In the past few days, in an effort to help keep Medicare beneficiaries healthy during the COVID-19 pandemic, key federal agencies within the U.S. Department of Health and Human Services (“HHS”) and the U.S. Department of Justice, Drug Enforcement Administration (“DEA”), announced they were relaxing certain requirements that relate to the provision of telehealth services to Medicare beneficiaries and other patients. Below in this Alert, we summarize these announcements from the Centers for Medicare & Medicaid Services (“CMS”) in relation to Medicare reimbursement, the HHS Office of Inspector General (“OIG”) in relation to waivers of cost-sharing amounts owed by federal health care program beneficiaries, the HHS Office for Civil Rights (“OCR”) in relation to certain requirements under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (“HIPAA”), and the DEA in relation to prescribing controlled substances.

CMS Announcement Regarding Telehealth Visits, Virtual Check-Ins, and E-Visits

The federal Coronavirus Preparedness and Response Supplemental Appropriations Act, signed into law on March 6, 2020, granted the Secretary of HHS the authority to waive certain requirements related to telehealth services provided to Medicare beneficiaries pursuant to the waiver provisions of Section 1135(b) of the Social Security Act. On March 17, 2020, CMS announced that the Secretary of HHS was using this waiver authority to expand Medicare coverage for telehealth services on a temporary and emergency basis. CMS hopes that the increased use of telehealth services will allow Medicare beneficiaries to receive routine care from home, particularly vulnerable patients and patients with mild symptoms, thereby slowing the spread of COVID-19 and reducing the impact on this vulnerable patient population.

To promote the receipt of care by beneficiaries at home, CMS is waiving or agreeing not to audit compliance with certain existing requirements applicable to telehealth visits. These changes apply to telehealth visits from March 6, 2020 until the end of the COVID-19 “public health emergency” declared by the Secretary of HHS on January 31, 2020. In the March 17, 2020 announcement, CMS also reminded providers of the existing ability to receive reimbursement for virtual check-ins and e-visits. Reimbursement for all three types of visits is available without regard to the diagnosis of the patient—the patient does not need to be seeking treatment for possible COVID-19 related illnesses.

Telehealth Visits

Location of Telehealth Visits

• Prior to this waiver, telehealth visitsgenerallywere available under traditional Medicare only to Medicare beneficiaries who were located in an authorized “originating site”— which typically meant a practitioner’s office or health care facility in a rural area and not in a patient’s home—at the time of the visit.Pursuantto the waiver, Medicare will waive these “originating site” requirements, allowing for payment for Medicare telehealth services furnished to beneficiaries in any setting, including the home.
• Medicare, however, will only pay a facility fee to originating sites that would have been eligible before the waiver. (For example, no facility fee will be paid when the patient is receiving telehealth services from his or her home.)

Practitioners Who Can Provide Telehealth Visits

• Consistent with existing Medicare telehealth regulations, these telehealth visits may be provided by “distantsite” practitioners who are physicians and certain non-physician practitioners such as nurse practitioners, physician assistants, certified nurse midwives, certified nurse anesthetists, licensed clinical social workers, clinical psychologists, and registered dietitians or nutrition professionals.
• During this public health emergency, these distant site practitioners need not have a prior relationship with the Medicare patient in order to receive reimbursement under Medicare. HHS has announced that it will not conduct auditsto ensure that such a prior relationship existed for claims submitted during this public health emergency.

Technologies that Can Be Used to Provide Telehealth Visits

• Additional flexibility is being provided with respect to the technology used to deliver telehealth visits. Visits still must be provided through an audio and video telecommunications system that permits real-time interactive communication between the beneficiary and the provider at the “distant site.” However, although existing Medicare regulations do not allow regular telephones to be used for these telehealth visits, pursuant to the waiver, telephones can be used if the telephone has audio and video capabilities that are used for two-way, real-time interactive communication.
• In addition, OCR has announced that it will not penalize providers using everyday audio and video communications technologies during the COVID-19 nationwide public health emergency. Additional details on flexibility offered by OCR to facilitate telehealth visits is detailed below.

Reimbursement for Telehealth Visits

• Medicare pays the same amount for telehealth services as it would if the service were furnished in person. As noted above, facility fees will only be paid if the “originating site” would have been an eligible site before the waiver.
• Medicare coinsurance and deductible obligations generally apply to telehealth visits. However, the OIG is providing flexibility for healthcare providers to reduce or waive cost-sharing for telehealth visits paid by federal health care programs, including Medicare. Additional details on flexibility offered by the OIG to facilitate telehealth visits is detailed below.

Communication with State Survey Agency and CMS Regional Office

• Prior CMS guidance on Section 1135 waivers suggested that before relying on a Section 1135 waiver, providers should seek approval from or notify (depending on the nature of the waiver) their local State Survey Agency and CMS Regional Office about their intent to ensure proper payment.
• While the March 17^thannouncement from CMS on the telehealth waiver did not reference any approval or notification requirement that applies to these waivers, Verrill’s health care attorneys are reaching out to their contacts at CMS to obtain further clarity on this point.

Virtual Check-Ins

The March 17^th announcement from CMS reminds providers of the ability to be reimbursed for virtual check-ins. A virtual check-in allows an established Medicare patient in his or her home—in any geographic location, rural or otherwise—to have a brief communication with a provider using a broad range of communication methods (e.g., a telephone discussion or the exchange of information through video or an image). These virtual check-ins must be initiated by the patient, but CMS allows providers to educate patients generally about the availability of the virtual check-in as a means to communicate with the provider.

Among other requirements, in order to be eligible for reimbursement, the virtual check-in cannot relate to a medical visit within the prior seven days or following 24 hours (or earliest available appointment), and the patient must consent (verbally) to receive the virtual check-in services. In addition, Medicare coinsurance and deductible obligations generally apply to virtual check-ins.

E-Visits

The March 17^th announcement from CMS also reminds providers of the ability to be reimbursed for e-visits. An e-visit allows an established Medicare patient in any location—including in his or her home—to have a non-face-to-face communication with his or her provider using an online patient portal. These e-visits must be initiated by the patient, but CMS allows providers to educate patients generally about the availability of the e-visit as a means to communicate with the provider.

Among other requirements, in order to be eligible for reimbursement, the e-visit must result from an initial inquiry by the patient and communications can occur over a period of seven days. The patient must consent (verbally) to receive the e-visit services. In addition, Medicare coinsurance and deductible obligations generally apply to e-visits.

Note on State Law Licensure Requirements for Telemedicine

On March 13, 2020, the Secretary of HHS also announced a waiver of the Medicare and Medicaid requirements that physicians be licensed in the state where they are providing services, as long as they have an equivalent license in another state (and are not barred from practice in the relevant state). However, providers still will need to comply with applicable state licensure laws. To date, some states have temporarily waived certain licensure requirements to permit out-of-state providers to render services to patients, but other states have not.

OIG Policy Statement on Waiving Cost-Sharing Amounts

On March 17, 2020, the OIG issued a policy statement addressing the reduction or waiver of cost-sharing amounts owed by federal health care program beneficiaries for telehealth services (“Policy Statement”).

The Policy Statement assures physicians and other practitioners that the OIG will not subject them to administrative sanctions under the federal anti-kickback statute or the civil monetary penalty law (as it relates to kickbacks and beneficiary inducements) for reducing or waiving cost-sharing obligations owed by federal health care program beneficiaries for telehealth services, provided that the following conditions are satisfied:

• The telehealth services are furnished in accordance with applicable coverage and payment rules in effect at the time of service and
• The telehealth services are furnished during the public health emergency, which began on January 27, 2020, according to the declaration by the Secretary of HHS.

The OIG further stated that it will not view the provision of free telehealth services alone to be an inducement to federal health care program beneficiaries. Nothing in the Policy Statement requires physicians or other practitioners to reduce or waive cost-sharing obligations or provide free telehealth services.

OCR Notification of Enforcement Discretion for Telehealth Remote Communications

In a March 17, 2020 notification (“Notification”), OCR announced that it will exercise enforcement discretion during the COVID-19 public health emergency and not penalize any covered entity health care providers for noncompliance with the HIPAA Privacy, Security and Breach Notification Rules (“HIPAA Rules”) associated with provision of telehealth services. Notably, this enforcement discretion applies to telehealth services provided for any reason, including the diagnosis and treatment of health conditions that are unrelated to COVID-19.

The Notification specifies that a covered health care provider may use any non-public facing audio or video communication technology that is available to communicate with patients even if the health care provider does not have a business associate agreement in place with the technology vendor. OCR offers examples of popular non-public facing applications that allow for video chat (e.g., Apple Face Time, Facebook Messenger video chat, Google Hangouts video, or Skype) to assure providers that such applications can be used in good faith to provide telehealth services without risk of penalty for non-compliance with the HIPAA Rules. OCR further advises covered health care providers using such applications to take steps to (1) enable all available encryption and privacy features offered by the application and (2) inform patients that these applications may introduce risks to the privacy of their protected health information.

For health care providers seeking privacy protections beyond those offered by the above applications, OCR encourages the use of HIPAA-compliant vendors who are willing to enter into business associate agreements and whose applications otherwise meet HIPAA Security Rule standards (e.g., Skype for Business, Updox, VSee, Zoom for Healthcare, Doxy.me, and Google G Suite Hangouts Meet). While the Notification includes several examples of non-public facing applications available for video chat and examples of technology vendors that provide HIPAA-compliant applications, OCR emphasizes that it is not endorsing any specific applications or vendors. It also highlights certain video communication applications that are not permitted for telehealth because they are public-facing (e.g., Facebook Live, Twitch, and Tik Tok).

The Notification was effective upon its issuance on March 17, 2020 and presumably will be in effect for the duration of the public health emergency. It will provide some needed flexibility to covered entity health care providers who are seeking to limit the risk of COVID-19 exposure that could result from in-person consultations.

DEA Announcement of Flexibility for Prescribing Controlled Substances

On March 16, 2020, the DEA announced that due to the public health emergency declared by the Secretary of HHS on January 31, 2020, during the emergency, DEA-registered practitioners are allowed to prescribe controlled substances even if the prescriber has not conducted an in-person evaluation of the patient. (An in-person evaluation would be required absent the public health emergency.) In order for a DEA-registered practitioner to prescribe a controlled substance during the emergency without an in-person evaluation, the following requirements must be met:

• The prescription must be issued for a legitimate medical purpose by a practitioner acting in the usual course of his or her professional practice;
• The telemedicine communication must be conducted using an audio-visual, real-time, two-way interactive communication system; and
• The practitioner must be acting in accordance with applicable federal and state law.

More information on this topic is available on the DEA COVID-19 website.

We will continue to stay abreast of developments regarding telemedicine on the federal and state levels in the days and weeks ahead. For assistance with a particular legal matter, please contact one of the attorneys in Verrill’s Health Care & Life Sciences Group.