OCR Issues Guidance on Telehealth Remote Communications Following Its Notification of Enforcement Discretion
March 20, 2020

On March 20, 2020, the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) issued guidance on telehealth remote communications following its Notification of Enforcement Discretion during the COVID-19 nationwide public health emergency.

The Notification, issued earlier this week, announced that effective immediately, OCR is exercising its enforcement discretion to not impose penalties for HIPAA violations against health care providers in connection with their good faith provision of telehealth using communication technologies during the COVID-19 nationwide public health emergency.

The new guidance is in the form of frequently asked questions (FAQs) and clarifies how OCR is applying the Notification to support the good faith provision of telehealth. Some of the FAQs include:

• What covered entities are included and excluded under the Notification?
• Which parts of the HIPAA Rules are included in the Notification?
• Does the Notification apply to violations of 42 CFR Part 2, the HHS regulation that protects the confidentiality of substance use disorder patient records?
• When does the Notification expire?
• Where can health care providers conduct telehealth?
• What is a “non-public facing” remote communication product?

“We are empowering medical providers to serve patients wherever they are during this national public health emergency,” said Roger Severino, OCR Director. “We are especially concerned about reaching those most at risk, including older persons and persons with disabilities,” Severino added.

• The FAQs on telehealth remote communications may be found here.
• The press release on telehealth remote communications may be found here.
• The Notification of Enforcement Discretion on telehealth remote communications may be found here.

For more information on HIPAA and COVID-19, see OCR’s February 2020 Bulletin, use this link.