Chief Compliance and Ethics Officer Health Care

OCR notice/telehealth

  • 1.  OCR notice/telehealth

    Posted 03-19-2020 11:15 AM
    ​With the notice from OCR that broadens the technologies used in telehealth during this emergency - there's language about encouraging providers to notify patients of the risks.  Has anyone given any thought to that and have you scripted a message to your patients that you're willing to share?  I'm going on the side of simple; these efforts are around making care more accessible - I wouldn't want a message to create fear.

    Just wanted to check what others are doing/saying.

    Thanks

    Under this Notice, covered health care providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency.  Providers are encouraged to notify patients that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications.

    https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html



    ------------------------------
    Timothy Koob
    Compliance Officer & Director

    ------------------------------
    2020 HCCA Compliance Institute


  • 2.  RE: OCR notice/telehealth

    Posted 03-20-2020 08:37 AM
    I have draft a consent, yet to be reviewed and approved by Leadership, but it does include the following:

    POSSIBLE RISKS

    There are potential risks associated with the use of technology for service delivery. These risks include, but may not be limited to:
    • Technical difficulties; possibility of a technical support staff needing to assist
    • Unauthorized access by others at your location; someone could overhear you or see you if you are not in a private area
    • The security of your session could be at risk if your smart phone, computer, and/or internet service provider is not configured property or has malware
    • In very rare instances, security protocols could fail, causing a breach of privacy of personal medical information
    Any feedback to this is appreciated.

    ------------------------------
    Diane Bennett
    QI/Compliance-Privacy Officer
    NorthCare Network
    Marquette,MI
    ------------------------------

    2020 HCCA Compliance Institute


  • 3.  RE: OCR notice/telehealth

    Posted 03-20-2020 08:42 AM
    Diane, I'm not an I.T. person, but I like what you included.

    ------------------------------
    Cinda
    Compliance/Ethics & Privacy Director
    Ohio
    ------------------------------

    2020 HCCA Compliance Institute


  • 4.  RE: OCR notice/telehealth

    Posted 03-20-2020 08:50 AM
    Thank you Cinda.  And I must note that I am not IT either, but work closely with our CIO/Security Officer who has reviewed and blessed.  He has taught me a lot and deserves some credit.  :-)

    ------------------------------
    Diane Bennett
    QI/Compliance-Privacy Officer
    NorthCare Network
    Marquette,MI
    ------------------------------

    2020 HCCA Compliance Institute


  • 5.  RE: OCR notice/telehealth

    Posted 03-20-2020 08:51 AM
    Diane...nice list.  For me...I'm too simple a person that my suggestion is a simple warning of risk similar to the warning that people can give when they let people know about the risk associated with unsecure email.

    For example, below is text from Omnibus regarding the "duty to warn" regarding unsecured email:
    "...Rather, we merely expect the covered entity to notify the individual that there may be some level of risk that the information in the email could be read by a third party.''

    My suggested adaptation is to notify the individual that there may be some level of risk that the information in the communication channel may be accessed by a third party.

    Whatever works...that's the key and just adding another option to the many that are out there.  Interestingly enough...and I won't call out the CE but folks may be able to find it on the Net as I did.  I saw one draft "consent" related to the use of telehealth technologies in response to the OCR memo and it was 3 pages long...my overall take.

    C'mon man!!!

    (I'll just offer a little insight...I know a bit about IT..and after reading this consent...I had to reboot my brain.)

    ------------------------------
    -------------Frank Ruelas--------------
    ► We don't fail unless we quit! ◄
    Next Study Session Topic(s) - The eGroups Shall Decide
    2020 CI Meet Up Sign Up: https://www.surveymonkey.com/r/26VLMS8

    ░ Pass the Exam Group for 2020 ░
    Melissa Singleton - Jan - CHPC
    Julie Clutter - Jan - CHPC
    Tanisha Grant - Feb - CHC
    Lisa Bibby - Jan - CHPC
    Kelly Puida - Mar - CHPC
    Christina Serrano - Mar - CHC
    ------------------------------

    2020 HCCA Compliance Institute


  • 6.  RE: OCR notice/telehealth

    Posted 03-22-2020 05:31 PM
    How are orgs manifesting informed consent?

    ------------------------------
    Michael Williamson
    Chief Compliance Officer
    Pacific Dental Services, LLC
    Irvine,CA
    ------------------------------

    2020 HCCA Compliance Institute


  • 7.  RE: OCR notice/telehealth

    Posted 03-23-2020 06:47 AM
    Thank you Diane.  How are you manifesting that, i.e. - how are you delivering that to the patient - what forum/method?

    ------------------------------
    Michael Williamson
    Chief Compliance Officer
    Pacific Dental Services, LLC
    Irvine,CA
    ------------------------------

    2020 HCCA Compliance Institute


  • 8.  RE: OCR notice/telehealth

    Posted 03-23-2020 08:33 AM
    We will read over the phone and get verbal consent.  Will follow-up with signature as appropriate.

    ------------------------------
    Diane Bennett
    QI/Compliance-Privacy Officer
    NorthCare Network
    Marquette,MI
    ------------------------------

    2020 HCCA Compliance Institute


  • 9.  RE: OCR notice/telehealth

    Posted 03-20-2020 09:04 AM
    Since I asked the question, I wanted to share our current thinking.

    Because all efforts are trying to encourage the use of telehealth during this crisis, we wanted to give a warning but not scare people away as that would be counter-productive...not did I want to make it sound to lawyer-like or technical.  As a result, we have a scripted introduction that the provider will give (who s/he is, what they can do via telehealth, etc.)....in that script we have added the following line:

    "While using telemedicine, your medical information will be handled with strict confidentiality, privacy and security; however, you should know there are risks associated with any communication technology​."

    I think it gets the message across without overwhelming the message.

    Thanks





    ------------------------------
    Timothy Koob
    Compliance Officer & Director

    ------------------------------

    2020 HCCA Compliance Institute


  • 10.  RE: OCR notice/telehealth

    Posted 03-20-2020 09:12 AM
    I like it!  This gets the "Frank Friendly" stamp of usability (as if that mattered or meant anything)...but I do like the matter of fact...easily understood...in my view..of your messaging!

    ------------------------------
    -------------Frank Ruelas--------------
    ► We don't fail unless we quit! ◄
    Next Study Session Topic(s) - The eGroups Shall Decide
    2020 CI Meet Up Sign Up: https://www.surveymonkey.com/r/26VLMS8

    ░ Pass the Exam Group for 2020 ░
    Melissa Singleton - Jan - CHPC
    Julie Clutter - Jan - CHPC
    Tanisha Grant - Feb - CHC
    Lisa Bibby - Jan - CHPC
    Kelly Puida - Mar - CHPC
    Christina Serrano - Mar - CHC
    ------------------------------

    2020 HCCA Compliance Institute


  • 11.  RE: OCR notice/telehealth

    Posted 03-20-2020 09:17 AM
    I like it as well and may use it if that is ok.  We are required to do a bit more education based on our population and state guidance but maybe that can be scripted for clinicians as they discuss telehealth with the consumer and keep the consent short and sweet.  Ummmmmmmm

    Thank you both for the feedback.

    ------------------------------
    Diane Bennett
    QI/Compliance-Privacy Officer
    NorthCare Network
    Marquette,MI
    ------------------------------

    2020 HCCA Compliance Institute


  • 12.  RE: OCR notice/telehealth

    Posted 03-21-2020 08:08 AM
      |   view attached
    Here's the OCR Telehealth notice from yesterday and FAQ's:

    March 20, 2020

    OCR Issues Guidance on Telehealth Remote Communications Following Its Notification of Enforcement Discretion

     

    Today, the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) issued guidance on telehealth remote communications following its Notification of Enforcement Discretion during the COVID-19 nationwide public health emergency. 

    The Notification, issued earlier this week, announced, effective immediately, that OCR is exercising its enforcement discretion to not impose penalties for HIPAA violations against healthcare providers in connection with their good faith provision of telehealth using communication technologies during the COVID-19 nationwide public health emergency. 

    The new guidance is in the form of frequently asked questions (FAQs) and clarifies how OCR is applying the Notification to support the good faith provision of telehealth.  Some of the FAQs include:

    • What covered entities are included and excluded under the Notification?
    • Which parts of the HIPAA Rules are included in the Notification?
    • Does the Notification apply to violations of 42 CFR Part 2, the HHS regulation that protects the confidentiality of substance use disorder patient records?
    • When does the Notification expire?
    • Where can health care providers conduct telehealth?
    • What is a "non-public facing" remote communication product?

    "We are empowering medical providers to serve patients wherever they are during this national public health emergency," said Roger Severino, OCR Director.  "We are especially concerned about reaching those most at risk, including older persons and persons with disabilities," Severino added.

    The FAQs on telehealth remote communications may be found at:  https://www.hhs.gov/sites/default/files/telehealth-faqs-508.pdf - PDF

    The press release on telehealth remote communications may be found at: https://www.hhs.gov/about/news/2020/03/17/ocr-announces-notification-of-enforcement-discretion-for-telehealth-remote-communications-during-the-covid-19.html

    The Notification of Enforcement Discretion on telehealth remote communications may be found at: https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html

    For more information on HIPAA and COVID-19, see OCR's February 2020 Bulletin:  https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf - PDF



    ------------------------------
    Brenda Manning J.D., C.H.C., C.H.P.C.
    Privacy Director
    Interim Privacy Officer
    Carilion Clinic

    The views expressed herein are my own and do not represent those of my employer. They are not meant to constitute legal advice or create an attorney-client relationship.
    ------------------------------

    Attachment(s)

    pdf
    telehealth-faqs-508.pdf   93K 1 version
    2020 HCCA Compliance Institute


  • 13.  RE: OCR notice/telehealth

    Posted 03-24-2020 09:02 AM
    TImothy, and all,
    thanks for sharing all these thoughts and resources.
    We implemented our Telehealth yesterday, and adopted a new verbal consent that includes language very simillar to Timothy's language.  It fits well with our "short and sweet" model, and it is in "plain language".   we will read it over the phone and get verbal consent for existing patients, and document in chart.
    For new, we will still state it all over phone, and then send packet with all registration including new consent form.

    Apparently our population is amenable to telehealth services.  We are monitoring volume this week.
    Thank you all!

    ------------------------------
    Marcia Rasch
    Compliance Officer
    HealthSource of Ohio
    Loveland,OH
    ------------------------------

    2020 HCCA Compliance Institute