This blog is co-authored by Mantra Health, a telemental health and software platform company focused on serving the needs of higher education, and Epstein Becker Green, a national law firm with an expertise in the provision of health care services in higher education environments.
In early March 2020, the federal government officially declared the novel coronavirus (“COVID-19”) outbreak a national emergency (1), and the U.S. Department of Health and Human Services (“HHS”) declared the COVID-19 crisis a public health emergency under Section 319 of the Public Health Service Act. (2) These events resulted in a myriad of changes to federal laws related to telehealth, as well as many related changes at the state level. These changes have prompted an influx of questions from health care providers who are pivoting to telehealth as their sole modality for providing care. This is particularly true in the higher education setting where university and college students and staff have been evacuated to their homes or other safe environments and education continues on a remote access basis.
This blog series, published by Mantra Health and Epstein Becker Green, was initiated in response to questions from the field of higher education mental health providers who are incorporating telehealth into their settings while concurrently adjusting to support a remote campus. Mantra Health and Epstein Becker Green will be publishing a series of three posts that will cover a range of changes in federal and state laws related to the use of telehealth, including:
- Blog 1: Professional licensure, state-specific definitions of telehealth, and acceptable telehealth modalities and platforms
- Blog 2: Privacy and security regulations pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
- Blog 3: Remote prescribing and managing high risk patients
Overview of Key Regulatory Changes
As a reminder, our first two blog posts discussed the significant changes to telehealth coverage and reimbursement rules in response to COVID-19 by the Centers for Medicare & Medicaid Services (“CMS”) (1-2) and the Office for Civil Rights (“OCR”) within the U.S. Department of Health and Human Services. (3-4) These changes have included, but are not limited to:
- Waiver of the requirement that providers have a valid license for the state(s) in which they provide care;
- Expansion of the list of acceptable platforms upon which telehealth services may be provided;
- Statements that penalties for HIPAA non-compliance will not be enforced, and that audits will not be conducted; and
- Suggestions regarding the locations from which providers can conduct telehealth visits, and related guidance regarding ways to maintain the privacy during such sessions.
It is important for providers to recognize that the guidance that has come from CMS is only applicable to federal healthcare programs. Such guidance may not apply to a large segment of the higher education student population, given the relatively small numbers of students receiving coverage under a federal health care program. Nevertheless, it is important to understand the federal-level guidance to the extent it can provide a roadmap for similar changes that may be occurring not only at the state level but also by private insurers.
Moreover, the relaxation of federal and state laws stems from the COVID-19 national public health emergency and, as specifically stated by many authorities, is temporary in its nature. We cannot predict when the national public health emergency period will end or the extent to which these emergency actions will change the prior regulatory and legal framework more permanently. However, in the absence of evidence to the contrary, higher education providers should anticipate that most, if not all, regulatory and legal changes will revert back to the status quo as it existed prior to the COVID-19 emergency.
FAQs from Higher Education Providers: Telemental Health Regulatory Considerations
What are the current laws regarding prescribing across state lines? What about the prescribing of controlled substances?
Certain provisions of the federal Controlled Substances Act (as amended by the Ryan Haight Act), (5) which state that providers cannot prescribe controlled substances via telehealth unless one of several limited exceptions apply, have temporarily been relaxed by the DEA invoking the public health emergency exception to the Act (6) with the following contingencies:
- Prescriptions must be issued for a legitimate medical purpose by practitioners acting in their usual course of professional practice;
- Telemedicine communications must be conducted using an audio-visual, real-time, two-way interactive communication system; and
- Practitioners must be acting in accordance with applicable federal and state laws.
The above waivers are only applicable to DEA-registered practitioners acting within the United States6. Prescribing providers also must continue to be mindful of any applicable state laws that regulate the practice of remote prescribing, or prescribing more generally.
Regarding the continuity of care and the issuing of remote prescriptions, psychiatrists should identify a local pharmacy of the student’s choosing for ongoing prescriptions, and/or offer the student a 90-day supply of any medications (for students who are stable). Indeed, many insurance companies are encouraging 90-day supplies when feasible. (7) Obtaining the new pharmacy address, if applicable, should be done prior to ending the telehealth visit to avoid any delays or lapse in treatment if the student runs out of the prescribed medications. As mentioned in our first post, if the treating provider is not licensed in the state where the student is located, and if that state has not (by law, regulation, or executive action) created a professional licensure exception during the COVID-19 national public health emergency period, no therapeutic services should be provided. Instead, the student should be referred to a provider who is licensed in the state the student is located to receive prescriptions until either: 1) the student has returned to campus, 2) the provider has become licensed in that state, or 3) the professional licensure requirements in the state have been modified as necessary to allow for out-of-state providers to practice in that state during COVID-19.
Am I allowed to see new students for telehealth visits who I haven’t yet met in person?
Generally, a “practitioner-patient relationship” must have been established prior to commencing the telehealth services. Depending on the state, establishing such a relationship with a patient requires the satisfying of different criteria. (8-10) This can lead to complications for new students who are seeking mental health services through their college or university during a time when all campus services are being provided on a remote basis.
In light of COVID-19, CMS has implemented a waiver for this requirement, (11-12) but this waiver only applies to services that are otherwise reimbursable under a federal health care program. Providers must therefore be knowledgeable as to the relevant state requirements for establishing practitioner-patient relationships prior to starting therapy or medication management via telehealth for a new patient seeking mental health services. Colleges and universities can download the easy-to-use app created by Epstein Becker Green that allows users to search telehealth laws unique to each state, including the state- and profession-specific requirements for establishing practitioner-patient relationships.
How do I establish a practitioner-patient relationship via telehealth if it is allowed in my state?
The main way to establish a practitioner-patient relationship via telehealth, while also enforcing privacy and confidentiality measures, is to deploy an identity verification protocol at the start of the telehealth session. Below are some suggestions about how to efficiently capture this information at the beginning of a telehealth session. Identity verification can be done in conjunction with identification of the student’s location for licensure regulation purposes as mentioned in our first post:
- Asking the student to share two elements of PHI (e.g., their full name and DOB)
- Asking the student to show a government issued ID or their student ID through the video call
Some state laws, including Idaho, New Jersey, and West Virginia, specify that mental health professionals (e.g., psychologists, psychiatrists) must verify the identity of the patient at the start of the video-conferencing call, (13-15) and that such an identity verification process may even need to be done prior to each telehealth visit throughout the course of treatment. (16) At a time where it is especially unclear where a student is physically located, all providers should consider this a best practice consistent with the most stringent of requirements found under state law.
What are others doing for emergency appointments and/or higher risk students?
Despite many students crossing state lines to return to their respective home states as COVID-19 has forced all college and university campuses to close, students are still under the care of the school-based provider (and that provider’s license to practice in the state where the school is located) if the student is presently in active treatment. To manage high risk patients and/or emergency appointments as they arise, the provider and the student should have a safety plan in place, an up to date emergency contact, as well as a go-to local emergency resource (e.g., local 911). The provider also should ensure that he/she has the student’s updated current address, in order to locate the nearest crisis resource for the student if needed. It may make sense to do this along with the identity verification protocol explained above.
Do I need separate malpractice insurance for telehealth?
When providing care via telehealth, all providers should ensure that their professional liability insurance covers telehealth services (17) and that such coverage applies to all states in which he/she is providing these services, to minimize potential malpractice risks. (18)
The above information has been reported to the best of our knowledge, and with the understanding that both federal and state guidance continues to evolve rapidly. We recommend referring to relevant federal and state government websites frequently (e.g., HHS, CMS, DEA, OCR, SAMHSA) for the most current guidance. To stay up to date with the latest regulatory changes, reference Epstein Becker Green’s Coronavirus Resource Center.
- U.S. Department of Health and Human Services. Published March 13, 2020. Accessed at: https://www.phe.gov/emergency/news/healthactions/section1135/Pages/covid19-13March20.aspx
- The Centers for Medicare and Medicaid Services. Published on: XXX. Accessed at: https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet
- The Office for Civil Rights, Department of Health and Human Services. Accessed at: https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html
- The Office for Civil Rights, Department of Health and Human Services. Published on March 20, 2020. Accessed at: https://www.hhs.gov/about/news/2020/03/20/ocr-issues-guidance-on-telehealth-remote-communications-following-its-notification-of-enforcement-discretion.html
- Department of Justice, Drug Enforcement Administration. 21 CFR Part 1300, 1301, 1304, et al. Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008. Final Rule. Published April 2009. Accessed at: https://www.deadiversion.usdoj.gov/fed_regs/rules/2009/fr0406.pdf
- Department of Justice, Drug Enforcement Administration. Accessed at: https://www.deadiversion.usdoj.gov/coronavirus.html
- America's Health Insurance Plans. Published March 27, 2020. Accessed at: https://www.ahip.org/health-insurance-providers-respond-to-coronavirus-covid-19/
- The Florida Legislature. 2019 Code § 456.47(2)(b). Accessed at: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0400-0499/0456/Sections/0456.47.html
- Maryland Department of Health. Code § 10.32.05.05 (last approved January 2020). Accessed at: http://mdrules.elaws.us/comar/10.32.05.05
- NJ Rev Stat § 45:1-63 (last approved 2017). Accessed at: https://law.justia.com/codes/new-jersey/2017/title-45/section-45-1-63/
- The Centers for Medicare & Medicaid Services. Medicare Telemedicine Health Care Provider Fact Sheet. Published on: March 17, 2020. Accessed at: https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet
- The Centers for Medicare & Medicaid Services. Medicare Telehealth Frequently Asked Questions (FAQs). Published on: March 17, 2020. Accessed at: https://edit.cms.gov/files/document/medicare-telehealth-frequently-asked-questions-faqs-31720.pdf
- Joint Idaho Psychological Association – Idaho Board of Psychologist Examiners Task Force, Guidelines for Electronic Transmission and Telepsychology in the State of Idaho (approved July 12, 2012).
- Senate and General Assembly of the State of New Jersey. N.J. Stat. Ann. § 45:1-63(3)(a) (approved July 21, 2017). Accessed at: https://www.njleg.state.nj.us/2016/Bills/PL17/117_.HTM
- West Virginia Legislature. W. Va. Code § 30-3-13a (approved February 2019). Accessed at: http://www.wvlegislature.gov/Bill_Status/bills_text.cfm?billdoc=hb2947%20intr.htm&yr=2019&sesstype=RS&i=2947
- Commonwealth of Pennsylvania. 49 Pa. Code § 47.1 (approved September 2010). Accessed at: http://www.pacodeandbulletin.gov/Display/pacode?file=/secure/pacode/data/049/chapter47/chap47toc.html&d=reduce
- American Psychiatric Association. Telepsychiatry Malpractice Issues. Accessed at: https://www.psychiatry.org/psychiatrists/practice/telepsychiatry/toolkit/telepsychiatry-malpractice-issues
- The Center for Connected Health Policy. Accessed at: https://www.cchpca.org/telehealth-policy/malpractice