The U.S. government just eased the path for doctors and nurses to do video chats with patients by lifting privacy and security compliance penalties and enforcement action against health care providers. The Office for Civil Rights at the U.S Department of Health and Human Services Tuesday said it will allow health care providers to use technology, such as Apple FaceTime, Facebook Messenger video chat or other video platforms, to communicate with patients.

But, while federal response to the COVID-19 pandemic could usher in greater adoption of virtual communication for testing and monitoring patients, several health data privacy questions remain.

The HHS announcement comes at a time when state and local governments have encouraged or demanded people stay home to stave off the spread of the illness. Meanwhile, more and more people who have contracted COVID-19 are quarantined in their homes. This new reality means doctors, hospitals and other health care providers must consider using so-called telehealth services to evaluate people for possible testing and monitor those with the illness. And it means during the emergency period, more people who require other medical assistance or mental health therapy will need to go virtual.

To encourage the use of telehealth services and technologies, HHS seems to be saying health care providers can disregard concerns about HIPAA security compliance during this emergency period, suggested Wilmer Hale Partner Kirk Nahra, CIPP/US.

“The government is saying you don’t have to worry about that risk right now,” he said.

The HHS notification on the use of telehealth communications during the COVID-19 public health emergency even listed specific technologies providers might consider using. “Under this Notice, covered health care providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency,” the notice stated.

“Providers are encouraged to notify patients that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications,” it continued.

Doctors and hospitals have piloted digital communications, like email, texting and video platforms, for some time, but they are not commonplace. In general, health care providers have been leery of data privacy and security concerns related to remote communications with patients. For instance, they worry about doctor-patient confidentiality compliance, patient data security breaches and who has access to patient information when shared via digital platforms.

The World Privacy Forum said it supports the HHS compliance waivers but urged restraint by tech firms when it comes to patient data storage and use: “We urge that any company involved will exercise restraint and appropriate behavior and expressly avoid collecting or using any health care information (including the mere fact of a communication between provider and patient) that is not essential to the communication service provided.” 

Tiffany Chhuom, a mental health therapist who provides services via digital platforms, said she worries about the impact of HHS temporarily lifting privacy protections for patient data included in video or text discussions with their doctors. “The ways in which these clients who are so vulnerable on video could be exploited — I don’t have the words to explain how much that concerns me,” said Chhuom, who is also the owner of digital health care training firm EthTech and currently works with the Washington State Health Care Authority on its use of digital technology in response to the COVID-19 outbreak.

Questions and confusion

One key question that has hindered wider proliferation of telehealth involves the status of tech vendors in relation to HIPAA, Nahra said. If a doctor uses Apple FaceTime to talk to a patient, “What’s Apple in that?” he asked. It has been unclear whether, for instance, a provider would need to sign a business association agreement with Apple in such a case.

Despite easing compliance burdens and facilitating convenient doctor-patient communication during an unprecedented health emergency, Nahra said the HHS guidance is confusing.

“It’s a badly written order,” he said, noting the announcement does not address doctors specifically. “The question of ‘does this apply to doctors?’ is a big deal,” he said. “The point of this exemption should have been telling doctors they can do this, and they screwed it up.”

Whether technologies should be considered HIPAA compliant at all is disputed. The HHS notice states, “Covered health care providers that seek additional privacy protections for telehealth while using video communication products should provide such services through technology vendors that are HIPAA compliant and will enter into HIPAA business associate agreements in connection with the provision of their video communication products.”

“It is actually the human behavior and how the human behavior chooses to use technology that is HIPAA compliant, not the tool,” Chhuom said.

The notice lists Facebook Live, Twitch and TikTok as technologies that should not be used to provide telehealth services because they are public-facing. Chhuom worried that without definitions for private- and public-facing technology, the notice leaves nurses, doctors and other health care providers to figure out for themselves what the difference is.

“There is no federal definition of what is considered public and private space,” she said, noting she has been bombarded with calls over the last few weeks from her consulting clients asking about what can be considered private space in their homes, how to ensure secure Wi-Fi connections, and other telehealth privacy and security concerns.

Ultimately, Nahra said, engaging in a HIPAA-compliant discussion with a patient requires being in a private environment. In other words, he said, don’t sit in a Starbucks and conduct a video chat with a patient. “It’s not the tech itself that is HIPAA-compliant,” he said. “It’s the process.”

Nahra added he expects the temporary exemption from penalties to continue until 72 hours after the national emergency ends.

The IAPP reached out to the HHS for comment, but they did not respond in time for publication. 

Photo by Bernard Hermant on Unsplash