End of PHE - Federal Provisions Impacting Telehealth

As a reminder, the end of the federal Public Health Emergency (PHE) on May 11, 2023 does not impact telehealth rules at the state level. However, there are federal rules organizations must consider that will impact telehealth related to prescribing and HIPAA compliance.

Prescribing Controlled Substances via Telehealth

As background, the Ryan Haight Act requires an in-person visit prior to prescribing of a controlled substance via telehealth. This requirement has been waived through the duration of the COVID-19 public health emergency (PHE). The Drug Enforcement Agency announced proposed rules for prescribing controlled substances via telemedicine after the COVID-19 Public Health Emergency expires on 5/11/23.

The DEA proposed creating two new limited options for telemedicine prescribing of controlled substances without a prior in-person exam. The options are both complex and more restrictive than what has been allowed for the past three years under the PHE waivers. 

The DEA proposes that a practitioner first prescribe a controlled substance after only a telemedicine encounter if the medication is a non-narcotic Schedule III, IV, or V controlled substance (or buprenorphine for treatment of OUD), and the prescription is limited to a 30-day period, starting from the date of first prescription. Prescriptions meeting this criterion are called a “telemedicine prescription.” Prescriptions for Schedule II and narcotic Schedule III, IV, and V medications may not be prescribed via a telemedicine-only encounter.

Even for these “telemedicine prescriptions," the patient must have an in-person medical evaluation before they can continue their treatment past the 30-day initiation period. The in-person medical evaluation may be conducted:

  • By the prescribing practitioner;
  • As part of a two-way exam, where the patient is in the physical presence of another DEA-registered referring provider, and participant participates in an audio-video conference with the prescribing practitioner and the other DEA-registered referring provider; or
  • By another DEA-registered referring provider that results in a “qualified telemedicine referral.” The DEA defines a “qualified telemedicine referral” as a referral based on an in-person medical evaluation by another DEA-registered referring provider, who then refers the patient to a second DEA-registered practitioner who prescribes the controlled medications based solely on a telemedicine encounter. The referral must include the diagnosis, evaluation, or treatment that was provided to the patient, and examples in the proposed rule suggest the medical record should also be provided. Both the referring practitioner and the prescribing practitioner must document the referral, among other things (see recordkeeping requirements below), in their medical records.
  • Once any of the three methods of providing an in-person evaluation occurs, the prescribing practitioner may continue to prescribe the controlled medication without additional in-person evaluations so long as there is a legitimate medical purpose.
  • The proposed rules do not include any grandfathering provisions, meaning that all patients who have never had an in-person encounter with their prescribing practitioner must have an in-person exam in order to continue being prescribed medication. For patients who have established a telemedicine relationship during the COVID-19 PHE (now a defined term in the proposed regulation), the patient will have up to 180 days from the date the final rule is published to have an in-person exam (as described above).
  • The DEA shared this summary of the proposed telemedicine rules.

These are proposed rules, they are not yet final and there will likely be changes based on stakeholder feedback. However, organizations should prepare for these changes. If not extended administratively or the final rule is not issued prior to 5/11/23, the provisions of the Ryan Haight act will resume. The Ohio Council will share updated information on these rules as they become available.

Telehealth & HIPAA

During the COVID public health emergency, HHS Office for Civil Rights (OCR) applied enforcement discretion to telehealth providers, allowing them to utilize any non-public facing remote communication product, even if they don’t fully comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 

OCR announced they are providing a 90-calendar day transition period for covered health care providers to come into compliance with the HIPAA Rules with respect to their provision of telehealth. The transition period will be in effect beginning on May 12, 2023, and will expire at 11:59 p.m. on August 9, 2023. OCR will continue to exercise its enforcement discretion and will not impose penalties on covered health care providers for noncompliance with the HIPAA Rules that occurs in connection with the good faith provision of telehealth during the 90-calendar day transition period.

Organizations should consider their telehealth policies and procedures when a client does not want to or cannot use their HIPAA compliant telehealth platform. Policies can be updated to outline a process for clients to waive HIPAA specific to telehealth platforms with informed consent and education on the risks.

CMS Telehealth Waivers

The Centers for Medicare & Medicaid Services released a series of provider-specific fact sheets as well as an Overview Factsheet that addresses what will happen to specific temporary PHE waivers after May 11, 2023. The factsheet specifically indicates that Medicare and Medicaid telehealth flexibilities will not be impacted by the end of the PHE. As a reminder, many of the current Medicare telehealth flexibilities that behavioral health providers have come to rely upon over the past two years, will remain in place through December 2024 due to the bipartisan Consolidated Appropriations Act, 2023 passed by Congress in December 2022.