Telehealth
Telehealth

Introduction to Telebehavioral Health

Compliance Considerations for Best Outcomes

Written in collaboration with the AIHC Volunteer Education Committee   


Delivering mental health services via telehealth has increased since the COVID-19 pandemic.  Both Federal and State rules are constantly evolving along with the use of Artificial Intelligence, creating a complex environment for compliance considerations.  This article is not intended as legal or consulting advice.  If your practice is currently using a telebehavioral health approach for patient treatment, or if you organization is considering implementing this approach, we hope this article will give some food-for-thought on the topic. Keep in mind coding and documentation is extremely important for psychiatric services – consider registering for the Psychiatric Compliance – coding & documentation short course offered by the American Institute of Healthcare Compliance.

Telemedicine is considered to be under the umbrella of telehealth and refers specifically to clinical services. Telehealth and telemedicine cover similar services, including medical education, remote patient monitoring, patient consultation via videoconferencing, wireless health applications, and transmission of imaging and medical reports.

Behavioral telehealth may also be referred to as telebehavioral health, telemental health, telepsychiatry, or telepsychology. 

Higher rates of use of telehealth are now standard in many practices since the coronavirus disease 2019 (COVID-19) pandemic. Increasing importance on patient satisfaction, providing efficient and quality care, and minimizing costs have also led to higher telehealth implementation.

This increase in telebehavioral health has been especially enjoyed by both patients and providers since the pandemic, but widespread adoption has been hindered by regulatory, legal, and reimbursement barriers.

Individual, one-on-one therapy, is the most common form of behavioral and mental health treatment. Telehealth can be an effective way to deliver individual therapy, as long as your practice carefully considers compliant technology, implementation and reimbursement concerns. Medicare covers many telebehavioral and telemental health services including audio-only services. Most private insurers and Medicaid cover telebehavioral health care, but check for reimbursement restrictions and obtain professional coding and billing guidance to avoid overpayment situations.

Substance use disorders impact a significant number of individuals, families, and communities.  When used in combination with other treatment methods, telebehavioral health interventions can be part of an integrated approach to treating substance use disorders. These interventions can include screening and diagnosis, online counseling, consults for prescriptions, and individual and group talk therapy. Treating substance use disorders via telehealth requires expertise and training in addiction care.

Benefits of Using Advanced Technology

The terms telehealth and telemedicine are often used interchangeably. Telehealth is a subset of e-health and is the use of telecommunications technology in health care delivery, information, and education according to the Health Resources and Services Administration (HRSA).

Telehealth has been used to bring healthcare services to consumers in distant locations, but became a necessity since the 2020 COVID-19 pandemic. Telehealth effectively connects individuals and their healthcare providers when in-person care is not necessary or not possible. Using telehealth services, patients can receive care, consult with a provider, get information about a condition or treatment, arrange for prescriptions, and receive a diagnosis. In the 30 plus years that telehealth has been in-use, it has been consistently shown to be a safe and quality care modality, a convenient option for both patients and the clinicians who care for them, and a secure environment for the collection and transmission of personal health information. In combination, these attributes extend where and how care is delivered for a stronger healthcare system.

Provider Shortages

Given provider shortages around the world, telehealth has a unique and appealing value proposition. It can provide millions of people in both rural and urban areas access to safe, effective, and appropriate care when and where they need it.

Cost-Benefit

Reducing or containing the cost of healthcare is one of the strongest motivators to fund and adopt virtual care technologies. Telehealth reduces the cost of healthcare and increases efficiency with better management of chronic diseases, shared health professional staffing, reduced travel times, and fewer or shorter hospital stays.

Meeting Patient Expectations

Patient utilizing telehealth during the pandemic may continue to expect remote care. Using telehealth technologies reduces travel time and related stresses for the consumer.

Understanding the Technology

Gaining a basic understanding of the technology will help your organization can help the wise professional make informed choices about telehealth purchases. Terminology used for the various forms of telehealth technology are summarized below which applies to both general and behavioral health care use.  Not all forms of technology are recognized as services which can be reimbursed by health insurance.

Chat-Based (Asynchronous) - This approach is online or through a mobile app communication which transmits the patient’s personal health data, vital signs, and other physiologic data or diagnostic images to a healthcare provider to review and deliver a consultation, diagnosis, or treatment plan at a later time.  This is also called “store-and-forward telemedicine.” 

  • Store-and-forward is less commonly reimbursed by Medicare and Medicaid programs.  In many states, the definition of telemedicine and/or telehealth stipulates that the delivery of services must occur in “real time,” automatically excluding store-and-forward as a part of telemedicine and/or telehealth altogether.

Mobile Health (mHealth) - Mobile Health, otherwise known as mHealth utilizes smart devices and can be now used for many specialized aspects of health care that benefit from continuous data collection about a person’s behavior or condition. Smartphones, tablets, smart wearables like iWatch can monitor a variety of factors such as pulse rate, heart rate, and with some, blood sugar levels or quality of expired air. Apps are now available to encourage healthier lifestyles and behaviors by providing heart-rate variability scores, sleep cycles, movement tracking, weight changes, dietary tracking and much more.

Remote Patient Monitoring or RPM - The remote patient monitoring approach supports ongoing condition monitoring and chronic disease management and can be synchronous or asynchronous, depending upon the patient’s needs.  The application of emerging technologies, including artificial intelligence (AI) and machine learning, can enable better disease surveillance and early detection, allow for improved diagnosis, and support personalized medicine. This includes the collection, transmission, evaluation and communication of the patient’s health data to the provider or extended care team from outside a hospital or clinical office.  It involves using personal health technologies including wireless devices, wearable sensors, implanted health monitors, smartphones, and mobile apps.

Virtual Visits (Synchronous)

This approach includes live, synchronous and interactive communication during the encounter between the patient and healthcare provider.  This is accomplished via video, telephone or live chat.

Facing Implementation Challenges

Health care providers should keep risk management strategies in mind and familiarize themselves with potential telehealth legal risks and implications. This will ensure best practices for patient care and to avoid licensure or litigation issues. 

Telehealth faces many legal and regulatory hurdles, including large variations in rules, regulations, and guidelines for practice which contributes to the confusion for providers engaged in the practice of telehealth. Telehealth rules and regulations vary greatly by state.

  • Providers should have awareness of and maintain compliance with state and federal legal requirements while using best practice guidelines to provide patient safety.
  • The lack of multistate licensure presents a barrier to telehealth because providers must obtain and uphold licensure (and the associated medical education and financial obligations) in multiple states.

The Federation of State Medical Boards created the Interstate Medical Licensure Compact to ease portability of licensure and the practice of telemedicine from state to state for physicians and physician assistants.

  • Under the compact, state medical boards would maintain licensure and disciplinary authority of providers. However, they would share information and processes essential to these providers’ licensure and regulations.
  • This compact does not apply to nurse practitioners (NPs) because they are licensed under state boards of nursing and not medicine.
  • Because state regulation and practice authority vary from state to state, NPs face more barriers than physicians or physician assistants.

Compared with face-to-face encounters, telemedicine encounters are more vulnerable to privacy and security risks.  Your telehealth platform should be secure in accordance with several laws, including the:

These laws protect medical information for both face-to-face and telehealth encounters which includes privacy, security, and protection for health information collected by covered entities such as health care plans, health care clearinghouses, and health care providers who use electronic resources for the transmission of health care information.

Only Consider Using HIPAA-Compliant Technology

The HIPAA Rules establish standards to protect patients’ protected health information. All telehealth services provided by covered health care providers and health plans must comply with the HIPAA Rules.

Covered health care providers and health plans must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth.

The Office for Civil Rights (OCR) is the HIPAA enforcement agency.  OCR released guidance on April 12, 2023 to help covered health care providers and health plans understand how they can use remote communication technologies for audio-only telehealth.  This information was published due to the end of the COVID-19 Public Health Emergency (PHE) which began May 12, 2023.

  • Click Here for OCR’s guidance “How the HIPAA Rules Permit Covered Health Care Providers and Health Plans to Use Remote Communication Technologies for Audio-Only Telehealth”

Comply with Consent Requirements

Most states have telehealth specific informed consent requirement in their statute, administrative code and/or Medicaid policies. This requirement can sometimes apply to specific types of professionals when located in law or regulations governing their profession. The requirement for consent is sometimes paired with other requirement such as the need to ensure the same level of care is delivered via telehealth as would be expected in-person. 

Make sure to have your medical/intake forms reviewed by your legal team. Obtaining informed consent with your patient is typically done before the first appointment.  Click Here for the interactive map to research your state, provided by the Center for Connected Health Policy (CCHP), federally designated as the National Telehealth Policy Resource Center.

Another resource is AHRQ resource page “How to Obtain Consent for Telehealth” – providing discussion tips for the before and during the consent periods.

Other Compliance Considerations

Compliance to both Federal and State privacy rules should be at the forefront of any telehealth endeavor, but none so important as those services provided by behavioral health professionals.  Telehealth providers must take responsibility for ensuring compliance with regulations, patient confidentiality, and system security at all times when practicing in a telehealth model.

The practice of telehealth raises many questions regarding malpractice liability including informed consent (addressed in more detail below), practice standards and protocols, supervision requirements for nonphysician providers, and the provision of professional liability insurance coverage.

  • Simply applying existing principles of malpractice liability to telehealth is not straightforward, especially when it is unclear what an appropriate “standard of care” is.
  • Professional liability policies may not include telehealth in the scope of coverage.
    • Providers need to be cognizant of what exactly liability insurance policies cover, especially when providing telehealth services in other states.

In addition to knowledge of legal aspects of telehealth, it is important for providers to be aware of and practice telehealth etiquette. These etiquette standards should be observed when providers are working remotely at home or performing telehealth visits at their practice location. Also follow all clinical standards for care and adhere to practice standards determined by the profession, state regulatory boards, and state law. Reference the CCHP Professional Boards Standards interactive map..

Providers should be appropriately licensed, credentialed, or certified to deliver care and permitted to practice without impermissible influence on their clinical judgement.

The transition to telehealth is an adjustment for patients as well as health care providers. By preparing your patients for remote medical care, you help ensure their comfort and maintain quality care. This includes understanding various fraud and abuse laws.  As telehealth use grows, caution and care should be taken to ensure that the practice of telehealth does not violate federal antikickback and Stark Law statues. These laws prohibit providers from receiving compensation for accepting or making referrals to other facilities or providers where the referring provider has financial interests.

  • Violations to these laws can result in fines, prison time, and/or exclusion from the Medicare and/or Medicaid programs.
  • The Federal Physician Self-Referral Law, also referred to as the Stark Law, prohibits a health care provider (or an immediate family member of a provider) from referring Medicare patients to entities providing designated health services if that provider or the provider’s immediate family member has a financial interest.

When considering potential fraud and abuse scenarios and related risks, a provider needs to keep in mind that each state has its own variations of these laws. A state-by-state analysis is necessary because of variations in statutes and/or regulations.

Advertising for virtual care services should be truthful and non-misleading and demonstrate a commitment to quality healthcare that meets the standard of care and compliance with all applicable state and federal laws.  The use of these telehealth appointments boomed during the pandemic. However, there are concerns about the quality of care patients receive and whether telehealth services are accessible to everyone, according to the September 2022 GAO article “Telehealth in the Pandemic—How Has It Changed Health Care Delivery in Medicaid and Medicare?”  Any website or other promotion of offering behavioral health services via telemedicine or telehealth should be reviewed by legal counsel or your Risk Attorney (free) through your malpractice insurance company.

Free Available Resources

American Telemedicine Association (ATA)

American Psychiatric Association - Telepsychiatry

Arizona Telemedicine Program: How AI Helps Physicians Improve Telehealth Patient Care in Real-Time (June 2023)

Center for Connected Health Policy (CCHP) – nonprofit organization federally designated as the National Telehealth Policy

Resource Center

Government Accountability Office (GAO) - Medicare Telehealth: Actions Needed to Strengthen Oversight and Help Providers

Educate Patients on Privacy and Security Risks

Telehealth.HHS.gov

Share 0
Post 0
Share 0


Copyright © 2023 American Institute of Healthcare Compliance All Rights Reserved 

Read More
Telehealth
HIPAA, Telehealth

Audio-Video Telehealth, Mobile Device Management & You

Written by: Joanne Byron, BS, LPN, CCA, CHA, CHCO, CHBS, CHCM, CIFHA, CMDP, COCAS, CORCM, OHCC, ICDCT-CM/PCS


This article addresses how to track telehealth policies while addressing HIPAA compliance and mobile device management as the United States enters into a post-pandemic era. The information is an overview and should not be used as legal or consulting advice. Health care providers need to look toward long-term telehealth policies, ensure compliance and realize there is remaining work to be done. 


Scroll to the end of this article for “Basic Telehealth Terminology” if you are new to telehealth or if you are a mobile device app developer!


Most Providers Utilize Audio-Only Telehealth


More than two-thirds of providers utilizing telehealth use audio-only, according to a recent Telehealth Survey conducted November 2021 through December 2021 by the American Medical Association (AMA). According to this survey, 85% of physician respondents indicate they currently use telehealth. Those reporting a decrease in use since first offering it, now indicate doing a mix of in-person and virtual care. Of physician’s using telehealth, the trend indicates 93% are conducting live, interactive video visits with patients and 69% are doing audio-only visits.  


Considering this survey and other reports on audio-video services, concerns seem to focus on potential overutilization, equity and quality of care. 


A concern expressed to AIHC, by our Compliance and HIPAA Officer members, surrounds mobile devices used by providers and practice managers and the organization’s responsibility to comply with applicable rules, regulations and mobile device policies.


So, how do policies apply? 

 

If your providers use a mobile device to access an organization’s internal network or system, the owner of that network or system’s policies and procedures apply to your use of the mobile device to gain such access. It is your organization’s responsibility to understand and follow the organization’s policies and procedures.


If an organization allows providers and professionals to use mobile devices for work, the organization should have reasonable and appropriate mobile device policies and procedures. The policies and procedures should describe any configuration requirements for mobile devices used by providers and professionals for work. It is your responsibility to understand and follow your organization’s mobile device policies and procedures. But, what about using personally owned mobile devices for work?

  • "Bring Your Own Device" or BYOD refers to using a personally owned mobile device for work. Providers should be reminded to let their organization know when they want to use a personally owned mobile device. Many organizations have centralized security management to make sure mobile devices accessing their internal networks or resources are compliant with their security policies. Centralized security management includes:

o Configuration requirements, such as installing remote disabling on all mobile devices; and


o Management practices, such as setting policy for individual users or a class of users on specific mobile devices.


It is the provider’s responsibility to understand and follow the organization’s mobile device policies and procedures. Registering the provider’s mobile device with the organization allows the organization to control who has access to its network or system and will keep unauthorized persons from accessing its network or systems.

  • Registering these mobile devices with your organization may also help the organization or law enforcement find your mobile device if it is lost or stolen. Providers should be directed to contact their organization’s Privacy Officer or Security Officer to register their mobile device.

Utilizing Step 4 from ONC’s 5-Step Process to Manage Mobile Devices Used by Health Care Providers & Professionals, the list of questions below is a way to take inventory of potential safeguards needed to address risk areas.


Mobile Device Management


 If your organization allows the use of mobile devices, what should the organization do about managing the use of mobile devices?


   o Has the organization identified all the mobile devices that are being used in the organization? How is the organization keeping track of them?


   o Has the organization assigned responsibility to check all mobile devices used for remote access, to find out if selected security/configuration settings are enabled?


   o Should there be a regular review and audit of the mobile devices? 


Misuse of Mobile Devices


 Does the organization have written procedures for addressing misuse of mobile devices?


   o If so, what are the consequences when a mobile device is misused and the incident poses risk of a data breach?


Should the Organization Allow BYOD?


 Is this a policy already in place, where providers are using their own devices?


   o Should the organization let providers and professionals use their personally owned mobile devices within the organization?


 Should providers and professionals be able to connect to the organization’s internal network or system with their personally owned mobile devices, either remotely or on site?


Restrictions on Mobile Device Use


 Does the organization restrict how providers and professionals can use mobile devices?


   o Can providers and professionals use mobile devices to access internal networks or systems, such as an EHR?


   o Are providers and professionals restricted from using mobile devices when they are away from the organization?


   o Can providers and professionals take their mobile devices home?


   o Should the organization allow texting or emailing of health information?


      Is there encryption allowing compliant texting and emailing from the mobile device?


Security/Configuration Settings for Mobile Devices


 Will the organization institute standard configuration and technical controls on all mobile devices used to access internal networks or systems, such as an EHR?


   o If so, is the organization's current mobile device configuration document, including connections to other systems/applications, inside and outside of the firewall.


Information Storage on Mobile Devices


 Are there restrictions on the type of information providers and professionals can store on mobile devices?


   o If so, where and for how long should the data be stored?


 Are providers and professionals allowed to download mobile applications to mobile devices? If so, what type(s) of applications are approved?


Recovery/Deactivation of Mobile Devices


 Does the organization have procedures to wipe or disable a mobile device that is lost or stolen?


 Does the organization have standard procedures to recover mobile devices from providers and professionals when their employment or association with the organization ends?


Mobile Device Training


Training is always a challenge, but if your organization cannot achieve effective training and compliance, you may need to reconsider how telehealth is delivered to your patient population.


 How is the organization training its workforce (management, doctors, nurses, and staff) on policies and procedures?


 How does the organization hold its workforce (management, doctors, nurses, and staff) accountable for non-compliance? 


What Additional Information Should I Know for Compliance?


Covered entities must comply with HIPAA Privacy and Security Rules to protect and secure health information, even when using mobile devices as described above. Taking it a step further, health care leaders are responsible to ensure that mobile device procedures and policies have been developed and properly implemented to protect the health information patients entrust to you.


Make Tracking Audio-Only Policy Easy


A great resource is utilizing the National Telehealth Policy Resource Center called “CCHP,” short for Center for Connected Health Policy. CCHP has been tracking audio-only policies across the country and offers access to state audio-only policies via CCHP’s Policy Finder Tool.


As AIHC advises, another resource is legal advice through your malpractice insurance company. At no additional charge, a risk attorney can be made available to help review which policies impact your type of practice and organization.


Free HIPAA Compliance Resources


Another reliable resource is found at HealthIT.gov, the official website of the Office of the National Coordinator for Health Information Technology, otherwise known as “ONC.” ONC offers basic guidance in these five steps 1) Decide; 2) Assess; 3) Identify; 4) Develop, Document and Implement; and 5) Train entitled “five steps organizations can take to manage mobile devices used by health care providers and professionals.”


Does Your Organization Have a Trained (Certified) HIPAA Privacy/Security Officer?


Your HIPAA Compliance Officer can serve as the best resource to help your organization navigate the telehealth and mobile device compliance issues facing your providers today. AIHC offers an online course covering both privacy and security with the option of certification (proctored and administered online).  The cost of certification is covered in the tuition price. Learn more.


It is highly recommended that mobile health app developers and Managed Service Providers (MSPs) have an in-house HIPAA Compliance Officer contributing input to ensure technology is compliant.


Are You a Mobile Health App Developer?


Integrating protections into your technology to create HIPAA compliant products is necessary for your company to succeed. Health care providers are subject to the HIPAA rules as covered entities to protect identifiable health information when it is created, received, maintained and/or transmitted. These protections are required under Federal and State Privacy, Security and Breach Notification Rules. A few basic resources to reference are:


The Office for Civil Rights (OCR) HIPAA website devotes a webpage under Special Topics entitled “Resources for Mobile Health Apps Developers.”


The Federal Trade Commission (FTC) offers a webpage entitled “Mobile Health Apps Interactive Tool” to help you locate federal laws to follow.


For Beginners - Basic Telehealth Concepts


Telehealth is also referred to as Telemedicine. It is the use of telecommunications technology to provide health care services to persons who are at some distance from the provider. This type of patient encounter involves a spectrum of technologies.


Coverage and payment for telehealth can include consultation, office visits, individual psychotherapy, pharmacologic management and other services delivered via an interactive audio and video telecommunications system.  

  • Providers are located at the distant site; and
  • Patients are located at the originating site.

Provider at the distant site - As stated above, providers are at the “distant site,” referring to where the provider is at time of service. The provider can communicate with the patient using an interactive audio and video telecommunication system that permits real-time communication with the beneficiary.


When telehealth is used, it is considered to be rendered at the physical location of the patient, and therefore a provider typically needs to be licensed in the patient’s state. During the COVID-19 public health emergency (PHE), many states waived this requirement or provided specific exceptions. Click Here for Cross-State Licensing information.


Medicaid programs often restrict the type of providers that can be reimbursed when delivering services via telehealth. During the COVID-19 PHE, the list of providers in Medicare and many state Medicaid programs expanded to include professionals such as occupational and physical therapists and speech-language pathologists. Federally Qualified Healthcare Centers (FQHCs) and Rural Health Clinics (RHCs) were also allowed to provide services in some cases. These policies are temporary and most will expire at the end of the PHE.


I also recommend utilizing the TELEHEALTH.HHS.GOV website for providers – “Getting Started with Telehealth.” This webpage provides many additional links to more resources your organization can use to navigate this complex topic.


Temporary telehealth policies during the PHE were implemented to provide improved access to health care during the COVID-19 pandemic. The federal government has been encouraging providers to use telehealth to conduct virtual appointments and has made the telehealth “rules” more flexible. For instance, audio-only delivery of care has rarely been reimbursed historically. But due to COVID and the PHE, temporary policies allow this modality to deliver some services.


The PHE is reviewed and potentially extended every 90 days. When the PHE ends, coverage for telehealth may change. Monitor these updates by using the CCPH website referenced earlier in this article found at https://www.cchpca.org/.

Read More
Telehealth
Telehealth

How Geriatric Care Will Change in the New Normal

Written by Sophie Johnson




The healthcare industry has been transformed by the pandemic, and one part of healthcare that was thrust into the spotlight over the last 16 months is geriatrics. The Centers for Disease Control and Prevention (CDC) states that older adults were more at risk of coronavirus complications, which put them at a higher likelihood of being hospitalized. This has changed how the healthcare sector has responded to seniors, and it will continue to shape how geriatric healthcare will continue in the new normal.


How COVID Affected Geriatric Care


The elderly were affected more severely by the pandemic because they were already a vulnerable population to begin with. Beyond preventing and treating the virus itself, healthcare centers also had to mitigate the adverse effects of extended isolation for older patients. Other restrictions also prevented seniors from getting the physical activity needed to maintain their health, leading to a faster-deteriorating state.

The beginning of the pandemic presented the greatest challenge for geriatric healthcare workers since there were physical distancing protocols in place. Geriatric care shifted to telehealth to meet the needs of older adults. This presented many challenges, the most pertinent one being how to increase the digital literacy of older people, as it became the main way to access resources and contact persons. As these challenges continued, caregivers and family members have had to give more support to seniors to ensure that their needs would be met and, ultimately, prevent hospitalization.

How Geriatric Care Will Change in the New Normal


The way care has changed during COVID-19 will likely continue into the new normal, but there will certainly be some changes in the preventive measures taken to ensure older adults are resilient, healthy, and safe.

Telehealth will grow

According to Pew Research, only about 40% of people aged 74 to 91 years use the internet. However, this is drastically changing. Doctors are seeing more and more virtual visits from older people as part of their practice. And with the ability to access doctors online becoming much easier now, senior patients may be inclined to make more visits, which will significantly improve their overall health.

One of our previous blogs, How Telehealth Is Being Used to Treat Mental Health, discussed how telehealth has also already improved mental health for older people through online therapy, emergency services, and remote monitoring programs, all of which are likely to become the norm in the new normal.

People will have more than one physician

Older people will likely be seeing teams of doctors rather than just one dedicated physician. It is a more efficient and cost-effective way of accommodating patients and for those patients to have their needs met without long waits. And with easier access to more doctors, seeing several specialists is now easier than before.

Coverage plans will become a priority

Apart from getting vaccinated, the CDC also recommends seniors take extra preventive measures to protect themselves from contracting COVID-19. However, individual efforts such as wearing a mask and a healthy lifestyle may no longer be sufficient, especially for older people who are at risk of suffering from other conditions.

This increased awareness in the new normal will see a rise in older adults investing in medical plans. Fortunately, the healthcare industry has long anticipated this, with many different plans available that cater to specific needs. Kelsey Care Advantage outlines the different packages available, some focusing on dental care while others put a premium on cardiovascular conditions. Older adults may even prefer medical coverage that includes medication and fitness benefits. Being prepared in this manner will allow older people to feel more secure should any health concerns come about in the future, COVID or otherwise.

For additional timely and relevant healthcare related information like this, please check out our other blog articles and access all of our course offerings at AIHC.

Read More