The COVID-19 PHE came to an end on May 11, 2023 and with it many of the telehealth flexibilities that allowed for the expansion of telehealth. We’ve put together this quick summary of all the telehealth rule changes you need to know to make sure you are keeping compliant and ensuring your telehealth ROI. The good news is that many of these temporary waiver and policy changes have been extended until Dec. 31, 2024.
HIPAA Telehealth Technology Flexibilities end Aug. 9, 2023
The HIPAA flexibilities for telehealth was not part of the telehealth rules that were extended to the end of 2024. Healthcare providers have until August 9, 2023 to transition over to HIPAA-compliant video conferencing tools (this is 90-days after the end of the PHE). During the PHE, HIPAA regulations were relaxed to allow the use of everyday communications apps like FaceTime and Skype for telehealth; however, such apps will no longer be permitted. The exception to this is for brief virtual check-ins, which can be conducted over phone without full HIPAA-compliance. Avoid OCR fines and penalties, streamline and professionalize your telehealth services by switching to HIPAA-compliant telehealth platform.
Read OCR’s HIPAA flexibility expiration announcement here
Audio-only Telehealth Calls
Audio-only calls are now permanently allowed by Medicare for behavioral/mental telehealth services only. The E/M visits and patient education visits that were allowed to be delivered audio-only during the PHE are also temporarily allowed to the end of Dec. 31, 2024.
Review HHS’s Guidance on HIPAA-compliant audio-only calls
(Hint: Landlines and traditional phone communications do not fall under HIPAA security rules; however VoIP calls, communication apps like VSee and Zoom, and voice transcription services would require HIPAA-compliance.)
Location Requirements
One of the biggest PHE flexibilities was allowing Medicare to reimburse for telehealth services regardless of patient location, including in the patient’s home and outside of federally designated rural areas.
These changes have now been permanently expanded for behavioral/mental health services only.
All other eligible healthcare providers (including the expanded list with physical therapists, occupational therapists, speech-language pathologists, and audiologists) can still temporarily provide telehealth services without any geographic restrictions and in the Medicare patient’s home until Dec. 31, 2024.
Additionally, some Accountable Care Organizations (ACOs) may be eligible to provide anywhere telehealth services even after the Dec. 31 expiration date.
See the list of all permanent and temporary Medicare telehealth changes here.
Practitioner Licensure
Interstate licensure is now currently required to provide telehealth; there are no federal extensions of waivers allowing clinicians to provide telehealth across state lines without a license. The general rule, including for telebehavioral health, is to
- meet the licensure requirements of the state where the provider is licensed and
- meet any licensure requirements of the state where the patient is physically located at the time of the telehealth appointment
Other compliance considerations include in-person visit requirements to establish the patient-provider relationship and the online prescribing of medications (both controlled and uncontrolled)
Many states have their own rules to make it easier to provide telehealth across state lines. These may include “temporary practice” laws, border state exceptions, and telehealth-specific registration and licensure.
In addition, there are several interstate licensure compacts that facilitate cross-state licensing, such as
- Audiology and Speech-Language Pathology Interstate Compact,
- Counseling Compact,
- Emergency Medical Services Compact,
- Interstate Medical Licensure Compact,
- Nurse Licensure Compact – now has 39 states,
- Occupational Therapy Compact,
- Physical Therapy Compact, and
- Psychology Interjurisdictional Compact
Many large health systems and telehealth companies already have processes in place to support cross-state licensure for their providers. Using compliance-focused telehealth platforms can also help simplify managing your telehealth services across state lines. VSee, for example, offers automated provider and patient state-matching functionality to automatically make sure that providers only see patients located in the states for which they are licensed.
Learn more about telehealth licensing across state lines here.
Prescribing Controlled Substances
Currently the DEA has issued a temporary rule which extends COVID-19 controlled-substance prescription flexibilities until Nov. 11, 2023. Patients who have an established a relationship with their provider on or before Nov. 11, 2023 will qualify for flexibilities until Nov. 11, 2024.
Earlier this year, the DEA proposed a new rule which would require monthly in-person visits for refills of certain drugs. The proposal received over 38,000 comments expressing deep concern and anxiety about provider accessibility for many patients.
Learn more about Controlled Substance Prescription rules here.
Remote Patient Monitoring
CMS Remote Physiologic Monitoring (RPM) waivers have all expired as of the end of the PHE on May 11, 2023. The following rules are being enforced once again.
- New patients or patients that have not been seen in the past 12 months will require a separate in-person initiating visit before RPM can be ordered.
- OIG now requires the 20% beneficiary copay for Part B services (including RPM and Chronic Care Management)
- CMS now requires the transmission of the full 16 days of data for each 30 days in order to be reimbursed. This includes RPM for COVID-19 cases, which had been reduced to 2 days of data out of 30 day during the PHE.
Learn more about Remote Patient Monitoring rules here.
Remote Therapeutic Monitoring
Remote Therapeutic Monitoring (RTM) is a more recently added set of billing codes created by the AMA in Nov. 2022. While not affected by the PHE, it made sense to include it here as a Post-PHE telehealth rule that providers should know about.
RTM is a new category of RPM that was created to allow providers to bill for the collection of non-physiological medical device data. This might mean the collection of data related to therapy/medication adherence, therapy/medication response, and pain level.
The CPT codes are designed to require providers to bill for specific body systems. For example, CPT 98976 is only for respiratory system data, CPT 98977 is only for musculoskeletal system data, CPT 98978 for cognitive behavioral therapy (CBT) data.
Foley and Lardner have a nice summary explaining RTM and how to bill for it here.
