Two Weeks’ Notice for the Public Health Emergency: What’s Next for Telehealth

The Department of Health and Human Services (HHS) has announced its plan to end the Federal Public Health Emergency (PHE) for COVID-19 on May 11, 2023. Due to the COVID-19 pandemic, emergency declarations, legislation, and regulatory waivers across government agencies, including the Centers for Medicare & Medicaid Services (CMS), allowed for flexibility in the delivery of care to patients, including the expanded use of telehealth. Originally intended to conserve healthcare resources and prevent unnecessary exposure to COVID-19, the use of virtual care has exploded since the beginning of the pandemic to become an intrinsic, essential part of the healthcare delivery system. Now, at the end of the PHE, we examine the path forward for telehealth and the extent to which providers may continue to offer it to patients.

COVID-19 related flexibilities for telehealth included expanding a) the locations where care is provided, including in patients’ homes, b) the types of services provided virtually, and 3) the types of providers who may provide telehealth services. Some of these changes have become permanent or extended beyond the end of the PHE due to Congressional action, while some waivers will expire on May 11, 2023. Providers are relieved to see the changes that have been made permanent and extended through 2024, but many providers are also left wanting more flexibility.

I. Reimbursement

A. Medicare

1. Permanent Changes

Some flexibilities as part of the response to the COVID-19 pandemic have become permanent for Medicare reimbursement, particularly for behavioral health, including the following:

• There are no geographic restrictions for the patient’s location for behavioral telehealth services.
• Medicare beneficiaries can receive behavioral telehealth services in their home.
• Behavioral telehealth services can be delivered using audio-only platforms.
• Rural hospital emergency departments are allowed as an originating site.
• Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs) can serve as distant site providers for behavioral telehealth services.

2. Temporary Changes through December 31, 2024

The Consolidated Appropriations Act 2023 extended many telehealth flexibilities for Medicare through December 31, 2024, including the following:

• Medicare covers patients located in any geographic area rather than only rural areas.
• Medicare beneficiaries may receive telehealth services listed in the 2023 Medicare Physician Fee Schedule while located in their homes.
• Telehealth services can be provided by an expanded list of provider types, including a physical therapist, occupational therapist, speech language pathologist, or audiologist.
• Certain telehealth visits can be delivered audio-only if patients do not have access to a synchronous audio/video modality.
• An in-person visit within six months of initial behavioral telehealth service, and annually thereafter, is not required.
• FQHCs and RHCs can serve as distant site providers for non-behavioral telehealth services.

B. Medicaid/CHIP

States have significant flexibility in covering and paying for Medicaid services delivered via telehealth. State requirements for approved state plan amendments vary as outlined in CMS’s State Medicaid and CHIP Telehealth Toolkit. After the PHE, states will continue to have the flexibility to expand their telehealth offerings through the amendment of their applicable state plan. Billing requirements vary state by state.

C. Commercial

Coverage for telehealth will continue to vary by private insurance plan after the end of the PHE. When covered, commercial insurance may impose cost-sharing, prior authorization, or other requirements on telehealth services.

II. Controlled Substances

Generally, the Ryan Haight Act requires that a provider must conduct at least one in-person medical evaluation of a patient before issuing a prescription for a controlled substance. The PHE triggered an exception under the Ryan Haight Act that allows providers to prescribe controlled substances to patients without first having an in-person medical evaluation as long as the prescription a) is for a legitimate medical purpose by a practitioner acting in the usual course of his/her professional practice, b) is issued via an audio-visual, real-time, two-way interactive communication system, and c) otherwise complies with applicable state and federal laws. This exception ends with the PHE on May 11, 2023.

On February 24, 2023, the Drug Enforcement Administration (DEA) announced proposed permanent rules for the prescription of controlled medications via telemedicine, specifically when telehealth is conducted by a provider who has never conducted an in-person evaluation and the service results in the prescription of a controlled substance. The proposed telemedicine rules would allow medical practitioners to prescribe:

• a 30-day supply of Schedule III-V non-narcotic controlled medications;
• a 30-day supply of buprenorphine for the treatment of opioid use disorder.

These prescriptions may be provided without an in-person evaluation, or referral from a medical practitioner that has conducted an in-person evaluation, as long as the prescription otherwise complies with applicable Federal and State laws. The public will be able to comment for 30 days on the proposed rules.

III. Privacy Laws

During the PHE, federal privacy enforcement was relaxed to allow providers to video chat with Medicare beneficiaries on “non-public facing” platforms, including FaceTime, Facebook Messenger, Google Hangouts, Zoom, and Skype, via phones rather than established telehealth platforms. The Office for Civil Rights (“OCR”) is exercising enforcement discretion to allow good faith use of telehealth during the Federal PHE, even if the services are not provided through HIPAA-compliant technology.

In light of the end of the PHE, OCR is providing a 90-calendar day transition period for providers to come into compliance with the HIPAA Rules in their provision of telehealth. The transition period will be in effect beginning on May 12, 2023, and will expire on August 9, 2023. OCR will not impose penalties on providers for noncompliance with the HIPAA Rules that occur in connection with the good faith provision of telehealth during the 90-calendar day transition period. Additionally, OCR has issued guidance on how providers can provide audio-only telehealth services in compliance with the HIPAA Privacy Rule after enforcement discretion has ended. HIPAA requires that covered entities must apply reasonable safeguards to protect the privacy of protected health information (PHI) from impermissible use or disclosure, including when providing audio-only services. OCR recommends that providers interact in a private setting, use a lower voice, and verify the identity of the patient either orally or in writing.