By Cori Haper and Rebeccah Raines

Law360 (March 17, 2020, 5:49 PM EDT )

Cori Haper

Rebeccah Raines

As individuals and organizations take precautions to avoid catching and spreading COVID-19, telemedicine can play an important part in assessing and treating patients who have COVID-19 symptoms, as well as ensuring continuity of care for patients who prefer not to visit medical facilities to seek care for other health conditions.

Health care practitioners who choose to provide care using telemedicine during the pandemic should be aware of the laws and reimbursement policies that apply. This article provides general guidance, with a focus on Ohio laws.

State Telemedicine Laws

A health care practitioner must provide telemedicine services in accordance with the laws of the state where the patient is located. If the practitioner chooses to provide telemedicine services to individuals located in other states, they should confirm and comply with the other states' licensure requirements and telemedicine laws.

Physicians licensed in Ohio may use oral, written or electronic communications to examine and diagnose patients located in Ohio.[1] Physicians who are not licensed in Ohio may not practice medicine in Ohio without first obtaining a telemedicine certificate, which permits the holder to engage in the practice of medicine in Ohio.

Physicians using telemedicine are held to the same standards of care as for in-person care, and failure to conform to the appropriate standards of care, whether care is rendered in person or via telemedicine, may subject the physician to potential discipline by the Ohio State Medical Board.

The medical board has advised that a provider practicing telemedicine should:

• Have some means of verifying the patient's identity;

• Establish a diagnosis using accepted medical practices, such as patient history, mental status examination, physical examination, and any appropriate diagnostic or laboratory testing — if not performed in person, then by using appropriate technology or utilizing a licensed telepresenter who is with the patient (a simple questionnaire without an adequate examination could violate the law);

• Ensure the availability of appropriate follow-up care and maintain a complete medical record of the patient's care that is available to the patient and other treating health care providers; and

• Comply with special rules that apply to treating patients prescribed controlled substances for chronic pain.

The medical board issued its COVID-19 and Telemedicine Guidance on March 11, which provides a review of Ohio law, as well as frequently asked questions.[2]

A provider should obtain the patient's informed consent to the use of treatment via telehealth.

Prescribing to People Not Seen by the Physician

Existing Patients

An Ohio physician may prescribe a noncontrolled substance to an existing patient if the physician or another person in the prescribing physician's practice has performed a physical examination of the patient for the condition the medication is intended to treat.[3]

An Ohio physician may prescribe a controlled substance to an existing patient if the physician or another physician in the prescribing physician's practice has performed a physical examination of the patient for the condition the medication is intended to treat, but only if the patient is an active patient.[4]

New Patients

A physician may prescribe a noncontrolled substance to a new patient on whom the physician has never conducted a physical examination and who is at a location remote from the physician, if the physician:

• Verifies the patient's identity and location;

• Obtains the patient's informed consent for treatment through a remote examination;[5]

• Interacts with the patient to complete a medical evaluation that is appropriate for the patient and the condition for which the patient presents and that meets the minimal standards of care, which may include portions of the evaluation having been conducted by other Ohio-licensed health care providers acting within the scope of their professional license;

• Establishes or confirms a diagnosis and treatment plan, including documentation of the necessity for the use of a prescription drug and any underlying conditions or contraindications to the recommended treatment;

• Documents in the patient's medical record the patient's consent to treatment through a remote evaluation, pertinent history, evaluation, diagnosis, treatment plan, underlying conditions, any contraindications and any referrals to appropriate health care providers;

• Either provides or recommends any necessary followup care;

• Makes the medical record of the visit available to the patient;

• With the patient's consent, forwards the medical record to the patient's primary care provider or other health care provider, if applicable, or refers the patient to an appropriate health care provider or health care facility;

• Uses appropriate technology sufficient to conduct the above as if the medical evaluation occurred during an in-person visit; and

• Prior to prescribing or personally furnishing opioid analgesics, benzodiazepines or reported drugs, obtains and reviews an Ohio Automated Rx Reporting System drug database report, in accordance with the provisions of Ohio Administrative Code Section 4731-11-11.

During an interactive telemedicine encounter, a physician may prescribe a controlled substance to a patient for whom the prescribing physician has not conducted a physical examination and who is at a location remote from the prescribing physician only as part of on-call or cross-coverage arrangements for a patient who has received at least one in-person or telemedicine medical evaluation within the previous 24-month period from an Ohio-licensed physician who is temporarily unavailable to evaluate the patient, and the prescribing physician complies with the steps set forth above for prescribing noncontrolled substances.[6][7]

HIPAA Compliance

Health care providers should ensure that the technology used to deliver telemedicine services complies with the Health Insurance Portability and Accountability Act security rule's requirements, meaning that it should be secured and encrypted.

In its February 2020 bulletin, HIPAA Privacy and Novel Coronavirus, the U.S. Department of Health and Human Services' Office for Civil Rights, reminds covered entities how patient information may be shared under the HIPAA privacy and security rules during an outbreak of infectious disease or other emergency situation.[8]

In the bulletin, the OCR confirms that HIPAA's privacy and security protections are not set aside during an emergency. Covered entities and their business associates must still apply the security rule's administrative, physical and technical safeguards to electronic protected health information.

Common smartphone applications, such as FaceTime and Skype, would not meet these criteria, so a telemedicine provider should utilize videoconferencing technology that is secured and encrypted in accordance with the security rule's requirements. The provider should also enter into a HIPAA-compliant business associate agreement with its videoconferencing technology vendor to ensure that the vendor adequately safeguards patient information shared during a telemedicine encounter.

The OCR bulletin also details the circumstances under which a health care provider may disclose protected health information without a patient's consent. While the bulletin does not establish new disclosure exceptions to the HIPAA privacy rule, health care providers should familiarize themselves with how protected health information may be shared during the COVID-19 pandemic.

Reimbursement Considerations

Medicare

Current Medicare telehealth rules limit opportunities for reimbursement, specifically:

• Medicare patients may only receive telehealth services while located in certain types of health facilities, including physicians' offices, hospitals, federally qualified health centers and skilled nursing facilities located in either a health professional shortage area or a county outside a metropolitan statistical area. Medicare does not reimburse for telehealth services delivered to patients in their homes.

• Telehealth services must be provided in real time via an interactive audio and video telecommunication system. Telephones do not meet the definition of an interactive telecommunication system.

On March 6, H.B. 6074[9] was signed into law, granting the HHS secretary authority to waive certain Medicare telehealth requirements to provide broader access to reimbursable telehealth services during a declared emergency period to help decrease the need for Medicare patients to visit crowded health care facilities during the COVID-19 outbreak. If implemented by the secretary, the following changes will apply:

• A Medicare patient will be able to receive telehealth services at home, at a relative's home or at a health care facility not currently authorized as an originating site.

• A practitioner and a Medicare patient may use a telephone as the telecommunication system, provided the telephone has audio and video capabilities that enable two-way, real-time communication.[10]

• For these relaxed requirements to apply, the practitioner or a practitioner in the same practice must have furnished the patient with an item or service for which payment was made under Medicare during the three years prior to the telehealth encounter.

• The other existing Medicare requirements for providing services via telehealth will continue to apply, such as the beneficiary being the party to initiate the service and giving consent to be treated via telehealth.

As written, H.B. 6074 appears to apply to any currently eligible services under Medicare, but it remains to be seen whether any forthcoming rules will limit the waivers to only those services involving assessment and treatment of COVID-19. As of the date of this article, the secretary has not yet implemented any rules or program instructions with respect to the waivers. Until the rules or program instructions are issued, current Medicare telehealth reimbursement rules continue to apply.

Ohio Medicaid

As of the date of this article, Ohio Medicaid has not issued any rules providing flexibility on reimbursement requirements for delivery of telemedicine services related to COVID-19. However, updated rules effective in July 2019 allow practitioners to provide telehealth services to patients in their homes.[11] Despite this added flexibility, Medicaid providers should be aware of the following rules:

• Practitioners must provide services from their service location(s) reported to Medicaid under Medicaid's screening rules,[12] unless (1) the patient is an active patient,[13] (2) the practice is enrolled as a patient-centered medical home (subject to certain additional requirements) or (3) the service provided is an inpatient or office consultation for a new or established patient when providing the same quality and timeliness of care to the patient other than by telehealth is not possible, as documented in the medical record.

• Services must be delivered via secure, synchronous, interactive, real-time electronic communication comprising both audio and video elements. Reimbursement is not available for services delivered by email, telephone or facsimile transmission.

• Services provided via telehealth must be provided in accordance with HIPAA, state privacy laws and Title 42 of the Code of Federal Regulations, Part 2.

• The practitioner site must have access to the patient's medical records at the time of service and is responsible for maintaining documentation for the health care service delivered through the use of telehealth.

• The practitioner must confirm that services delivered are eligible for payment under Ohio Medicaid.[14]

Commercial Payors

Health care providers should review their commercial insurance provider agreements and policy manuals for policies on coverage and reimbursement for services delivered via telemedicine. Many states have adopted telehealth parity laws that require commercial health plans to provide coverage for eligible services delivered via telemedicine in the same way that they cover services delivered in person.

Ohio has a new telehealth parity law that applies to health benefit plans issued, offered or renewed on or after Jan. 1, 2021.[15] As this law does not apply to existing health benefit plans, current health plan telemedicine policies could distinguish between coverage and reimbursement of services provided via telemedicine and those provided in person.

Conclusion

The laws governing the provision of and reimbursement for telemedicine services during the COVID-19 outbreak will likely continue to evolve. Health care practitioners providing or considering providing telemedicine services should monitor the latest developments and consult with legal counsel to ensure compliance.

---

Cori Haper is a partner at Thompson Hine LLP and chair of the firm's health care practice. 

Rebeccah Raines is an associate at the firm.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

[1] "State Medical Board of Ohio Position Statement on Telemedicine" at https://med.ohio.gov/LinkClick.aspx?fileticket=egcAzl-lHlE%3d&portalid=0.

[2] State Medical Board of Ohio "COVID-10 and Telemedicine Guidance" at https://med.ohio.gov/Publications/Recent-News/practicing-telemedicine-in-ohio.

[3] The focus of this summary is on a practitioner's ability to provide telemedicine services to patients in their homes or other nonfacilities.

[4] "Active patient" means that within the previous 24 months, the physician or other health care provider acting within the scope of their professional license conducted at least one in-person medical evaluation of the patient. Ohio Administrative Code Section 4731-11-01(D); 21 U.S.C. § 829(e).

[5] Informed consent requires that the patient and the physician discuss the risks and benefits of, and alternatives to, treatment through a remote evaluation, resulting in the patient's agreement or signed authorization to be treated through remote evaluation conducted through technology.

[6] Ohio Administrative Code Section 4731-11-09(D)(1); 21 U.S.C. 829(e).

[7] 21 U.S.C. 802 (54)(D).

[8] https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf.

[9] House Bill 6074 is called the "Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020."

[10] Providers should continue to comply with the HIPAA Security Rule.

[11] Ohio Administrative Code Section 5160-1-18.

[12] http://codes.ohio.gov/oac/5160-1-17.8.

[13] "Active patient" means that within the previous twelve months at least one in person physical exam or assessment of the patient has been conducted by the telehealth practice or practitioner acting within the scope of their professional license or by the patient's usual source of medical care that is not an emergency department. Ohio Administrative Code Section 5160-1-18.

[14] See Ohio Administrative Code Section 5160-1-18(D).

[15] http://codes.ohio.gov/orc/3902.30.

For a reprint of this article, please contact reprints@law360.com.