HHS Announces End of COVID-19 HIPAA Flexibilities for Telehealth
The U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR) announced last week that the enforcement discretion it has exercised with respect to the use of non-compliant telehealth communications platforms will expire on May 11, 2023, along with the COVID-19 public health emergency (PHE). However, OCR will continue to exercise enforcement discretion for a 90-day transition period, until Aug. 9, 2023, to give providers an opportunity to bring their telehealth services to compliant communications platforms. After Aug. 9th, OCR may impose penalties for the use of non-compliant communications platforms, such as Apple FaceTime or Google Hangouts, for telehealth services.
Providers are expected to use the transition period to adjust their telehealth practices to come into compliance, such as by choosing a telehealth technology vendor that will enter into a business associate agreement and comply with applicable requirements of the HIPAA Rules. Providers and business associates may also need to review and update as necessary any policies and practices developed and implemented prior to the COVID-19 PHE for compliance with the HIPAA Rules.
The OCR announcement is available here, and the Notice of Expiration of the Enforcement Discretion is available here.
Contact: Karen Lipson, klipson@leadingageny.org