Content created by Office for Civil Rights (OCR)
Covered health care providers and health plans (covered entities)
HHS is issuing this guidance on audio-only telehealth in direct response to the Executive Order on Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government (E.O. 14058).
In addition, while telehealth can significantly expand access to health care, certain populations may have difficulty accessing or be unable to access technologies used for audio-video telehealth because of various factors, including financial resources, limited English proficiency, disability, internet access, availability of sufficient broadband, and cell coverage in the geographic area. Audio-only telehealth, especially using technologies that do not require broadband availability, can help address the needs of some of these individuals.
OCR’s Telehealth Notification and FAQs
In March 2020, in response to the COVID-19 public health emergency (PHE), OCR issued the Telehealth Notification to assist the health care industry’s response to the PHE and to quickly expand the use of remote health care services. OCR also published a set of FAQs to support and clarify the Telehealth Notification.
The Telehealth Notification provides that OCR will exercise its enforcement discretion and will not impose penalties on covered health care providers
The following FAQs provide guidance to assist covered entities in complying with the HIPAA Rules when OCR’s Telehealth Notification is no longer in effect.
1. Does the HIPAA Privacy Rule permit covered health care providers and health plans to use remote communication technologies to provide audio-only telehealth services?
Yes. HIPAA covered entities can use remote communication technologies to provide telehealth services, including audio-only services, in compliance with the HIPAA Privacy Rule.
The HIPAA Privacy Rule requires that covered entities apply reasonable safeguards to protect the privacy of protected health information (PHI) from impermissible uses or disclosures, including when providing telehealth services.
In addition, if the individual is not known to the covered entity, the entity must verify the identity of the individual either orally or in writing (which may include using electronic methods).
2. Do covered health care providers and health plans have to meet the requirements of the HIPAA Security Rule in order to use remote communication technologies to provide audio-only telehealth services?
Yes, in certain circumstances. The HIPAA Security Rule applies to electronic protected health information (ePHI), which is PHI transmitted by, or maintained in, electronic media.
The HIPAA Security Rule does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line, often described as a traditional landline,
However, traditional landlines are rapidly being replaced with electronic communication technologies such as Voice over Internet Protocol (VoIP)
For example, some current electronic technologies that covered entities use for remote communications that require compliance with the Security Rule, may include:
- Communication applications (apps) on a smartphone or another computing device.
- VoIP technologies.
- Technologies that electronically record or transcribe a telehealth session.
- Messaging services that electronically store audio messages.
Potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI when using such technologies need to be identified, assessed, and addressed as part of a covered entity’s risk analysis and risk management processes, as required by the HIPAA Security Rule.
- There is a risk the transmission could be intercepted by an unauthorized third party.
- The remote communication technology (e.g., mobile device, app) supports encrypted transmissions.
- There is a risk ePHI created or stored as a result of a telehealth session (e.g., session recordings or transcripts) could be accessed by an unauthorized third party, and whether encryption is available to secure recordings or transcripts of created or stored telehealth sessions.
For more information about encryption, see OCR Cybersecurity Newsletter Summer 2021 at https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-summer-2021/index.html. - Authentication is required to access the device or app where telehealth session ePHI may be stored.
- The device or app automatically terminates the session or locks after a period of inactivity.
As communication technologies (e.g., networks, devices, apps) continue to evolve at a rapid pace, a robust inventory and asset management process can help covered entities identify such technologies and the information systems that use them, to help ensure an accurate and thorough risk analysis.
3. Do the HIPAA Rules permit a covered health care provider or a health plan to conduct audio-only telehealth using remote communication technologies without a business associate agreement in place with the vendor?
Yes, in some circumstances. The HIPAA Rules require a covered entity to enter into a business associate agreement (BAA)
- For example, a covered health care provider may conduct an audio-only telehealth session with a patient using a smartphone without a BAA between the covered health care provider and the TSP, where the TSP does not create, receive, or maintain any PHI from the session and is only connecting the call.
However, a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI.
- For example, a covered health care provider may want to conduct audio-only telehealth sessions with patients using a smartphone app offered by a health care provider that stores PHI (e.g., recordings, transcripts) in the app developer’s cloud infrastructure for the provider’s later use. In this case, the app would not be providing mere data transmission services and would instead also be creating, receiving, and maintaining PHI. Because it is not merely a conduit for transmission of the PHI, the provider would need to enter into a BAA with the app developer before it can use the app with patients.
- Similarly, a covered health care provider would need a BAA with the developer of a smartphone app that the provider uses to translate oral communications to another language to provide meaningful access to individuals with limited English proficiency,
OCR encourages covered entities to ensure the accuracy and quality of any language assistance service provided, whether via smartphone app or live interpretation or translation. For further guidance on the use of automatic or machine translation, including digital services and websites, visit LEP.gov, links to an external website. because the app is creating and receiving PHI, and therefore the developer is a business associate of the provider.A covered entity would need to enter into a BAA with any language interpretation service it engages because the service is creating, receiving, maintaining, or transmitting PHI for or on behalf of the covered entity. In contrast, OCR has described when a covered entity can contact an individual using a Telecommunications Relay Service (TRS) communication assistant without having a business associate agreement in place with the TRS provider because the TRS provider is not acting for or on behalf of the covered entity. See OCR guidance at https://www.hhs.gov/hipaa/for-professionals/faq/500/is-a-relay-service-a-business-associate-of-a-doctor/index.html. Also see 86 FR 6446, 6496-6487 (January 21, 2021) for discussion of HHS’s proposals to modify the Privacy Rule to expressly permit disclosures to TRS communications assistants and to modify the definition of business associate to expressly exclude TRS providers.
4. Do the HIPAA Rules allow covered health care providers to use remote communication technologies to provide audio-only telehealth if an individual’s health plan does not provide coverage or payment for those services?
Yes. Covered health care providers may offer audio-only telehealth services using remote communication technologies consistent with the requirements of the HIPAA Rules, regardless of whether any health plan covers or pays for those services. Health plan coverage and payment policies for health care services delivered via telehealth are separate from questions about compliance with the HIPAA Rules and are not addressed in this document.
Resources
OCR Resources
- OCR Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID–19 Nationwide Public Health Emergency, links to an external website, opens in a new tab
- FAQs on Telehealth and HIPAA during the COVID-19 nationwide public health emergency, opens in a new tab
- Guidance on the HIPAA Security Rule
- Guidance on HIPAA and Cloud Computing
- Guidance on HIPAA Business Associate Agreements
- FAQ: Use of Telecommunications Relay Service (TRS) does not require a business associate agreement with the TRS
- HHS Security Risk Assessment Tool (jointly developed by OCR and the Office of the National Coordinator for Health Information Technology (ONC))
- Filing a complaint with OCR if you believe that a HIPAA covered entity or business associate violated your (or someone else’s) health information privacy rights or committed another violation of the HIPAA Rules
HHS Resources
- Telehealth resources are available at https://telehealth.hhs.gov/ and https://www.hhs.gov/coronavirus/telehealth/index.html
- HHS information about Medicare and Medicaid coverage and billing for telehealth services is available at https://telehealth.hhs.gov/providers/billing-and-reimbursement/
- CMS Telehealth Resources about Medicare and Medicaid coverage
- SAMHSA Guidance regarding telehealth and Confidentiality of Substance Use Disorder Treatment Records regulations (42 CFR Part 2)