Regulatory, Legal, and Ethical Considerations of Telemedicine.

Sleep telemedicine practitioners must ensure their practice complies with all applicable institutional, state, and federal regulations. Providers must be licensed in any state in which they provide care, have undergone credentialing and privileging procedures at outside facilities, and avoid real or perceived conflicts of interest while providing that care. Internet-based prescribing remains limited to certain circumstances. Whether or not a malpractice insurance policy covers telemedicine depends on the insurer, especially if interstate care is provided. All telemedicine programs must protect patient health information. Similarly, bioethical principles of autonomy, beneficence, nonmaleficence, and justice apply to both in-person and telemedicine-based care. Published by Elsevier Inc.

Key points

Telemedicine practitioners should follow applicable practice regulations at the facility, state, and federal levels.

Streamlined multistate medical licensing now exists through the Interstate Medical Licensure Compact.

Practitioners should collaborate with their malpractice insurers to ensure appropriate coverage.

The same ethical, conflict of interest, and personal health information protection obligations exist for practicing telemedicine as practicing in-person medicine.

Introduction

Telemedicine has been regulated almost as long as it has existed. Five states had adopted legislation by 1992, a number that grew to 15 states within 3 years. A quarter of a century later, all 50 states now have laws pertaining to telemedicine. Federal statutes and any facility-based regulations are superimposed on that state-based legislation, resulting in a tangle of rules than can frustrate even the most committed sleep telemedicine practitioner.

The purpose of this article is not to stymie the field with lists of regulations, laws, and ethical dilemmas. On the contrary, it is meant to guide telemedicine practitioners and other stakeholders (heath system administrators, practice managers, and so forth) through the broad brushstrokes of these topics while identifying useful resources for more in-depth study (Box 1 ). Even if this article does not provide answers to every applicable question, it should aid these individuals in learning which questions to ask.

Informed consent

Licensing

Clinical privileges and credentials

Internet prescribing

Conflicts of interest

Malpractice insurance

Protected health information

Much of the article can be summarized in 3 words: know your state. Or, more precisely, know your state’s rules (distant site) and the rules pertaining to the states in which your patients reside (originating sites). States have instituted different regulations regarding practices before, during, and after clinic encounters. For instance, some states require patients to complete a written informed consent form before telemedicine visits can begin. Others require an in-person visit be performed before engaging in telemedicine-based follow-up. Learning these details about the states in which care is provided is essential; disobeying telemedicine regulations can have professional and legal consequence for both providers and their workplaces, as the following case study illustrates.

A case study: Hageseth v. superior court

In 2005, a California resident attempted to purchase fluoxetine online for his ongoing moderate depression. The Web site operators, based outside the United States, forwarded his request and associated questionnaires to Colorado psychiatrist Dr Christian Hageseth. Dr Hageseth neither conducted a face-to-face evaluation of the patient nor was licensed to practice medicine in California. After reviewing the questionnaire information, Dr Hageseth issued an online prescription for the medication. A Mississippi pharmacy filled the prescription and sent it to the patient. Several weeks later, the patient completed suicide. Postmortem bloodwork revealed detectable fluoxetine levels. The San Mateo County District Attorney charged Dr Hageseth with practicing medicine in California without a license. He challenged the charges, claiming that the court lacked jurisdiction because his prescribing behavior took place outside of California. However, the California Court of Appeals ruled against this challenge and Dr Hageseth pled guilty. He was sentenced to 9 months in prison.

Although Hageseth v. Superior Court involves a particular form of telemedicine (Internet-based prescribing), it raises many questions that are applicable to other forms of telemedicine as well:

Should a patient provide informed consent before beginning telemedicine-based treatment, absolving the prescriber of all or most potential harms that could arise?

Can a provider licensed in one state treat a patient located in another state?

Are providers allowed to order medication over the Internet (controlled substance or not) for patients they have never evaluated beyond questionnaires?

Must providers have the same privileges at a health care facility–based originating site as they would if physically providing care there?

What conflict of interest regulations apply?

Does medical malpractice insurance cover telemedicine?

What personal health information (PHI) regulations should be considered?

Each of these topics is reviewed here, followed by a discussion of ethical standards as they pertain to sleep telemedicine, such as: what are the ethical duties of prescribers who have never physically met, or even interacted, with their patients?

Informed consent

Informed consent requirements vary by state; there is no federal policy. Some states require a written acknowledgment form completed and signed by the patient, whereas other states have no such requirements. As noted in the Ethics section later, informed consent is an important part of telemedicine initiation whether documentation to that effect is required or not. The Federation of State Medical Boards (FSMB) suggests the following elements be included in informed consent:

Documentation of the patient, provider, and credentials

Type of telemedicine being used (face to face, online prescribing, and so forth)

Recognition that the practitioner may decide whether managing a particular condition is appropriate via telemedicine

Security measures taken to protect PHI, and potential privacy risks

Clause holding providers harmless for information loss caused by technical failure

Requirement for patient consent to forward PHI to a third party

Of course, these are only suggestions for states and their providers. Individual telemedicine practitioners may wish to develop their own informed consent forms in conjunction with legal counsel not only to enhance patient disclosure processes but also to reduce potential legal exposure should negative outcomes arise. Hageseth v. Superior Court reveals a potential vulnerability when no such documentation of risk acknowledgment exists. Among other deficiencies, Dr Hageseth had no record of patient consent to his method of care.

Licensing

In general, practitioners must be licensed in the states in which their originating site patients reside. Licensing requirements vary significantly by state; knowing both originating state and distant state rules before implementing a telemedicine program is essential. Detailed information is available through the National Telehealth Policy Resource Center, a component of the Center for Connected Health Policy (CCHP): https://www.cchpca.org/about/projects/national-telehealth-policy-resource-center.

The CCHP notes that 9 states issue special licenses or certificates allowing out-of-state licensed practitioners to practice telemedicine with patients in their states: Alabama, Louisiana, Maine, Minnesota, New Mexico, Ohio, Oregon, Tennessee, and Texas. State-specific rules apply regarding what constitutes telemedicine, and whether these practitioners are then prohibited from opening brick-and-mortar practices in the state.

Federal legislation easing interstate licensing restrictions has slowly materialized with the advent of the Interstate Medical Licensure Compact (IMLC), developed by FSMB. Twenty-nine states, the District of Columbia, and Guam are now part of the IMLC, with more states joining annually. Although a license obtained through the IMLC costs physicians more than licenses obtained conventionally (standard state licensing fee plus FSMB fee), significant time and effort is saved because a single online application may be used to apply for licensure in multiple states. There are specific physician qualifications to participate, including maintaining unrestricted licensure in the state of principle licensure, remaining board certified in the specialty of practice, and having no history of disciplinary actions against the license. The FSMB outlines additional qualifications on their Web site: www.fsmb.org. Consulting the IMLC Web site in the context of our case study shows that Dr Hageseth would still be prohibited from treating California patients through telemedicine unless he obtained a California medical license through traditional methods; although Colorado is part of the IMLC, California is not.

Like many other specialties, sleep medicine is becoming more focused on a team-based model of care. Therefore, licensing concerns are not only limited to physicians and advanced care providers (ACPs; physician assistants and nurse practitioners) but also to nurses and polysomnogram (PSG) technicians. Nurses must hold licenses in both the state in which they reside and the state in which the patient is located. Similar to the IMLC, a nursing licensure compact now exists among 25 states. Interstate PSG technician licensing is more variable; individual state policy should be consulted. For instance, some medical boards (eg, Idaho, Tennessee, New York, and California) have specific technician licensing requirements. In addition, nurses and technicians must consider scope of practice when conducting telemedicine visits. Like ACPs, their allowable scope can differ among states. In sum, sleep nurses and technicians should ensure that they are both (1) licensed in the state where the patient is located (if applicable for technicians) and (2) practicing within the scope of practice regulations in that state. In another nuance, nurses may only take orders from physicians or ACPs licensed in the patient’s state; orders from providers unlicensed in that state are invalid.

Clinical privileges and credentials

Like traditional care providers, telemedicine providers must obtain treatment privileges and be credentialed at any health care facility in which they practice. This requirement can lead to substantial administrative burden on both the provider and the facility. However, facilitated processes do exist for federally defined Critical Access Hospitals. Congress created this designation in 1997 in response to many rural hospitals closing in the late 1980s and early 1990s. Therefore, part of the federal government’s goal is to stabilize the number of practitioners available to provide care within them; telemedicine-based care is a vital part of this strategy. In 2011, Centers for Medicare and Medicaid Services (CMS) decreased the burden on both distant-site providers and Critical Access Hospitals (originating sites) by allowing providers’ distant-site credentials to be accepted at originating sites. This credentialing by proxy option is available to hospitals meeting specific criteria:

Written agreement between originating and distant site

Distant site is a Medicare-participating hospital or telemedicine entity

Telemedicine provider is privileged at distant-site hospital, with those privileges provided to originating site

Telemedicine provider holds a license in originating site’s state

Originating site hospital reviews provider’s performance and provides this information to distant-site hospital

Originating site hospital informs distant-site hospital of all adverse events and complaints related to the telemedicine provider

Therefore, sleep providers wishing to conduct telemedicine visits to a Critical Access Hospital need not repeat the credentialing process at that facility as long as they have completed it at a distant site. If that Critical Access Hospital is located in a state in which the provider is licensed, the process (from a legal and regulatory standpoint) is even more straightforward.

Internet prescribing

As telemedicine has grown, so have concerns about practitioners’ prescribing controlled substances for patients whom they have never physically seen or examined. States vary in their Internet-based prescribing regulations, especially when the prescriber resides out of state. Any policies from both the medical and pharmacy boards should be reviewed before implementing a telemedicine program in any state in which the care occurs.

Like several areas discussed, federal law overlays state policy. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 regulates this area. The act, designed to prevent illegal distribution and dispensing of controlled substances via the Internet, added new provisions to the already-established Controlled Substances Act. Its overall message is that no controlled substance “may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.” A key part of the “valid prescription” definition is that the prescriber, or a covering prescriber, must perform at least 1 in-person medical evaluation of the patient.

Although the act recognizes the practice of telemedicine as an exception to this rule, it stops short of delineating a special registration pathway that would allow telemedicine practitioners to prescribe through the Internet without in-person evaluation. The act states: “The Attorney General may issue to a practitioner a special registration to engage in the practice of telemedicine.” Although this special registration process was never enacted, changes are afoot. Substance Use-Disorder Prevention that Promotes Opiate Recover and Treatment (SUPPORT) for Patients and Communities Act of 2018 set a 10/24/19 deadline for the Attorney General to activate that provision.

As of this writing, there is no finalized, public guidance in response to that deadline. However, it is anticipated that telemedicine practitioners will soon learn of a specific registration process that will allow them to comply with Drug Enforcement Agency (DEA) regulations and the Ryan Haight Act while still performing telemedicine without in-person examination requirements.

Conflicts of interest

Sleep telemedicine providers must adhere to the same federal standards regarding real or perceived conflicts of interest as they would as in-person sleep medicine providers. These situations include providing or accepting goods or services simply to encourage referrals (anti-kickback laws). For instance, if a distant-site provider purchases telemedicine equipment for a Critical Access Hospital with hopes of establishing it as an originating site, that action could be viewed as a form of inducement. If such behavior results in remuneration to the offender under a federal health care program, it is an Anti-Kickback Statute–associated felony punishable by steep fines and/or imprisonment.

Another potential conflict of interest occurs when telemedicine providers leverage their programs to increase business traffic to their own business ventures. The federal self-referral law, or Stark Law, applies to every practitioner whether care is provided through telemedicine or in-person methods. For instance, the Stark Law prohibits providers from billing Medicare if selling patients durable medical equipment from a company in which they have a financial stake. Sleep testing is outside of the Stark Law and, therefore, a sleep provider ordering testing in a self-owned sleep laboratory is permissible as long as the laboratory is not performed in a hospital (and, even then, it may be allowed in some situations). Stark Law does not apply if nonfederal reimbursement is sought for goods and services.

In addition to federal rules addressing conflicts of interest, many states possess their own legislation regarding kickbacks, self-referrals, and the like. Sleep telemedicine providers should familiarize themselves with applicable laws at all originating sites; it is these rules against which their conduct will be judged if seeking federally sourced reimbursement.

Malpractice Insurance

This topic, more than any other, is most heavily dependent on a practitioner’s specific situation. Before implementing any telemedicine program, liability exposure should be mitigated. There are 2 primary questions to consider. Does the malpractice policy cover (1) telemedicine and (2) care provided outside of the states in which the clinician currently practices? Telemedicine-related claim coverage should be stipulated explicitly in the policy documents. Similarly, policies must indicate the jurisdictions in which claims are covered; practitioners may find that although intrastate telemedicine may be within their policy’s coverage, interstate telemedicine is not. These malpractice insurance considerations extend beyond practitioners (physicians, ACPs) to other sleep medicine teammates as well, such as nurses.

Protected health information

Providers’ approach to PHI during telemedicine should be the same as it is for in-person visits. Health Insurance Portability and Accountability Act (HIPAA) requirements must be followed in addition to any state, local, or institutional/organizational standards. Software used should be patched with the latest security updates, and the operating system used should be up to date. Notably, PHI is not limited to medical reports. Patients’ email addresses, phone numbers, street addresses, and so forth are all in this category and must all be protected. State privacy laws vary in their stringency depending on the technology used; the National Telehealth Policy Resource Center provides more state-specific information: https://www.cchpca.org/about/projects/national-telehealth-policy-resource-center.

Any communication and data storage systems should be encrypted and password protected, with telemedicine practitioners educated on best practices to protect PHI. Inactivity timeout functionality is recommended. Only authorized users should have access to telemedicine systems, with unauthorized access attempts recorded and reviewable. Collaboration with data security experts/computer technicians is generally recommended. Audio and video recording is discouraged given patient consent considerations and susceptibility to hacking.

Sleep telemedicine is unique in its significant reliance on store-and-forward telemedicine technology in patient assessment and decision making. Protected access to previous sleep testing is often required, with any data from that testing transferred directly into the secure patient records. Providers must use positive airway pressure (PAP) data collection platforms offering cybersecurity protection of patient data on their Web site. These sites are restricted either to a practice group or an individual provider (eg, Airview and EncoreAnywhere).

Ethics

Like any emerging technology, telemedicine-related hardware and software come with no ethical dilemmas in themselves. It is how this technology is used that can create ethical conundrums. The American Medical Association (AMA) outlines ethical obligations between a patient and provider along a continuum reflecting the type of telemedicine used (levels of accountability). At 1 end of this continuum are Web sites providing only indirect interaction between a patient and provider. Although the medical professional is responsible for the general accuracy of content presented, there is no direct responsibility and little accountability for how readers will use that information. Web sites guiding patients through the steps of insomnia treatment are good examples. Further along the continuum are non–real-time platforms for patients’ sleep study data, so-called asynchronous or store-and-forward telemedicine. In this scenario, the distant-site provider is responsible for making an accurate diagnosis that will guide the patient’s care. However, it could be another provider who makes treatment decisions based on those findings. Both the interpreting and treating providers share responsibility for keeping with in-person standards (confidentiality, adequate training to perform the task, and so forth).

When telemedicine and treatment initiation are provided by the same person (as in Hageseth v. Superior Court), more ethical dilemmas arise. The following ethical discussion focuses on provider-patient interactions at the most interactive end of the telemedicine spectrum: real-time, synchronous, clinical video telehealth (CVT). Four widely accepted principles of medical ethics should be respected in developing and sustaining any sleep CVT program:

Autonomy: patients’ right to make decisions about their medical care

Beneficence: a provider’s duty to benefit the patient in all situations

Nonmaleficence: a provider’s duty to harm neither the patient nor society during the care of that patient

Justice: a provider’s duty to ensure fairness in medical decisions, implying equal distribution of scarce resources and new treatments, and upholding applicable laws and legislation

Autonomy

If a sleep medicine patient’s autonomy in decision making is to be supported, the patient needs as much information as possible about both the care recommended and the manner in which it is provided (ie, telemedicine vs in-person care). Respecting this principle begins when the patient is first referred to the sleep clinic. If both telemedicine and in-person care options exist, and the condition is likely equally well managed through both modalities, then the patient should be made aware of both options. It should not be assumed that a patient would prefer a telemedicine encounter to an in-person evaluation, even if the individual lives far from a sleep center or experiences disability. Conversely, it should not be assumed that a local patient free from disability would be best served by in-person care. In either case, patients should receive information about both treatment formats at the time of scheduling without an opt-in or opt-out bias guiding the discussion. Once both options are fully presented, patients can then make a more informed decision about how they wish to receive their care.

This decision-making process incorporates several assumptions. First, because it is typically scheduling staff who initiate communication with patients, it behooves practitioners and practice managers to ensure these individuals are themselves informed enough about telemedicine to educate patients effectively. Supporting patients’ autonomy is heavily dependent on accurate information sharing at this point of initial contact; withholding information either voluntarily or unwittingly undermines these efforts. Second, the decision-making process described assumes that practitioners are just as able to treat one patient through telemedicine as any other. This situation is not always the case. As described in relation to licensing, practitioners may not have the licensing and credentials to treat a patient if the visit originates from another state; legal considerations sometimes preclude patient choice. Third, telemedicine can be difficult to explain over the phone even for the most experienced scheduling personnel and savviest of patients. Nuances, including audio quality, telemedicine presenter interaction, and loss of physical practitioner-patient touch, may not be fully appreciated until the patient arrives for the first telemedicine visit. Autonomy must then be supported if a patient wishes to reverse an earlier decision and pursue in-person care; it should be made explicit to the patient that initiating telemedicine does not preclude future in-person visits.

Respecting patients’ autonomy goes beyond choices in health care setting. Sleep telemedicine practitioners must ensure patient privacy to the same extent they would during in-person visits. It should not be assumed that information gleaned from patient encounters (verbal information, sleep testing results, PAP data) may be shared with any other entity unless specified by the patient. Other individuals in the room with the patient at the originating site should be identified, and providers should ask patients explicitly if they will allow others to remain in the room throughout the interview no matter what material is discussed. Similarly, providers at the distant site should identify anyone else in the room with them, including trainees, nurses, or administrative staff. A patient’s autonomy is eroded if anyone, on either side of the interaction, has access to the PHI without the patient’s knowledge and permission.

Beneficence

Once patients choose to participate in a telemedicine-based treatment pathway, providers and associated personnel must uphold the highest standards of care during their sleep medicine journeys. Part of that obligation comes through education. It is not feasible to assume that clinicians can transition seamlessly from in-person patient care to telemedicine-based care without training, both didactic and experiential. Although multiple specialties have recognized this need and committed themselves to formalizing telemedicine education (dermatology, emergency medicine, neurology), sleep medicine has lagged behind. Recent research shows that most physicians without telemedicine experience are uncomfortable evaluating new patients (75%) and making diagnosis and treatment decisions through telemedicine (95%). However, studies with providers having more telemedicine experience reveal more positive attitudes toward the modality. Providers think that telemedicine’s impact on patient-provider interactions is neutral to, or even more positive than, in-person visits. ,

Beyond an initial visit, sleep telemedicine providers should use patient satisfaction and quality improvement monitoring to ensure the principle of beneficence remains upheld. In 2015, the American Academy of Sleep Medicine (AASM) introduced a series of quality measures for adult obstructive sleep apnea (OSA), pediatric OSA, narcolepsy, restless legs syndrome (RLS), and insomnia. Although designed to be measured and tracked in more traditional, in-person environments, every quality measure may also be adapted for the telemedicine clinic. For instance, the same RLS symptom severity questionnaires used in an in-person clinic may also be used for telemedicine; questionnaires can be located at an originating clinic for center-to-center (C2C) telemedicine or emailed to a patient for center-to-home (C2H) telemedicine. The responses can then be transmitted to the distant site using encrypted systems with the patient’s permission. In the OSA realm, most PAP machines have wireless data download capability. Treatment adherence and effectiveness can be reviewed via the Internet with a patient using screen-share technology. Therefore, by subtle adaptations to in-person clinic practice, telemedicine in no way precludes practitioners from ensuring beneficence for their patients while meeting AASM quality measure goals.

Nonmaleficence

Although telemedicine has been used to decrease travel burden on patients, the modality can also have unintended negative effects. The principle of nonmaleficence addresses this issue. Fear can be a significant issue among patients and families even if they initially agree to partake in the technology. As alluded to earlier, telemedicine-naive patients may relish the prospect of staying home or close to home for their sleep medicine care. However, considering the full implications of the visit as it draws nearer can be unsettling. Unfamiliar technology coupled with an unknown medical provider far away can prove stressful, even overwhelming. Providers and other staff members should remain sensitive to these concerns and how they evolve over time. Patients may be calmed to learn that telemedicine is simply a tool to provide standard medical care, staff will be available to assist with the technology (especially for C2C visits), and patients may choose to switch to in-person care at any time. These techniques can decrease the unintended burden on patients often already encumbered by other issues and concerns.

In addition to these important but well-intentioned challenges to the principle of nonmaleficence, more malignant threats exist. Telemedicine-associated equipment can be expensive. Therefore, practitioners must use it for many patients to recuperate the cost and obtain a profit. A conflict of interest can then arise when patients who might otherwise have been offered in-person care are scheduled for telemedicine-based care, regardless of their wishes (diminishing their autonomy), medical complexity, and providers’ experience with the technology. As one bioethicist wrote, “At that moment the technological imperative transforms the healing profession into a healthcare enterprise and our patients become a means to an end.” Nevertheless, the same reimbursement restrictions that have slowed sleep telemedicine’s growth have also curbed the potential for its misuse. Because practitioners receive little to no additional reimbursement for telemedicine encounters compared with in-person visits, there is less motivation to choose one modality rather than the other (especially once telemedicine technology costs have been recovered). It is yet to be seen how changes in health care reimbursement as a whole may affect how nonmaleficence is maintained.

Justice

Ideally, every patient should have the same access to telemedicine for part or all of their sleep medicine care. However, the same provider shortages that plague the specialty also apply to telemedicine. The AASM estimates there are only about 7500 board-certified sleep specialists to serve more than 350 million Americans. Therefore, there is 1 sleep specialist for about every 43,000 Americans, with most sleep providers concentrated in states such as New York, Florida, Texas, and California. There are current efforts to widen the training pipeline, but real shortages in terms of provider numbers and geography will persist. It is this area where telemedicine has greatest potential to improve treatment equity and justice.

However, there are significant challenges to consider. Socioeconomically disadvantaged Americans face the same limited access to telemedicine care as they would in-person care. Fiscally responsible telemedicine programs rely on adequate reimbursement to sustain them, typically from public payors, private payors, and out-of-pocket from patients. Uninsured or underinsured Americans often lack each of these sources, perpetuating telemedicine inaccessibility. Another factor affecting justice in telemedicine dissemination is geography. Although one benefit of telemedicine is overcoming geographic challenges, rural patients accessing C2C telemedicine often travel long distances to do so. Difficulties accessing reliable transportation, missed work hours, and variable weather conditions are all potential burdens. Although C2H telemedicine can ameliorate some of these issues, it relies on patients possessing feasible equipment (smartphone, tablet, computer) to make the connection. Furthermore, some payors who cover C2C visits do not reimburse for C2H visits. For instance, as of early 2020, Medicare only covered C2H for specific purposes, which do not include sleep medicine. Long term plans to sustain temporary, Covid-19 related coverage benefits for C2H telemedicine are yet to be determined.

Telemedicine program developers must consider each of these factors in designing programs enhancing justice and access equity among all patients served. The US Department of Veterans’ Affairs (VA) system has made progress in this regard. Supported by the VA MISSION Act, computer tablets with webcams can be sent to veterans for variable amounts of time. With those devices, any veteran may choose to participate in C2H using the VA-issued hardware. Use outcomes are being tracked, but preliminary data show significant impact among veterans throughout the nation.

Summary

Navigating the regulatory system underlying sleep telemedicine in 2020 requires preparation, commitment, and attention to detail; however, so does navigating the same system for in-person care. Telemedicine is unique in some ways. Prescribers may need to consider multiple states’ regulations, and work through nuances such as multistate licensing and credentialing. In other ways, telemedicine is simply another way to practice medicine. Conflict of interest (real or perceived) should be avoided, PHI should be protected, and the highest of ethical standards should be upheld. With that recognition of more similarity than dissimilarity will come improved processes to streamline interstate licensing and credentialing requirements, while loosening online prescribing rules that currently inhibit telemedicine-based care. That progress at federal and state levels will then lead sleep telemedicine to more completely fulfill the promise it has held for more than 2 decades.