[ Friday, April 14, 2023 ]
End of the Public Health Emergency means end of HIPAA Enforcement Discretion. Been on Zoom or Teams lately? Worked from home? Telecommuted? The Covid Pandemic changed a lot of things about the way we work, including a dramatic increase in telehealth services. In healthcare (primary care particularly), there was firehose-level adoption of Zoom, FaceTime, and similar technology at the very early stages of the pandemic, as providers tried to find ways to keep their patients healthy without having them come to the office.
However, these new technologies raised potential HIPAA issues: were they safe enough? Had the adopting practices done sufficient due diligence understand the risks they posed to the confidentiality, integrity, and availability of the PHI that would be transmitted? OCR wasn't about to simply say "Zoom is HIPAA-compliant" (as any reader of this blog knows, that's not how that works); however, at the same time, OCR wasn't about to stand in the way of Covid-safe healthcare delivery.
As is usually the case*, OCR took a balanced, reasonable approach: if providers agree to take reasonable steps to layer on the best privacy and security safeguards they can, OCR will agree not to prosecute you for a HIPAA violation if you use one of these video technologies. They called it "enforcement discretion:" OCR will exercise the discretion granted to it to not prosecute Zoom and FaceTime users for HIPAA violations. Now, OCR didn't say Zoom or FaceTime were otherwise improper under HIPAA; keeping a neutral stance, they simply said that, for the time being, we won't hold it against a covered entity that they chose to use such a technology.
OCR made clear that this was a pandemic-related decision, and subject to the circumstances. That meant that, when the pandemic ends, so does the enforcement discretion. And lo, it came to pass, that the pandemic will officially end (as far as the federal government is concerned) on May 11, when the Public Health Emergency declaration ends. OCR will give covered entities and business associates 90 additional days (from May 12 through August 9) to become compliant. OCR's declaration is here.
Bottom line: if you are a covered entity and adopted Zoom or some other telehealth technology, now is a good time to take a look at how you're using it, and make sure it fits within your HIPAA policies and procedures. It would be a good idea to have a specific policy/procedure to address use of telehealth technologies (ask me if you need a form). Make sure you cover ALL instances where you use Zoom, especially if you use it for non-patient-care purposes -- for example, staff meetings where PHI is discussed.
It might also be a good idea to leverage off of that review to freshen up your overall HIPAA risk analysis. Are there other practices you adopted during the pandemic that might have HIPAA risk? It doesn't mean you have to actually change anything, and in fact you might be doing everything as safely as possible. But it's a good idea to look, because technology changes, as to threats.
* I've been accused of being a cheerleader or fanboy for OCR, but that's not true. I think the civil rights arm of OCR has been pretty lousy, with a heavy thumb on the scale for leftist woke claptrap and a clear bias against traditional religious rights. But the HIPAA enforcement part of OCR has really been a partner to the healthcare industry it regulates from the beginning of HIPAA in 1999-2000. I give credit where due, and when the government does something right, it deserves mention.
Jeff [8:39 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
