Telehealth and the Expiration of COVID-19 Public Health Emergency, with Kathy Wibberly

Organizations and resources mentioned in this episode:

• Mid-Atlantic Telehealth Resource Center
• COVID-19 Public Health Emergency, U.S. Department of Health and Human Services
• HIPAA for Professionals, Office of Civil Rights, U.S. Department of Health and Human Services
  • HIPAA and COVID-19
  • HIPAA and Telehealth
  • HHS Office for Civil Rights Announces the Expiration of COVID-19 Public Health Emergency HIPAA Notifications of Enforcement Discretion – OCR announces a 90-day transition period ending August 9, 2023 for covered healthcare providers to come into compliance with the HIPAA rules regarding telehealth provision. [Added 4/20/2023]
• Telemedicine Prescribing of Controlled Substances When the Practitioner and the Patient Have Not Had a Prior In-Person Medical Evaluation, March 1, 2023 Federal Register Drug Enforcement Agency Notice of Proposed Rulemaking related to the Ryan Haight Online Pharmacy Consumer Protection Act of 2008
• A Roadmap for New Physicians: Fraud & Abuse Laws, with a section on the anti-kickback statute, Office of the Inspector General, U.S. Department of Health and Human Services
• Acute Hospital Care at Home, Centers for Medicare and Medicaid Services
• Physicians and Other Clinicians: CMS Flexibilities to Fight COVID-19, 2023 fact sheet, Centers for Medicare and Medicaid Services

Transcript

Andrew Nelson: Welcome to Exploring Rural Health, a podcast from the Rural Health Information Hub. My name is Andrew Nelson. In this podcast, we'll be talking with a variety of experts about providing rural healthcare, problems they've encountered, and ways in which those problems can be solved. This is an episode about the COVID-19 Public Health Emergency [PHE] declaration set to end on May 11th. Today I'm talking to Kathy Wibberly, who's been the director of the Mid-Atlantic Telehealth Resource Center since 2012. The MATRC is housed within the University of Virginia Karen S. Rheuban Center for Telehealth. Thank you for joining us today, Kathy.

Kathy Wibberly: Thank you for having me.

Andrew Nelson: In January of 2020, a national Public Health Emergency was declared as a result of COVID-19. Can you tell us some about when the initial PHE was declared, and what some of the immediate impacts to telehealth were?

Kathy Wibberly: Yeah, so many of the flexibilities that that we now know, and until May 11th when things end, they all kicked off and they were actually declared in phases. So things were a moving target for about a month there. But probably the biggest things that we all now are appreciating and enjoying are the Medicare flexibilities related to HIPAA, related to being able to prescribe controlled substances. Big ones are reimbursement for audio-only care, reimbursement for patients who are not necessarily rural, and also reimbursement for home as the originating site, and those are the huge ones.

Andrew Nelson: There were several points in the last three years where the PHE was renewed or extended. Were those thresholds marked by any additional changes in the way telehealth could be administered?

Kathy Wibberly: We didn't see significant changes at the different extensions, but we did see changes along the way. So they weren't attached to the renewals per se. It took a little while for FQHCs [Federally Qualified Health Centers] and Rural Health Clinics to be recognized as distant site providers. That was right at the start of the pandemic. That was not part of the original flexibilities. Then it became so, and it remains so to this day. Also, we saw an expansion in the types of providers that could provide telehealth. And that too was not tied to any particular extension, but it just happened as we went further into the pandemic and people started realizing, “Oh, this isn't just a temporary fix for the next month.” They realized this was going to be six months, 12 months, and now, almost three years down the road. So things like physical therapists and occupational therapists, speech language pathologists, audiologists, those were all kind of became eligible telehealth providers.

Andrew Nelson: As much as the term “new normal” has been thrown around in the last three years, there are a lot of practices or methods that didn't exist before the start of the PHE that have now become the standard. And it'll be interesting to see how those continue or how those evolve after the end of the PHE. As you mentioned, three years after the initial PHE declaration, on January 30th of this year, 2023, the White House announced that both the COVID-19 National Emergency and PHE declarations would end on May 11th. This will result in the resumption of enforcement of penalties for unknowing violations of HIPAA privacy, security, and breach notification rules. Can you tell us in a little greater depth how that's going to affect telehealth?

Kathy Wibberly: Absolutely. So during the pandemic, it wasn't really that they waived HIPAA, but they waived the enforcement of HIPAA. And so providers were basically told, “If you're providing telehealth in good faith, we're not going to come penalize you if you violate.” And many people were doing telehealth for the first time ever during the pandemic, so they really did not have the resources, have equipment, have software, have technologies set up. So they were relying on things like whatever consumer-based video conference we have, whether it's a smartphone, iPhone, using Zoom, using any number of video conference platforms. And so people have gotten used to it. Consumers have gotten used to it. It's easy, right? It's like whatever's available on your phone. We don't need to download any software, we don't need to use a special link. That is going to come to an end.

And what that really means to providers are a number of things. One is you can't just have any consumer-based device. You're going to really need to have some software that has the encryption, you're going to have to have a Business Associates Agreement with the software vendor. Those vendors are going to need to understand what HIPAA is and be able to do things like breach notification and all those great things that come with those regulations. They're intended to protect people, but I think one of the unintended consequences is it does make the telehealth visit slightly more complicated. Because you can't just pick up, you know, and just dial using Google Chat or Meet or whatever you happen to have. I think another thing that people really have not thought through often if they hadn't been doing telehealth is that HIPAA is not just your phone, right?

It's not just the video conference, it's not just encryption. There are many administrative things. And so, as people have moved from work sites to home and working from home, they really aren't thinking about their own routers, their access points, whether their home network is actually secure, whether they're using a public network, which all would violate HIPAA. Also, things like privacy in the home. Do you have a secure locked office? Do you have kids running around in your background who can hear this conversation? We've had providers providing telehealth visits, sad to say, in public locations; open the laptop sitting in a park or at a Starbucks. And those are all violations of HIPAA, and I think we really need to start getting the message out that you may have been doing this for the last three years; you should probably shouldn't have been anyway, but you will get slapped with fines.

Andrew Nelson: Yeah. So there're going to be a lot of changes for the things that providers are doing. Can you talk a little bit about the extent to which that might change clients' or patients' experience? Will they need to go back to install a special app on their phone or their computer, that kind of thing?

Kathy Wibberly: Absolutely. So I think, you know, you and I are probably used to using Zoom, and most of us have either the free Zoom platform or the Zoom for education kind of thing. And so Zoom for healthcare is different. It costs more, first of all. But there are some security things around that. So as patients think about, well, “I used to just click on this; my provider would just send me a link by email.” Well, sending things by email is not necessarily secure from a HIPAA standpoint because your IP address and your email address are considered PHI [protected health information]. Now we're talking about trying to drive people to connect through their patient portals. People have oftentimes difficulty with the patient portal because it requires a certain level of digital literacy. You need an email address, you need to be able to sign in, you need to remember a password, all of those things. And so I think patients are going to find that extra step perhaps a little bit more challenging.

Andrew Nelson: Certainly. There are a lot of important changes coming up in the next couple years as some of the allowances that were made during the PHE start to start to get rolled back as things kind of return to normal. Can you talk a little bit about this timeline and what some of the important dates are, maybe starting with May 11th?

Kathy Wibberly:

Let me kind of focus on those things that'll change immediately when the PHE ends. So on May 11th, the HIPAA enforcement we already talked about. The next big thing is the DEA and the Ryan Haight Act. So there were some temporary flexibilities during the PHE that allowed providers to prescribe controlled substances without an in-person visit. Under the Ryan Haight Act, which started in 2008, it basically said, “If you are prescribing controlled substances, the patient has to be treated in a particular facility.” So it's a hospital or clinic, the patient has to be treated in the physical presence of another registered practitioner. If the telemedicine consult is conducted by a registered practitioner it's allowed under Indian Health Services, but not other services. So basically the big picture is if you have not had an in-person visit with this patient, you cannot prescribe by telehealth.

So there was always this kind of registration process that was in the rules, like the DEA will create a special registration process that will allow telemedicine providers to prescribe. Well, since 2008, nothing has ever been done with that registration process. Public Health Emergency was one of the provisions; you can prescribe controlled substances if there's a Public Health Emergency. So when the PHE came about, those flexibilities came about and they said, “Okay, you don't have to have an in-person visit before prescribing controlled substances.” This was a huge relief to many, many providers, obviously, and especially with psychiatric services. You know, many, many kids, with ADHD, with all sorts of medications, they didn't need to come in and have an in-person visit first. People got used to that.

There didn't seem to be huge detriment, but as soon as that Public Health Emergency ends, you're going to have to have that in-person visit again. We're seeing a huge challenge because many, many providers, especially mental health providers, have actually moved to all-virtual in their practice. And so how are you going to have an in-person visit before prescribing? So just last month in February, the DEA announced a proposed new rule for some permanent telehealth or telemedicine flexibilities. However, they did not develop a special registry, yet again. We don't know whether the proposed new rule will become permanent prior to May 11th.

So right now we need to kind of act as if we're going to have to have an in-person visit before prescribing controlled substances. So there were three provisions in the proposed new rule. One is that you can prescribe controlled substances without an in-person visit if the patient is being referred to you by a practitioner who had an in-person visit. So that helps some. You may also prescribe a 30-day initial prescription for Schedules III, IV, and V, like non-narcotic controlled substances. But beyond 30 days, if you need a refill, you'll go back to a required in-person visit. However, prescribing the Schedule II or narcotic controlled meds will not be allowed without a prior in-person visit. So there's a lot of reaction to this right now, and we just don't know. So there's a lot of unknown with that.

So that is coming up very soon and we shall see what the impact of that is going to be. A third thing that's going to happen immediately with the end of the PHE is that the flexibilities with what's called the anti-kickback statute will go away. So, the anti-kickback statute prohibits kind of knowing willful payment that, that the federal government would say you're inducing or rewarding patient referrals. So for example, for telehealth, let's say I am a huge medical center and you are a small rural clinic or small rural hospital. And I say, well, “Let me provide you with remote patient monitoring equipment for all of your COVID-19 cases or COPD cases under the Public Health Emergency.” I could do that for free of charge, right? I can say, “Here, I'm giving you all this equipment.” After the PHE ends, the federal government is going to view that as inducing referrals, right?

You can't just give away stuff because then it's perceived as, “Oh, well, tit for tat,” right? “I give you lots of free equipment and then you're going to refer all your patients to us.” So that could have a significant impact on the smaller practices who don't have the funds to purchase their own equipment. Prior to the PHE, I think some workarounds around that would be like to actually have a contract. So you know, “You provide this RPM equipment, we'll pay you, you know, $5 a month or you know, however, per patient.” It could be a very small amount, but it still has to be some exchange for the service. So it's not viewed as a gift for inducing referrals. We all know how difficult contracts are, right? So if you haven't started that process down a contract road by now and May 11th hits, you may be in trouble.

So you're going to have to stop using that equipment that was given to you by, let's say, large medical center A or big practice B. So that's going to be another issue. I think a fourth thing that's going to happen at right at the end of the PHE impacts remote patient monitoring. So during the PHE they removed the restrictions on remote patient monitoring so that the patient didn't have to be an established patient. So if I never saw you in person, but you are showing all the signs of, let's say, respiratory distress because of COVID or whatever, I can put you on a remote patient monitoring program and monitor you from home without ever having an E/M [evaluation and management] visit in the office. That will go away with the end of the PHE. And also the other flexibility that will go away with remote patient monitoring is that anti-kickback thing, right? You kind of give that patient equipment, so now they're either going to have to pay for it or the practice is going to have to pay for it somehow. So those are some fairly big changes that will be coming up.

So the Hospital Without Walls program or, or oftentimes known as Hospital at Home, it basically waived a lot of the regulatory issues so that it said, well, if this is something that would be treated in the hospital, so an inpatient care service, if you can figure out how to provide that service without having that patient be at home. And this was in response to all the hospital beds being completely full with COVID patients, and we need to figure out how to treat these people without them having to physically be in the hospital. But Hospital at Home has actually been in existence in other countries for decades now. It's new for us in the US, but by using remote technologies, by using personnel that go to the patient's home, they've been able to move what typically would've been an inpatient service into an outpatient setting, whether it's a home or any other facility, and provide that same kind of service and bill for that service as if it were an inpatient service. And I think that was the big piece, how do you bill for an inpatient service if the patient is sitting at home? But that's what that flexibility has allowed. And so Congress has kicked that can down the road to the end of 2024 as well.

Most of the time there was some in-person element, but a lot of the monitoring would've been done by telehealth. And so you might have one person visit the home a day a week, or two days a week and then everything else is monitored remotely. Unless there's a need — something happens, someone needs to go in. So it's a combination, it's a hybrid model, and I think that's where we're going anyway, with all of telehealth. It's going to be a hybrid model.

Andrew Nelson: Sure. Well, would those flexibilities just cease to exist? Or do you think that some kind of modification, some kind of compromise, might be reached instead of it being completely eliminated?

Kathy Wibberly: Yeah, so I think right now, CMS has this whole Hospital at Home piece as a demonstration project. It's already showing significant data that it's a less expensive way to provide care and from other countries results, you know, patients recover quicker at home. And you and I can probably figure that out. It's a no-brainer, right? You're able to sleep better, you're in a more relaxed environment so you can heal quicker. I think that, you know, in the best of all worlds, this will become a permanent piece of the regulatory flexibilities. But we shall see. I think the data's definitely there.

You asked about the rest of the timeline, right? So, there are a lot of kind of benchmarks and unfortunately they're all kind of moving targets at this point. So one thing that CMS uses is this physician's fee schedule piece. So at the start of each new year, January 1st, they issue a new kind of physician fee schedule that oftentimes says, “Hey, we are changing what we are reimbursing for, we're we've made these temporary things permanent.” So in 2021, they made a whole bunch of new things permanent. In 2022, they did the same. In 2023, they did the same. We anticipate that's going to happen in 2024 as well. And so be on the lookout around October, November-ish of this year for the proposed regs to go out, and then there'll be a comment period, and then come January 1st of the new year, there'll be a new set of codes that we've made permanent.

CMS also has what's called this Category III code that got instituted during the PHE. So basically, these were temporary codes that they allowed during the PHE and they think, “Well, these codes might be useful, let's study these some more. So we'll temporarily allow this set of codes, call them Category III, we're going to collect data, and then they may or may not be made permanent.” So those are the things everyone's keeping an eye on, right? So maybe during this physician fee schedule for 2024, they'll take a subset of those Category III codes and make them permanent. So that's another thing.

But one thing that did not end was the virtual direct supervision piece. So that one still, I think, ends September 2023 as far as I can tell right now, unless someone introduces something different. So during the PHE, they said, “Hey, if you have direct supervision requirements, you can do that virtually.” I can provide a doctor's supervision remotely watching them on video conference. I don't have to be sitting there physically in the same room or in the same facility as them. That may end, which could impact training programs; residency training programs and other things where doctors who were being able to supervise remotely or mental health training programs are now going to have to be onsite in that facility. So almost everything else got kicked two years down the road to December 31st, 2024 as a result of the Omnibus bill.

People didn't want to make decisions about permanence, so they just said, “Well, let's give it more time.” So those things are the big ones that we mentioned; home as originating site for Medicare, FQHCs and RHCs as distant site providers. The audio-only reimbursement piece; having no limitations on geography. So prior to the pandemic, facilities had to be in rural and underserved areas to get reimbursed by Medicare. They also delayed the in-person requirement for mental health services. So that was kind of a change that happened last year. And they said, “Well, you still have to have an in-person visit every six months for mental health services.” And that got kicked down. So hopefully that will change as well. Hopefully some of those will get made permanent before that 2024 ends.

Andrew Nelson: Yeah, it'd be nice to have a little certainty before these changes need to be made.

You also mentioned the requirement that existed, and may soon exist again, for an in-person visit, especially prior to prescribing certain kinds of prescriptions. Is that requirement satisfied if a patient has ever had an in-person visit with a physician, or does it need to be right before the prescription occurs?

Kathy Wibberly: It was, “has ever had an in-person visit,” but we also know that during the pandemic, many, many people established patients through telemedicine. And so there's a little bit of an unknown, like if it's a now-established patient, even though that patient never had an in-person visit, will that still be eligible? That's kind of a little fuzzy gray area there.

Andrew Nelson: Sure. That's kind of interesting too. That's another area where there's a little bit of uncertainty. From what you've seen in working with rural providers, do you feel that in general they're ready for the changes that are coming at the end of the PHE, or are there any concerns you have, or advice you would give them?

Kathy Wibberly: I have a lot of concerns. And I think it's not just rural, but certainly rural has more challenges than huge hospitals and health systems. So I think one of the biggest challenges I see is that because this is a moving target, things are changing sometimes daily, weekly, monthly. There are a lot of rumors, there's a lot of misinformation, but there's also a lot of missed information. And if you're in a huge hospital health system, you probably have an office of telemedicine, you have a whole cadre of people looking at all of these things that are happening constantly. For smaller practices, for small rural hospitals, most of the times you have the one person who's doing three or four jobs. It's going to be really easy to miss changes coming down the pike.

And I think my fear is that for rural hospitals, they're not going to have a communication plan because they don't have a communications director. They're not going to be able to get information out quickly to providers. So let's say CMS suddenly makes a change and this is allowed, but this is not allowed, or [for] telephone only, we will now only be reimbursing half the rate. And that it won't be parity with in-person if that communication doesn't come down, and you're billing all these audio-only codes, that's going to affect your bottom line significantly. So I think those are the things that I have a lot of concerns about. And then a lot of rural providers were never using telehealth prior to the pandemic, and they pivoted rapidly. And I think my concern is a lot with, if you didn't realize all of these things, you're not going to have things in place for when those provisions or those flexibilities end.

So you might not have the HIPAA-compliant platform [with] all of the administrative controls that need to happen. You might not have an ability to have an alternate site to see a patient because, let's say, at-home no longer is eligible. You don't have kind of this whole network set up where you can go here, you can go site B, site C, a lot of the large hospital health systems are already developing this huge network of alternate locations where patients can go. So I think those are the types of things that I am very concerned about.

Andrew Nelson: You mentioned audio-only telehealth visits earlier. We've seen that video telehealth visits have become pretty firmly established at this point as a tool that payers will reimburse. How have audio-only and video-only telehealth visits been different, or how do you think they will be treated differently here in the next couple of years?

Kathy Wibberly: I think there's a huge debate right now on the whole audio-only thing. So one, I think the jury's still out on a number of services and can they actually be done effectively by audio-only? But I think the bigger question is the issue of telehealth equity, right? If I am in rural and I don't have access to broadband, and all I have is a phone, should I be expecting my provider to provide services without reimbursement if they're chatting with me by phone or if I don't have a device. I don't have the income to support a device, or I don't have minutes on my phone to support a video conference call, are we going to penalize those patients and not allow them to have any kind of visit? So is it audio-only versus no visit or audio-only versus video and do we have kind of second-tier people who just can't access video-only?

And then where's the incentive for providers to provide audio-only care if they're not going to get reimbursed? So I think we are really at that point where people are looking at it from all issues. There's not a quick and easy and clear solution. And I think we're hearing a lot of payers say, “Well, maybe we pay less for audio-only.” You know, at least we give them an incentive to use it if they need it, we pay more for video. So it gives you incentive to enable video when you can. So I think we're going to be in this debate for a little while, and all the different payers are landing in different places on that.

Andrew Nelson: Licensure across state lines has long been kind of a limiting factor for the adoption of telehealth. Have you seen an evolution of licensure requirements or reciprocity agreements and multi-state compacts during the pandemic? And how do you think these things might change going forward?

Kathy Wibberly: So licensure is a state responsibility. So that's state oversight. But the federal government basically said, “You have flexibility to do what you need to do to bring in the workforce that you need.” Just about every state, probably every state said, “Okay, we're going to make, you know, some porous borders during the Public Health Emergency.” Most of the states' Public Health Emergency declarations ended a year ago. So I don't know that there are any states that are still under their state PHE. So that also means that most of the licensure things have gone away and have been away for the last year. What we have seen over these last few years is that more and more states are participating in these licensure compacts.

So there are compacts for nursing, for psychologists, for even EMS personnel now, for doctors. For doctors, it's not reciprocity, it's just an expedited process. But for nurses, for the states that participate in a nursing compact, it is actual reciprocity. So if I'm licensed, let's say, in North Carolina, and my state participates in this compact, then my license is valid in any other state that participates in that compact. I don't have to apply for a special license in each of those states. We are also seeing, in the last year and a half, a trend towards states who might not even participate in the compact, but passing laws that allow cross-border practicing.

A provider could have three practices across three different states, or have patients just cross over because they work in DC but they live in Maryland, and so they're getting their healthcare in DC and it makes no sense. So the rule of thumb is that the provider has to be licensed in the location where the patient is physically located at the time of service. So if, let's say, my practice is in DC and my patient is being seen through telehealth and they're sitting in their home in Maryland, I would have to have a license in Maryland to see that patient. Even though they can drive 20 minutes and see me in my office in DC. And so people are saying this makes no sense. It's a burden to providers because they'd have to apply and it's expensive for a license and keep up with all the licensing climates across multiple states. So what states are starting to do are creating legislations that say, “If you practice in a bordering state and you are licensed in one of those bordering states and your license is without blemish, then we will accept that for existing or established patients.” I think more and more states are moving in that direction. We'll see how quickly and how far they move.

Andrew Nelson: Are there any changes that you've seen that took place in telehealth as a result of the PHE that will continue to benefit providers and patients after the end of the PHE provisions?

Kathy Wibberly: Yeah, absolutely. I think the biggest changes that people are comfortable with it now, people know what it is. And I used to start every conversation like, “I direct a telehealth resource center,” and people give you that glassy eyed stare like, “What is telehealth?” I mean, it's very rare now that you have that. People get it, they know what telehealth is, and I think we've changed the status quo, right? Patients have experienced it, providers have experienced it. It's no longer this weird thing that a handful of people do. So I think that what's going to benefit patients and providers both is this movement toward a hybrid model. There are so many things that people go into an office in person for that they don't need to be there in person for; for patients especially who are in inner cities or rural areas where transportation is a huge barrier or childcare or having to take time off from work. To be able to turn that one hour round trip visit and sitting in the waiting room for another half an hour, just for a 10 minute visit, into a 10 minute video visit, I think is going to be a game changer for so many people. Practices are now trying to figure out that hybrid model and what are some things that we don't need to get that patient in.

And we also learned from the pandemic that providers are realizing like, no-shows went down significantly because you can offer someone telehealth services and it is all those barriers, the typical barriers, right? “I didn't have gas money to put gas in my car, so I'm going to miss the visit. You know, my sitter didn't show up. I'm going to miss an appointment.” And we've had some practices who basically said, “If a patient calls to cancel, we're going to immediately offer them a telehealth visit.” And they've converted about half of them. Instead of losing money on a missed appointment where you couldn't fill a slot with someone else, the provider can actually bill for that telehealth visit and the patient's getting care.

Andrew Nelson: As we've mentioned, there is some uncertainty about how things are going to going to change, of course. Are there any, are there any specific areas of concern you have about telehealth post-PHE?

Kathy Wibberly: I think my biggest concern is that some, something will hit the headline news that says, something happens, “So-and- so was seen by telehealth and it went bad,” right? And all of a sudden telehealth is seen as, you're not getting good care and people shouldn't use telehealth. And I think we really need to think about like what is our standard of care for in-person because there are going to be bad actors out there for sure, but there are bad actors on the in-person side too, and we have lots and lots of patients with very bad outcomes who go to in-person care. So I guess my fear is that we throw the baby out with the bath water if something goes wrong. And we really need to take a step back and realize like how much good telehealth is doing right now with access to care and not let those kind of fraud-and-abuse headlines or the “so-and-so had bad outcomes” headlines dissuade us from moving forward with so much great access that we have been able to provide as a result of the PHE.

I would love to just mention, especially for rural providers who don't have the time, energy, resources, staff, to really think about that hybrid model. I would really recommend that you actually think about that seriously, like take a step back and do some planning for it. And I say that because we have lots and lots of for-profit companies moving into this telehealth space and they are going to provide competition for our providers, whether that's an Amazon or a Walgreens or whatever is out there. And we know that patients do better when they have a medical home and when it's not disconnected care. And so if you are not providing that in your small rural practice, if you're not providing that convenience and that access and the ability to see patients when they are sitting at home, I think people are going to respond to that convenience and go to that one-off. You know, “I have an earache, I'm just going to dial into the Walmart provider or the Amazon provider and skip your practice.” And I would just caution, please take that step and take that time to do it.

Andrew Nelson: You've been listening to Exploring Rural Health, a podcast from RHIhub. In this episode, we spoke with Kathy Wibberly, director of the Mid-Atlantic Telehealth Resource Center. Look in our show notes for more information about her work, and visit ruralhealthinfo.org for all things pertaining to rural health.