The Regulatory Environment of Telemedicine After COVID-19.

The COVID-19 pandemic has created many barriers to providing health care, yet it also has created new opportunities. Although telemedicine was a nascent means of health care delivery before COVID-19, it now is one of the principal means for doing so today, and it is likely to remain so. Whether this will happen may depend in part on continued relaxation of regulations that hampered it before the pandemic. Whereas enforcement of compliance with Health Information Portability and Accountability Act will most likely resume, platform operators and providers have had an opportunity to prepare for this. State licensure requirements may also resume; however, the regulations were in the process of becoming more liberal before COVID-19 so that process might continue. There is no reason to anticipate that payment for telemedicine services including check-ins, remote physiologic and therapeutic monitoring, and relaxation of location and service requirements will end. For these reasons, telemedicine therefore is likely to continue as an important part of medical practice.

Telemedicine has been used for as long as technologies for connecting patients with providers have been available. Initially this involved use of the telephone for synchronous care and later email and store and forward technologies for asynchronous care. Before the COVID-19 pandemic, significant barriers interfered with the expansion and routine use of telemedicine for patient care. This was particularly true for direct to consumer or nonfacilitated telemedicine visits. In addition, although remote patient monitoring (RPM) and remote patient therapeutics were permitted, these procedures were not reimbursed that limited their usefulness.

In March of 2020, the world changed because of the COVID-19 pandemic. Patients simply could not travel to and be seen by providers in traditional clinical settings because of the risk of transmission of this pandemic virus. In response, early in 2020, the Department of Health and Human Services (HHS) and other health care–related regulatory entities waived many of the rules that had prevented widespread adoption of telemedicine. As a result, the use of telemedicine exploded. Patients are now accustomed to at least being offered a telemedicine visit instead of an in-person visit when scheduling an appointment with a health care provider.

Although these waivers have enabled widespread use of telemedicine during the pandemic emergency, many are scheduled or are likely to expire as the emergency ends. This raises the question of why these waivers need to expire and whether the original restrictions were necessary in the first place. In this paper, we will attempt to review some of the regulations that did change during COVID-19 and to predict how they are likely to evolve once the pandemic is over.

For the purpose of this review, the definition of telemedicine includes both synchronous and asynchronous communications between providers and patients at a distance using technology. Although the terms “telehealth” and “virtual” are also used in various ways, there is no consensus about their use. To keep with the theme of this telemedicine issue, we will use the term “telemedicine” to describe all of these technology-based modes of care.

Health Insurance Portability and Accountability Act And Telemedicine

One regulatory issue that has affected the use of telemedicine during COVID-19 is the protection of patient privacy (Table I ). The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required creation of national standards to keep protected health information (PHI) from being disclosed without a patient’s consent or knowledge. This was accomplished by creating 3 rules: (1) privacy that regulated the use and disclosure of PHI, (2) security standards that dealt with protecting PHI including electronic PHI, and (3) breach notification that required an organization to report leaks of PHI to HHS, to the patient, and in some cases to the media.

Table I

Regulatory issues that changed during COVID-19

• HIPAA flexibility for telemedicine○ Although HIPAA regulations are unchanged, the Notice of Enforcement Discretion indicated that violations made in good faith would not be prosecuted during COVID-19. • Medicare and Medicaid policies○ Changes include the almost complete elimination of requirements for geographic and setting locations as well as permitting most types of services to be performed by telemedicine. • Licensing requirements and interstate compacts○ Licensure waivers during COVID-19 have permitted providers to see established patients by telemedicine even if they are across state lines. ○ The Interstate Medical Licensure Compact has grown to 37 participating states • Prescriptions of controlled substances○ Under the Federal State of Emergency, these restrictions were removed allowing physicians to prescribe schedule 2 and 3 medications as indicated when practicing via telemedicine. • Payment for telemedicine○ Payment for brief communication with patients otherwise known as virtual check-ins. ○ Payment initiated for E-visits. ○ Payment for remote physiologic monitoring and remote therapeutic monitoring is available. • Legal considerations○ Federal liability protection for volunteer health care professionals who provide volunteer medical services during COVID-19 for services that relate to the diagnosis, prevention, or treatment of COVID-19. ○ Protection from civil liability to out-of-state licensed health professionals for free care provided during COVID-19. • Equity in telemedicine○ Ask if a patient has access to video technology and to the internet. ○ Remind patients to locate a private space in advance that in some cases could even consist of the family car if they have one. ○ Provide information that can be understood by low literacy individuals. ○ Forms and handouts should be available in the most common languages spoken in the region.

HIPAA, Health Information Portability and Accountability Act.

During COVID-19, some of the HIPAA rules were relaxed in response to some of the limitations related to the pandemic. Before COVID-19, technologies used to communicate with patients during telemedicine sessions were required to be “HIPAA compliant,” meaning that they needed to meet specific security standards and that legal agreements needed to be in place between the platform providers and their users to ensure this security. Under the Notice of Enforcement Discretion (NED), the Office for Civil Rights agreed not to penalize providers for noncompliance with regulatory requirements under the HIPAA rules if they demonstrated good faith use of telemedicine during the pandemic.

Under this notice, health care providers were permitted to use popular applications for video chats that would previously not have been permitted, such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype, without the risk of prosecution for noncompliance with the HIPAA rules. The notice also stated that certain apps such as Facebook Live, Twitch, Instagram, TikTok, and similar video applications were not to be used for telemedicine services because they are accessible to the public without an ability to ensure privacy.

Although Zoom did have a HIPAA compliant option before the pandemic, it required a business associate agreement (BAA) so that version technically was not “free” though it was relatively less expensive than most other options. Google Meet also is free, but it too requires that users have a signed BAA. Otherwise, HIPAA compliance is not assured. Doxy.me has a free option that includes a free BAA, but like Apps from the App Stores, the free version is limited. Cerner has been trying to embed telemedicine into their electronic health record (EHR) for years though a market-ready product still is not available. Epic has a very nicely embedded telemedicine option. Many telemedicine vendors have their own documentation product built into their telemedicine platform, which allows pdf reports to be sent to other EHRs, though such solutions are often overlooked or difficult to access. More costly platforms, before pandemic, were examples of both “buyer-beware” and “you get what you pay for.” Many vendors did have an option to integrate telemedicine; however, they tend to have clinical workflows that do not mimic providers’ existing workflows. It was possible to use those platforms and document from within the platform and export the record to another EHR. If the user’s EHR does not have embedded telemedicine, providers can opt to use their existing EHR and to use a different telemedicine platform just for the video capabilities.

As a result, multiple modalities for telemedicine services have been used for patient visits. In addition, audio-only services were permitted for less complex follow-up visits. Although the future of the NED is unclear, it is likely that future telemedicine encounters will need to be performed using fully HIPAA-compliant platforms. Fortunately, the notice has provided an opportunity for most popular platforms to become HIPAA compliant if they were not already.

The Center for Medicare and Medicaid Services (CMS) changed its policies regarding billing for telemedicine services provided during the COVID-19 pandemic, as shown in Table II . Before COVID-19, Medicare restricted most telemedicine services to patients located in rural areas and in specific settings (such as a hospital or physician office). In addition, it covered a limited number of services and restricted care to real-time, 2-way video communication, with limited exceptions, such as tele-stroke that involved encounters that dealt with strokes.

Table II

Changes in payment policies during COVID-19

• Location: Geographic restrictions including the distance between the provider and the patient as well as types of locations each could be at for patients or providers were removed. • Eligible providers: All health care providers who are eligible to bill Medicare can bill for telemedicine services, including Federally Qualified Health Centers and Rural Health Clinics. • Eligible services: This includes E&M codes both for new and established patients, as well as other services that were restricted from use by telemedicine before COVID-19. • Cost-sharing: Providers can reduce or waive patient cost-sharing (copayments and deductibles) for telemedicine visits. • Licensing: Providers can provide services outside their state of enrollment. • Modality: Some telemedicine services could now be provided using a telephone.

Changes in response to COVID-19 included the almost complete elimination of requirements for geographic and setting locations so that most patients could benefit from telemedicine regardless of where they live or the setting in which they are located. This change even made it possible for providers to see patients by telemedicine in their homes. In addition, the types of technology that can be used, such as remote monitoring and asynchronous services, are now permitted, as opposed to the previously restricted list of approved services.

Under the new rules, Medicare patients are allowed to be seen by telemedicine for office or hospital visits and for almost any other service that would normally occur in-person. To do this, the provider is required to use an interactive audio and video telecommunications system that permits real-time communication between their location and the patient’s home. A variety of providers are permitted to see patients by telemedicine including physicians, nurse practitioners, physician assistants, nurse midwives, certified nurse anesthetists, clinical psychologists, clinical social workers, registered dietitians, and nutrition professionals. This change was enacted so that patients could avoid travel to physicians’ offices, clinics, hospitals, or other health care facilities where they could risk exposure to COVID-19. In addition, although regulations still require that a provider have a prior established relationship with the patient to see him or her by telemedicine, HHS agreed not to prosecute providers who see new, not previously established patients by telemedicine during COVID-19.

Even though CMS made changes in response to the pandemic, state-specific policies are still in effect, so it is necessary to keep up to date with the information related to the state in which you practice. A helpful guide for this can be found at the Center for Connected Health Policy web site. Because each state has its own telemedicine legislation, another useful resource for keeping track of those changes is at the Health Resources & Services web site.

On March 15, 2022, the Consolidated Appropriations Act 2022 was signed into law. The Act extends certain telehealth flexibilities for Medicare patients for 151 days after the official end of the federal public health emergency (PHE). This gives health care providers a minimum of 7 months to prepare for a return to pre-COVID telemedicine legislation. For mental health, telemedicine waivers have become permanent, lifting the originating site requirements and allowing for audio-only coverage. There is a requirement that a patient must initially be seen in person and then every 12 months unless there are extenuating circumstances.

Payment During COVID-19

In 2019, Medicare started paying for brief communication with patients otherwise known as virtual check-ins. These consist of short patient-initiated communications between a patient and his or her health care provider and can be done using a variety of communication technologies including synchronous discussion over a telephone or asynchronous exchanges of information through videos or images. Its purpose is for patients to communicate information with their provider, who could help to avoid unnecessary trips to the doctor’s office or hospital. Because the communication must be patient initiated, providers need to inform patients that this is available and how to use it before a virtual check-in can be used.

These virtual check-ins are permitted for patients who have a previously established relationship with the provider and only if the communication is not related to a medical visit within the previous 7 days and if it does not lead to a medical visit in the next 24 hours (or at the soonest appointment available). Finally, the patient must verbally consent to receive virtual check-in services, and this should be documented. Virtual check-in services can be billed depending on the mode of communication used such as telephone (Healthcare Common Procedure Coding System [HCPCS] code G2012) or review of video or still images (HCPCS code G2010) (see Table III ).

Table III

Codes for various telemedicine services,

RPM code	Description
99453	RPM setup
99454	RPM monitoring/30 d
99457	RPM treatment management—first 20 min
99458	RPM treatment management—additional 20 min
99091	RPM treatment management—30 min

HCPCS, Healthcare Common Procedure Coding System; RPM, remote patient monitoring; RTM, remote therapeutic monitoring.

Payment was also initiated for E-visits. E-visits are asynchronous patient-initiated communications through an online patient portal. Billing for E-visits also requires that the provider have a previously established relationship with the patient. In addition, the patient must generate the initial inquiry and communications can occur over a 7-day period. E-visit services are billed using Current Procedural Terminology (CPT) codes shown in Table III.

In 2014, CMS sponsored a $7 million innovation project to expand the use of e-consults. Many large health systems participating in the Coordinating Optimal Referral Experiences program experienced favorable outcomes and cost findings with the implementation of e-consults. In 2019, CMS approved the use of several CPT codes under interprofessional consultations for reimbursement of e-consults based on the amount of the specialist’s time spent completing the consultation (Table III). After the pandemic, some state Medicaid programs have enacted permanent reimbursement for e-consults under covered asynchronous telemedicine services. , A recent study demonstrated the usefulness of e-consults for allergy by reducing the number and wait time of visits.

Although the federal PHE is still active (current extension set to expire April 16, 2022), many commercial insurers have announced that coverage for telemedicine encounters established during the pandemic will continue beyond the PHE expiration. At the time of writing, a bill before Congress proposes another extension of select telemedicine waivers. This foreshadows the high likelihood that telemedicine regulation changes that occurred during COVID-19 will become permanent.

A provider must be licensed to practice in the state(s) where their patients are located at the time of care regardless of how that care is delivered. This is not new; however, the use of telemedicine challenges this traditional model of care and highlights a regulatory barrier to access that did not exist before the technology was widely available. For years, telemedicine lobbyists and advocates have called for an interstate medical licensure compact (IMLC) like the registered nurse license compact that has been around for decades. In large, sparsely populated states, this barrier is not as apparent as it is in densely populated, small states like those on the Upper East Coast. It was not surprising then that the first federal and state COVID telemedicine waivers removed this requirement, allowing physicians in good standing to care for, via telemedicine, patients located in states where they did not have medical licenses.

Expansion of licensure for telemedicine to out-of-state providers during COVID-19 has permitted providers to see patients even if they were across state lines or in Alaska. Although the federal PHE remains in place, many states have enacted their own versions of the licensure waiver (which supersedes the federal waiver for the state), and those waivers have almost all expired. A useful web site for state-specific health care laws is FindLaw.

The IMLC started onboarding states that had enacted the appropriate legislation in 2017 and since has grown to 37 participating states and 4 that have pending administrative processing. , The pandemic highlighted the need for states not already participating in the IMLC to offer a reasonable solution for when their waivers expired.

An example of a state that has enacted a permanent alternative for out-of-state physicians to care for their patients via telemedicine is Florida. Providers with an out-of-state license or certification can qualify by submitting an application form, maintaining an unencumbered license, having no pending adverse actions in the recent 5 years, maintaining liability coverage, not having a Florida office, and using only licensed pharmacies for prescriptions.

As noted in the introduction, before contemporary availability of secure video-conferencing solutions, many providers interested in telemedicine relied on the phone or email to deliver care. The Ryan Haight Act was passed in 2008 limiting a physician’s ability to prescribe controlled substances when offering telemedicine by requiring an audio-video assessment at a Drug Enforcement Agency (DEA) registered facility at least every 24 months or that the patient-provider relationship first be established by an in-person encounter.

Under the Federal State of Emergency, these restrictions were removed allowing physicians to prescribe schedule 2 and 3 medications as indicated when practicing via telemedicine. According to the American Telemedicine Association, the nation has not seen a resultant increase in opioid prescription errors, diversion, or addiction since waiving the requirements of the Ryan Haight Act.

Providers practicing telemedicine with patients located in various states need not only a professional license from those states but also current DEA registration numbers or controlled substance licensure numbers. Failure to keep the state authority current can result in loss of the federal DEA designation.

When implementing a telemedicine program, certain legal considerations need to be considered. This is true whether the program is being implemented before, during, or after COVID-19. These include protecting yourself from liability and malpractice, protection of PHI, and compliance with regulatory requirements such as licensure and informed consent. The latter 2 considerations are discussed elsewhere in this review.

Before seeing patients using telemedicine, providers have been advised to check with their insurance company to make sure that telemedicine services are covered, particularly when using telemedicine in response to COVID-19. In some cases, liability insurance will already cover it, and in others, it may be necessary to purchase supplemental telemedicine coverage. It is also important to confirm that the insurance policy provides coverage for all locations, especially if patients are seen in states other than the one in which the provider is licensed. To assist providers who want to see patients using telemedicine during COVID-19, the Secretary of HHS issued a letter and guidance in March of 2020 urging state governors to enact executive orders aimed at shielding health care professionals from certain types of liability. Of course, this was not intended to protect providers from actions such as gross negligence, criminal misconduct, or providing care while intoxicated.

At about the same time, the Coronavirus Aid Relief and Economic Security Act went into effect. This included federal liability protection for volunteer health care professionals who provide volunteer medical services during COVID-19 for services that relate to the diagnosis, prevention, or treatment of COVID-19, or the assessment or care of a patient related to an actual or suspected case of COVID-19. For more specific telemedicine legal information about state laws, the Center for Connected Health Policy provides webinars and summary reports for each state.

The Uniform Emergency Volunteer Health Practitioners Act grants protection from civil liability to out-of-state licensed health professionals for free care provided during a declared emergency such as COVID-19. However, the act only applies to out-of-state physicians who have registered in advance or during an emergency. Before seeing a patient using telemedicine, it is necessary to get his or her official informed consent. Specific informed consent laws vary by state; however, certain aspects of the consent are consistent29, 30, 31, 32 (see Table IV ).

Table IV

Considerations when obtaining informed consent to use telemedicine29, 30, 31, 32

• Consider mailing or using a patient portal to send the telemedicine consent form in advance, so that patients can review it ahead of time. • Ask if the patient has access to a safe and comfortable location to conduct the telemedicine visit. • Explain what a telemedicine visit consists of. • Discuss the benefits of a telemedicine visit including avoiding travel to a provider’s office. • Discuss limitations of telemedicine including inability to do a physical examination, certain types of tests, and privacy risks. • Specify what type of telemedicine visit (audio-only or audio-visual) the consent is for. • OK to obtain written or oral consent if it is documented. • If the patient does not speak English very well, arrange for a qualified interpreter to be present during the visit. • Once a patient gives consent, consider mailing him or her a copy of the consent form to keep.

Remote Therapeutic Monitoring and Remote Patient Monitoring

For the last 2 years, codes for remote physiologic monitoring also known as RPM have been available (Table III). This involves providers keeping track of physiologic data (eg, heart rate, respiratory rate, blood pressure, weight, and spirometry) that are automatically transmitted electronically for use in treatment. Physiologic monitors monitor vital signs and inform providers of changes in a patient’s condition using alerts. Payment for RPM can be made even if the services are provided by clinical staff without the provider necessarily being present on-site. Although monitors for basic parameters are available now, there is a need to develop wearable physiologic monitoring systems with algorithms that can convert the acquired data into actionable information for medical management. To bill for RPM, patient data must be collected for at least 16 days per month, and it is billed on a 30-day basis.

Remote therapeutic monitoring (RTM) is different from RPM. RTM usually involves remote communication technology-based services such as use of surveys, along with interaction between providers and patients. It permits nonphysiologic data to be collected and monitored that are linked to therapeutic interventions. RTM data can be self-reported by the patient and transmitted automatically by a device. A physician (or nonphysician practitioner) must directly supervise clinical staff who provide the treatment management part of the service. This means that a provider must be present in the office when clinical staff are performing the remote service. It is distinct enough to have its own set of billing codes (see Table III). In addition, the billing is specifically for musculoskeletal, respiratory, or medication adherence programs.

Conclusion

The COVID-19 pandemic has created many barriers to providing health care, yet it also has created new opportunities. Although telemedicine was a nascent means of health care delivery before COVID-19, it now is one of the principal means for doing so today, and it is likely to remain so. Whether this will happen may depend in part on continued relaxation of regulations that hampered it before the pandemic. Whereas enforcement of compliance with HIPAA will most likely resume, platform operators and providers have had an opportunity to prepare for this. State licensure requirements may also resume; however, the regulations were in the process of becoming more liberal before COVID-19 so that process might continue. There is no reason to anticipate that payment for telemedicine services including check-ins, remote physiologic and therapeutic monitoring, and relaxation of location and service requirements will end. For these reasons, telemedicine therefore is likely to continue as an important part of medical practice.