substance or practitioners who have previously had an in-person exam. But they would prohibit a practitioner from being able to use telemedicine to prescribe more than a 30-day supply of Schedule III-V non-narcotic controlled medications or a 30-day supply of buprenorphine for the treatment of opioid use disorder without an in-person evaluation or referral from a medical practitioner that has conducted an in-person evaluation. The rules were exceptionally controversial and garnered over 38,000 comments. As a result, the DEA announced on May 10, 2023 that they would allow all COVID flexibilities to continue for another six months, until November 11, 2023. This buys the DEA enough time to rewrite the proposed rules and incorporate the many submitted comments. Therefore, until November 11, 2023 all providers may prescribe controlled substances through telehealth under the same rules that have been utilized throughout the pandemic.

Also notable are all of the telehealth safeguards and rules that individual states have instituted as a result of the COVID-19 pandemic. Ohio, for example, has instituted new laws and rules that govern telehealth for Medicaid patients as well as for all types of providers. The practice and regulation of telehealth will continue to evolve over the next several years, so it is important to understand all of the rules that apply to your practice. For questions, please reach out to attorney Ashley Watson at abwatson@bmdllc.com or any member of the BMD Healthcare Team.

[1]88 FR 12890; 88 FR 12875; DEA Announces Proposed Rules for Permanent Telemedicine Flexibilities, DEA (March 3, 2023, 12:32 PM), https://www.dea.gov/press-releases/2023/02/24/dea-announces-proposed-rules-permanent-telemedicine-flexibilities.

[1] Telehealth policy changes after the COVID-19 public health emergency, Telehealth.HHS.Gov (February 19, 2023, 1:45 PM), https://telehealth.hhs.gov/providers/policy-changes-during-the-covid-19-public-health-emergency/policy-changes-after-the-covid-19-public-health-emergency/.

[2] Please note the presentation was given prior to the DEA’s announcement on May 10, 2023 to extend controlled substance prescribing flexibilities.

[3] OIG Policy Statement Regarding Physicians and Other Practitioners That Reduce or Waive Amounts Owed by Federal Health Care Program Beneficiaries for Telehealth Services During the 2019 Novel Coronavirus (COVID-19) Outbreak, OIG (March 17, 2020); see also FAQs—OIG Policy Statement Regarding Physicians and Other Practitioners That Reduce or Waive Amounts Owed by Federal Health Care Program Beneficiaries for Telehealth Services During the 2019 Novel Coronavirus (COVID-19) Outbreak, OIG (March 24, 2020).

[4] CY 2023 Medicare Physician Fee Schedule (PFS).

[5] CY 2023 Medicare Physician Fee Schedule (PFS).

[6] Consolidated Appropriations Act of 2023, H. R. 2617.

COVID-19Ending the Public Health Emergencypublic health emergencytelehealthHIPAAMedicareCMS
Client Alert

Will Federal Legislation Open Cannabis Acquisition Floodgate?

February 18, 2021Are potential buyers quietly lobbying at federal and state levels to kick open the door to launch a new round of strategic acquisitions? Will presently pending federal legislation, the SAFE and MORE Acts, providing safe harbor for banks and re- or de-scheduling marijuana, be sufficient to mobilize into action major non-cannabis companies that previously shunned the cannabis industry due to the unknown implications of owning businesses whose activities are illegal under federal law?Client Alert

The Future of the Families First Coronavirus Response Act

February 3, 2021Over the last year we all have had to adjust to the new normal ushered in by the coronavirus pandemic. Schools and daycares closed, businesses transitioned from in-office work to work from home, bars and restaurants have closed their doors...all to slow the spread and try to prevent this pandemic from spiraling out of control. The start of the pandemic was utter pandemonium. Working parents trying to balance both caring for their now at-home children and their livelihood. Businesses trying to decide how to implement leave policies with limited information. Employees determining if they could financially afford to take time off. We were all flying by the seat of our pants trying to adjust to our new normal.Client Alert

Ohio Supreme Court Clarifies Medical Statute of Limitations

February 1, 2021The Ohio Supreme Court issued a decision in late December that clarifies and finalizes the Ohio law regarding the period of time in which patients can assert claims for medical malpractice. The Court was examining the interplay between three different statutes being the statute of limitations, the statute of repose, and the savings statute.Client Alert

Ohio Hospitals and Healthcare Clinics: It’s Time to Revisit Your Billing and Collection Practices

February 1, 2021According to a recent Cuyahoga County case, certain healthcare entities may not be protected from liability when engaging in unfair or deceptive billing acts. This decision is consistent with the growing trend across the country to encourage price transparency and eliminate unfair surprise billing practices by health care organizations. Now is the time for hospitals and other health care organizations to revisit their billing and collection policies and procedures to confirm that they are legally defensible and consistent with best practices.Client Alert

HIPAA Business Associate Agreements: Why These Contracts Matter

January 27, 2021No one loves drafting, reading or negotiating HIPAA Business Associate Agreements (BAAs). Yet many of us need to do so, and some of us do so daily. They are often boring, dense and technical, but BAAs are important from both a legal and a business perspective, and they deserve our attention. Failure to enter a BAA when one is required can constitute a HIPAA violation that results in substantial liability, as demonstrated by certain recent Department of Health & Human Services (HHS) settlements.1 A business associate who makes a disclosure that is not authorized by the applicable BAA or required by law can be subject to civil and, in some cases, criminal penalties. Further, parties are often presented with BAAs that contain onerous one-sided indemnification and other provisions that can be devasting to an organization in the event of a HIPAA breach. The significance of a BAA is often not fully understood by the parties until something goes wrong (e.g., a HIPAA security incident or breach, an Office of Civil Rights (OCR) audit or a fracture in the relationship between the parties) and, at that point, there is limited opportunity to mitigate legal and business risk. Ideally, attention should be given at the commencement of the business associate relationship, when the parties are able, to thoughtfully addressing regulatory requirements, planning and preparing for potential adverse events and appropriately allocating risk among the parties. As with most healthcare regulatory compliance initiatives, a proactive approach with respect to BAAs is preferable. This article provides a broad overview of certain BAA requirements and some practical negotiating tips for the parties involved.
Older posts
Newer posts