HHS's Office for Civil Rights (OCR) has issued guidance addressing how health providers and health plans (as HIPAA covered entities (CEs)) can use remote communication technologies to provide audio-only telehealth services consistent with HIPAA (Audio-Only Telehealth Services Guidance (June 13, 2022)). The guidance, which encompasses HIPAA's Privacy, Security, and Breach Notification Rules (collectively, HIPAA Rules), applies now and after expiration of a related HHS telehealth notice issued early on in the COVID-19 pandemic.

For more information on compliance with the HIPAA Rules, see HIPAA Privacy, Security, and Breach Notification Toolkit and Practice Note, COVID-19 Compliance for Health and Welfare Plans: HIPAA Privacy and Related Issues.

As background, HHS issued a telehealth notice in March 2020 to promote the use of remote health care services in response to COVID-19 (Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide PHE (85 Fed. Reg. 22024 (Apr. 21, 2020)); see Practice Note, Telehealth Coverage and Reimbursement: Reimbursement of Telehealth During COVID-19). Under HHS's telehealth notice, the agency did not impose penalties on CE/health providers for noncompliance with the HIPAA Rules regarding the good faith provision of telehealth using non-public facing audio or video remote communication technologies during the COVID-19 public health emergency (PHE). As a result, providers could use these technologies for telehealth even if the technologies were not fully compliant with the HIPAA Rules. The telehealth notice will remain in effect until HHS declares that the COVID-19 PHE no longer exists (or, if earlier, the expiration date of the declared PHE).

HHS's June 2022 guidance addresses when and how health plans and health providers may use remote communication technologies to provide telehealth services, including audio-only services, in compliance with HIPAA's Privacy Rule (see Practice Note, HIPAA Privacy Rule). Under the Privacy Rule, CEs must apply reasonable safeguards to protect the privacy of protected health information (PHI) from impermissible uses or disclosures, including when providing telehealth services. For example, HHS's guidance notes that providers must:

Besides Privacy Rule issues, CEs must consider potential HIPAA Security Rule implications when using remote communication technologies to provide audio-only telehealth services (see Practice Note, HIPAA Security Rule: Overview and Administrative Safeguards). HHS's guidance addresses these considerations. HIPAA's Security Rule governs electronic PHI (ePHI) (that is, PHI transmitted by—or maintained in—electronic media). As a result, HHS's guidance clarifies that the Security Rule does not apply to audio-only telehealth services furnished by a CE via a traditional landline telephone, because the transmitted information is not electronic.

However, HHS noted that the Security Rule applies if a CE uses electronic communication technologies for remote exchanges. Accordingly, CEs that use telephone systems to transmit ePHI must comply with the HIPAA Security Rule as to those technologies, which may include:

Security Rule compliance also may be required for remote communications using:

Under HHS's guidance, however, CEs are not responsible for the privacy or security of individuals' health information after it is received by the individual's phone or other device.

HHS takes the view in its guidance that CE/health providers may offer audio-only telehealth services using remote communication technologies consistent with the HIPAA Rules even if a participant's health plan does not cover or reimburse those services. According to HHS, health plan coverage and payment questions involving health care services delivered using telehealth are distinct questions from HIPAA compliance (and only the latter is addressed in this HHS guidance).

HHS's guidance also addresses business associate (BA) issues regarding audio-only telehealth services. The guidance clarifies that health plans and providers will sometimes need a BA agreement (BAA) in place with vendors in order to conduct audio-only telehealth using remote communication technologies (see Standard Document, HIPAA Business Associate Agreement). As a general rule, CEs are only required to enter into a BA agreement with a telecommunication service provider (TSP) when the vendor acts as a BA—which depends on whether the vendor is serving as merely a conduit or something more.

Although geared to health providers, HHS's latest telehealth guidance will also be of interest to health plans—particularly regarding the BA implications of contracting with telecommunication service providers and the applicability of the conduit exception. (For more information, see Practice Note, HIPAA Business Associates and Cloud Computing: Limited Availability of Conduit Exception Regarding Cloud Service Providers.) As HHS's guidance makes clear, expanded reliance on telehealth services comes with additional compliance considerations that may somewhat offset the cost-savings typically associated with these services.