The Office for Civil Rights at the U.S. Department of Health and Human Services has issued new guidance describing how HIPAA-covered entities can use remote communication technologies to provide audio-only telehealth services.

WHY IT MATTERS
The goal is to ensure such communications are conducted consistently with the applicable requirements of the HIPAA's Privacy, Security and Breach Notification Rules – especially when OCR's Notification of Enforcement Discretion for Telehealth expires.

The new guidance is meant to clarify how covered entities can provide audio-only virtual care in compliance with HIPAA and improve public confidence that covered entities are protecting the privacy and security of their health information.

Among the questions it answers:

• Does the HIPAA Privacy Rule permit covered healthcare providers and health plans to use remote communication technologies to provide audio-only telehealth services?
• Do covered healthcare providers and health plans have to meet the requirements of the HIPAA Security Rule in order to use remote communication technologies to provide audio-only telehealth services?
• Do the HIPAA Rules permit a covered healthcare provider or a health plan to conduct audio-only telehealth using remote communication technologies without a business associate agreement in place with the vendor?

"This guidance will help ensure that individuals can continue to benefit from audio-only telehealth by clarifying how covered entities can provide telehealth services and improving public confidence that covered entities are protecting the privacy and security of their health information," said OCR officials.

THE LARGER TREND
Certain populations may have difficulty accessing or are unable to use traditional audio-video telehealth, for reasons having to do with disability, financial resources, internet access, lack of broadband or cell coverage.

Audio-only telehealth, especially using technologies that do not require broadband availability, can help address the needs of some of these individuals, as a University of California study of telehealth implementation at community health centers found earlier this year.

The HHS public health emergency declaration was extended again recently, but it won't last forever. We spoke recently with one healthcare attorney who offered her perspective on the steps health systems should take around telehealth and virtual care to ensure they're in compliance once the regulatory reprieve expires.

ON THE RECORD
"Audio telehealth is an important tool to reach patients in rural communities, individuals with disabilities, and others seeking the convenience of remote options," OCR Director Lisa J. Pino, said in a statement.

"This guidance explains how the HIPAA Rules permit healthcare providers and plans to offer audio telehealth while protecting the privacy and security of individuals' health information."

Twitter: @MikeMiliardHITN
Email the writer: mike.miliard@himssmedia.com
Healthcare IT News is a HIMSS publication.