Telehealth experienced massive growth during the COVID-19 pandemic, due in no small part to various regulatory and reimbursement policies that federal agencies implemented following a declaration by the US Department of Health and Human Services (HHS) in early 2020 that the COVID-19 pandemic was a public health emergency (PHE). Although the PHE officially ended on May 11, 2023, several telehealth flexibilities remain available to health care providers and their patients.

On the cusp of the PHE's termination, HHS issued a fact sheet on May 10, 2023, noting some key telehealth flexibilities that will continue post-PHE. They include flexibilities in Medicare coverage for telehealth services, tele-prescribing of controlled substances, and compliance with the privacy and security requirements under the Health Insurance Portability and Accountability Act (HIPAA).  

Expanded Medicare Coverage of Telehealth Services to Extend Through 2024

Prior to the PHE, Medicare limited coverage of telehealth services largely to patients who were physically present within a hospital or other facilities located in certain rural areas. Medicare also required a telehealth encounter to occur through an interactive audio-video system, thus excluding coverage for services delivered via audio-only devices.

During the PHE, HHS relaxed those requirements, using authority under the Coronavirus Preparedness and Response Supplemental Appropriations Act of 2020 and the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The waiver of the Medicare coverage restrictions contributed to a dramatic increase in utilization of telehealth services, with Medicare beneficiaries using 88 times more telehealth services in 2020 than in 2019.

The Consolidated Appropriations Act of 2022 extended many of the Medicare telehealth flexibilities for 151 days following the end of the PHE. More recently, the Consolidated Appropriations Act of 2023 decoupled these flexibilities from the PHE and will continue expanded Medicare telehealth coverage through 2024. Accordingly, as the HHS fact sheet notes, through December 31, 2024, Medicare beneficiaries may:

• Access telehealth services in both rural and urban areas;
• Receive treatment via telehealth at home rather than travel to a health care facility; and
• Use audio-only technology for certain Medicare-covered telehealth visits if unable to use both audio and video, such as a smartphone or computer.

Temporary Flexibilities for Tele-Prescribing of Controlled Substances Continue Amid Proposed Rulemaking

Under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, a physician or other health care practitioner may, with certain exceptions, prescribe controlled substances to a patient only after conducting an in-person evaluation of that patient. Several exceptions to the in-person medical evaluation requirement are specifically tied to the statutory definition of the “practice of telemedicine” (21 U.S.C. § 802(54)). These exceptions, however, are narrow and of limited utility, particularly for telemedicine arrangements in which the patient receives services at home and is unable to obtain in-person care from the prescribing practitioner.

One telemedicine-related exception allows practitioners to prescribe controlled substances during a PHE. During the COVID-19 PHE, this exception permitted prescribing of controlled substances to patients via a telemedicine modality, regardless of whether the practitioner had first conducted an in-person evaluation (and irrespective of whether the prescription was for treatment for COVID-19). While this flexibility may have promoted access to care, it also presented prescribers of controlled substances with the potentially daunting task of conducting in-person evaluations on all of their patients whose treatment began via telemedicine during the PHE and continued after the PHE.

Yet, this scenario did not come to pass. Just days before the PHE terminated on May 11, 2023, the US Drug Enforcement Agency (DEA), in concert with the Substance Abuse and Mental Health Services Administration (SAMHSA), issued a temporary rule extending the telemedicine flexibilities for prescribing controlled substances during the PHE. Under the rule, practitioners may continue to tele-prescribe controlled substances without having to conduct an in-person evaluation of the patient during the six-month period from May 11, 2023, to November 11, 2023. For any practitioner-patient relationships that have been or will be established on or before November 11, 2023, practitioners have an additional one-year grace period through November 11, 2024, during which no in-person evaluation is required.

In addition to giving practitioners more time to conduct in-person evaluations, the temporary rule gives DEA and SAMHSA more time to review the record number of 38,369 comments the agencies received in response to two related March 2023 notices of proposed rulemaking. The first proposed rule would permanently modify DEA’s telemedicine regulations to permit a practitioner to tele-prescribe an initial prescription of no more than 30 days’ supply of a non-narcotic Schedule III through V controlled substance to a patient whom the practitioner has not evaluated in person. The second proposed rule would impose similar requirements for tele-prescribing of buprenorphine, a narcotic for opioid use disorder.

OCR Offers Transition Period Following Expiration of HIPAA Telehealth Policy

As a result of telehealth involving the transmission of patient-identifying information, telehealth providers and the telehealth platforms through which they provide services ordinarily must comply with HIPAA requirements governing the privacy and security of protected health information. To facilitate the sudden and large-scale pivot to telehealth during the PHE, the HHS Office for Civil Rights (OCR) issued a Notification of Enforcement Discretion relating to “telehealth remote communications” and HIPAA compliance. As we discussed in a prior alert, that enforcement policy assured that OCR would not impose penalties for HIPAA non-compliance during the PHE against health care providers in connection with the “good faith provision of telehealth” using a remote communication technology that allows only the intended parties to participate in the communication.

As it was directly linked to the PHE declaration, OCR’s Notification of Enforcement Discretion terminated with the PHE on May 11, 2023. However, OCR announced a 90-day transition period during which it will continue to exercise enforcement discretion as provided in the telehealth notification. During this time, OCR expects health care providers to “adjust their telehealth practices to come into compliance” with HIPAA. Such compliance efforts may include, for example, entering into business associate agreements with telehealth technology vendors and updating policies and procedures.

OCR is expected to issue additional guidance on telehealth remote communications to assist health care providers during the post-PHE transition period, which is scheduled to end August 9, 2023. Thereafter, covered entities and their business associates are subject to enforcement actions by OCR if their telehealth practices do not comply with HIPAA requirements.

Navigating the Post-PHE Environment

For health care providers and patients who grew accustomed to accessing telehealth during the PHE, the continuation of certain telehealth flexibilities following termination of the PHE is welcome news. At the same time, stakeholders should be mindful that the extension of these policies is temporary. As they plan for the eventual termination of pandemic-era telehealth flexibilities, interested parties should remain vigilant for additional regulatory guidance and developments from DEA, OCR, and other agencies, as well as legislation in Congress that may make federal telehealth reforms during the PHE permanent.