Coronavirus (COVID-19) Privacy Resource Center : Telehealth Information

Telehealth Information

To help facilitate continuity of care, the University of Miami Health System has gone live with Telehealth for providers in all departments. Information about training for providers who need assistance with Telehealth visits can be found on the health system’s internal site under the “Telehealth” tab.

The Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) issued guidance on telehealth remote communications following its Notification of Enforcement Discretion during the COVID-19 nationwide public health emergency and well as a series of frequently asked questions (FAQs).

Please note, this guidance does not affect the application of the HIPAA Rules to other areas of health care outside of telehealth during the emergency. HIPAA Rules should be observed in all other areas, as explicitly stated by the Office for Civil Rights.

What is telehealth?

Telehealth is defined as, “the use of electronic information and telecommunications technologies to support and promote long-distance healthcare, patient and professional health-related education, and public health and health administration.” Recent guidance issued by OCR lists videoconferencing, the internet, store-and-forward imaging, streaming media and landline and wireless communications as telecommunications technologies that support telehealth.

What is the recommended platform for telehealth at the University of Miami Health System?

The approved platform is Zoom for Healthcare, which fully integrates with UChart. Information about training for providers who need assistance with Telehealth visits has been sent to all clinical faculty and VCAs and can be found on the internal site (https://my.med.miami.edu) under the “Telehealth” tab.

The health system a business associate agreement (BAA) in place with Zoom which ensures compliance with regulatory requirements. The University community should make every effort to use Zoom. In very rare instances where Zoom may not be available, the University has a BAA with Skype for Business and telephone consults may be made in the regular course of business so long as patients are provided the telehealth consent and the process is adequately documented. Please note that the consent covers the existing HIPAA requirements as well as important protections to the practitioner regarding the inherent limitations of telehealth. Other platforms should be vetted through leadership and vendorized. Please contact the Privacy Office to process any COVID-19 related agreements and/or requests on an expedited basis.

Can providers utilize other videoconferencing platforms, such as WhatsApp, or Facetime?

Currently, Zoom and Skype for Business are the only authorized platforms at the health system. Other video conferencing platforms should not be utilized unless a true exigent circumstance exists. If any other platform is being used, contact the Privacy Office immediately at 305-234-5000.

The guidance issued by the OCR states that OCR will exercise its discretion not to levy penalties against healthcare providers for noncompliance with HIPAA Rules, including lack of a business associate agreement with video communication vendors, provided it relates to the good faith provision of telehealth services during the COVID-19 nationwide public health emergency.

While good faith use is evaluated on a case by case basis, OCR specifically encourages providers work with vendors who are familiar with the requirements of the Security Rule and will provide assurances by signing a BAA. In cases where exigent circumstances require the use of a less secure platform, providers are encouraged to notify patients about privacy risks and enable encryption and privacy modes.

What type of consent is required?

Any and all forms of telehealth require proper patient consent. Providers should document in their notes that patient has consented to receive telehealth services. Patients with scheduled telehealth appointments, utilizing the MyUChart application, will complete a digital consent prior to joining the video encounter.

Unscheduled patients or ‘on the fly’ encounters will not be able to complete the digital consent and, therefore, must be provided the approved telehealth consent document for completion prior to the encounter.

Patients who are new to UHealth are required to complete and sign all necessary consent documents (financial and treatment) and will need to go through the standard registration process. Therefore, new patients will not qualify for ‘on the fly’ encounters.

What platforms are not permitted for telehealth?

Providers may not use public-facing platforms such as TikTok, Facebook Live, Twitch, workplace chat rooms like Slack, and similar video communication applications in the provision of telehealth. Applications that are public-facing are not acceptable forms of remote communication for telehealth because they are designed to be open to the public or allow wide or indiscriminate access to the communication.

Where should telehealth sessions be conducted?

OCR expects that telehealth sessions be conducted in private settings, such as a doctor in a clinic or office connecting to a patient who is at home or at another clinic. Providers should always use private locations and patients should not receive telehealth services in public or semi-public settings, absent patient consent or exigent circumstances.

If telehealth cannot be provided in a private setting, covered health care providers should continue to implement reasonable HIPAA safeguards to limit incidental uses or disclosures of protected health information (PHI). Such reasonable precautions could include using lowered voices, not using speakerphone, or recommending that the patient move to a reasonable distance from others when discussing PHI.

Providers are encouraged to notify patients that use of any third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when available.

What services are covered in telehealth sessions under the new guidance?

The waiver of requirements under section 1135 of the Social Security Act expanded telehealth, allowing Medicare to pay for office, hospital, and
other visits furnished via telehealth across the country and including in patient’s places of residence starting March 6, 2020. Additionally, the HHS Office of Inspector General (OIG) is providing flexibility for healthcare providers to reduce or waive cost-sharing for telehealth visits paid by federal healthcare programs.

Below are resources for additional information on covered telehealth services. For further guidance, please contact the Office of Billing Compliance at UHealth Compliance.