Federal Fix to Telehealth Rules Would Secure Delivery System

BakerHostetler attorneys Vimala Devassy and Justin Chavez analyze how the extension of the Covid-19 public health emergency impacts telehealth practices. They say it’s important to have permanent rules in place when the PHE ends.

The pandemic has brought about a seismic shift to telehealth. The renewed federal declaration of the public health emergency through April 2023 remains vital policy.

Currently, there is a Frankenstein-like quilt of federal and state laws, regulations, and waivers that serve as a regulatory Band-Aid for telehealth. State and federal regulators continue to scramble to implement more permanent and sustainable solutions that will allow ongoing and seamless delivery of and payment for telehealth services.

These solutions will avoid the feared telehealth cliff that could occur at the end of the PHE if Congress does not finalize these regulations, leaving the health-care delivery system and patients in limbo and unable to provide or receive care via telehealth in a compliant manner. Congress assuaged concerns to some degree in its Consolidated Appropriations Act in December by extending certain Medicare-related telehealth flexibilities, without reliance on an ongoing declaration of a PHE, through Dec. 31, 2024.

Importance of PHE Extension

Since the PHE was declared in 2020, the health-care industry has relied on a variety of waivers issued by the Department of Health and Human Services, as well as state medical boards, that removed restrictions on where patients could receive telehealth services. These waivers also amended regulations on who could provide telehealth services to beneficiaries and reimbursement for telehealth services.

The HHS confirmed in the 2023 Medicare physician fee schedule that these waivers would remain in place for 151 days after the expiration of the PHE. The formal extension in the CAA of many of the permissions granted by these waivers until the end of 2024 was welcome relief for the health-care industry as it ensured the following:

• Medicare beneficiaries can continue to receive telehealth services at their home
• A variety of eligible practitioners can continue to provide and be reimbursed for telehealth services
• Providers can continue to provide mental health care via telehealth without an initial in-person visit
• Telehealth can continue to be delivered through audio-only telehealth communications

Prescribing Controlled Substances Via Telehealth

Throughout the PHE, the Drug Enforcement Agency permitted practitioners to prescribe most controlled substances via telemedicine without an in-person medical evaluation as long as certain conditions were met. The DEA also waived state-registration requirements for practitioners who prescribe controlled substances in multiple states.

This flexibility is slated to expire at the end of the current PHE. However, Congress directed the DEA in the CAA to issue regulations that would establish a special registration process for telemedicine and allow prescriptions to be issued for controlled substances via telemedicine without an in-person exam. If issued, this could alleviate many of the concerns about this potential barrier to care.

State Telehealth Update

State laws on telehealth remain in flux and serve as a potential roadblock to the delivery of telehealth across state lines by providers not licensed in the state where a patient is located. The licensure waivers that many states issued during the pandemic, which permitted care via telehealth by a physician not licensed where the patient is located, may already have expired or are set to expire at the end of the PHE.

Other state laws may contain material limitations on the types of treatment that are permissible via telehealth. Ongoing reimbursement for telehealth is tied to state law, including payment parity laws in most states that required insurers to cover services delivered via telehealth as if the services had been provided in person during the pandemic.

Medicaid coverage for telehealth is dictated by state law and regulation, which could impact coverage of and reimbursement for telehealth at the end of PHE.

In the continued absence of any federal laws to fill the void and regulate states’ ability to limit the delivery of telehealth, the highly varied patchwork of state laws and regulations remains a barrier to the seamless provision of telehealth.

HIPAA Enforcement

The HHS Office for Civil Rights issued a notice of enforcement discretion announcing that it would not impose penalties for Health Insurance Portability and Accountability Act noncompliance against providers using unsecure or noncompliant telehealth technologies in good faith to communicate with patients during the PHE. However, the OCR published guidance in 2022 confirming that such flexibility would terminate at the end of the PHE.

This makes it imperative for providers to use without delay a secure, HIPAA-compliant telehealth solution from a vendor with whom it has a business associate agreement.

Looking Forward

The extension for telehealth practices gives regulators additional time to make permanent the flexibilities that have proven helpful during the PHE. This also allows providers to continue operating their telehealth programs under existing structures.

Though the looming expiration of the PHE no longer signifies the imminent end of certain telehealth coverage for Medicare beneficiaries, the latest developments do not fully address telehealth coverage concerns.

Prescription of controlled substances via telehealth services by DEA-registered practitioners currently remain tethered to the end of the PHE, and state laws governing the provision of telehealth are changing. This significantly hinders a provider’s ability to adopt a one-size-fits all approach to telehealth, as each state’s laws must be carefully reviewed prior to providing telehealth in that state.

The patchwork quilt of legislation, regulations, and waivers for telehealth enacted during the past few years has resulted in a markedly different digital health landscape. This has provided a much-needed life jacket during the pandemic, and established telehealth as an accepted modality of care in the health-care delivery system.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Write for Us: Author Guidelines

Author Information

Justin Chavez is an associate at BakerHostetler who provides regulatory counsel to health-care industry clients with a focus on privacy and security.

Vimala Devassy is a partner with BakerHostetler’s national health-care group and co-chair of the firm’s health-care technology team. She focuses on transactions and regulatory matters for health-care industry clients with a focus on privacy, security, and technology issues.