Federal Discretion for HIPAA and Telehealth Expiring May 11 - Implications for Microsoft Teams
The Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) issued four distinct Notifications of Enforcement Discretion between April, 2020 and February 2021, and all Notifications collectively were associated with the COVID-19 public health emergency. These discretions were issued to essentially allow healthcare providers the ability to adapt their care models to unprecedented circumstances during the pandemic. In this quick blog I will discuss one of the expiring discretions associated with telehealth and the use of “non-public facing remote communication technologies”, which includes Microsoft Teams. When healthcare providers use virtual healthcare or telemedicine to deliver services, they must ensure that they comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. OCR is tasked with enforcing this application of HIPAA and HITECH to these services that use remote communication technologies, thus, why they issued the initial notification detailing their provision to not impose penalties. When they issued the notice on March 17, 2020 – the accompanying FAQ did not specify when the notification would expire. That TBD expiration date is now May 11, 2023.
