History of the Public Health Emergency
During the Public Health Emergency for COVID-19 (PHE), the federal government enacted several changes to respond to the pandemic and promote the provision of health care. In turn, healthcare providers received enhanced flexibility to streamline the delivery of health care services.
After more than two years, the PHE expired on May 11, 2023. Although May 11, 2023, marked the end of the PHE, many of the changes enacted during and in response to the PHE have continued in effect, while others terminated in their entirety. This article analyzes the key PHE changes for healthcare providers, including whether each change remains in effect beyond the expiration of the PHE and what steps providers should take to ensure continuing compliance.
Stark Law and Anti-Kickback Statute Blanket Waivers
In March 2020, at the start of the PHE, CMS issued blanket waivers that waived certain elements of the Stark Law exceptions for direct financial relationships and referrals related to COVID-19 purposes (as defined by CMS). Shortly thereafter, the Office of Inspector General of the US Department of Health and Human Services (HHS) issued a policy statement stating that its office would exercise its enforcement discretion not to impose under the Anti-Kickback Statute for certain remuneration related to COVID-19 covered by the Stark Law blanket waivers.
These waivers ended upon expiration of the PHE. Consequently, it is important that healthcare providers evaluate the financial relationships and referrals entered into during the PHE pursuant to the blanket waivers. If compliance of the relationship with the Stark Law and Anti-Kickback Statute relies on the CMS and OIG waivers, the relationship needs to be amended to ensure ongoing compliance post-PHE. If a compliant amendment is not feasible, the relationships should be terminated.
Telehealth Services to Medicare Beneficiaries
During the PHE, HHS also issued several waivers under the Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020, and the Coronavirus Aid, Relief, and Economic Security Act, which suspended the geographic and location requirements related to telehealth services provided to Medicare beneficiaries. Although these waivers expired upon expiration of the PHE, the Consolidated Appropriations Act, 2023, passed by Congress in December 2022, extended many of these flexibilities through December 31, 2024, including, but not limited to:
- Medicare beneficiaries can access telehealth services anywhere in the US.
- Medicare beneficiaries can participate in telehealth visits from their homes.
- Certain telehealth visits can be delivered audio-only (such as a telephone) if someone is unable to use both audio and video.
- There is no in-person visit requirement for mental telehealth services (Note: after December 31, 2024, beneficiaries will be required to attend an in-person visit within six months of an initial mental telehealth service and every 12 months thereafter).
- The types of practitioners who may bill for Medicare telehealth services from a distant site are expanded to include qualified occupational therapists, physical therapists, speech-language pathologists, and audiologists. Prior to the PHE, “practitioner” only included physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, certified nurse-midwives, clinical social workers, clinical psychologists, and registered dietitians or nutrition professionals.
Any telehealth arrangements continuing beyond December 31, 2024, will need to be evaluated to determine whether they are compliant with the CMS coverage rules absent the PHE waivers. Moreover, healthcare providers should avoid entering into long-term telehealth arrangements that are dependent on the PHE waivers and cannot be easily amended or terminated.
Use of Non-HIPAA-Compliant Telehealth Platforms
During the PHE, the HHS Office for Civil Rights (OCR) implemented a policy not to impose penalties for noncompliance with HIPAA against providers who communicated with patients and provided telehealth services through remote communications technologies. This permitted healthcare providers to use applications that allow for video chats (e.g. FaceTime, Google Hangouts, Zoom, and Skype) to provide telehealth services without risk of penalties for noncompliance with HIPAA.
Although this allowance ended upon expiration of the PHE, OCR is granting providers a 90-day period, extending from May 12, 2023, through August 9, 2023, to transition to HIPAA-compliant telehealth platforms. (See Notice here.) If providers are currently relying on platforms that are not compliant with HIPAA, alternative, compliant options should be explored and adopted during the transitionary period.
Other Changes Continuing Beyond Expiration of the PHE
- Virtual Supervision. CMS expanded the definition of “direct supervision” to allow the supervising provider to be immediately available virtually, using real-time audio/video technology, instead of requiring his/her physical presence. This flexibility will expire on December 31, 2023. As we approach the second half of 2023, healthcare employers should remind providers of this change and clearly communicate that beginning in 2024, direct supervision will once again require physical presence. If any internal policies have been created or amended using the revised definition of “direct supervision,” they should be amended and implemented before December 31, 2023.
- Reporting of COVID-19 Laboratory Results and Immunization Data to CDC. Upon expiration of the PHE, HHS no longer has the authority to require COVID-19 laboratory results and immunizationdata from labs; however, per the CMS Conditions of Participation, hospitals must continue to report COVID-19 laboratory results and immunization data through April 30, 2024.
- Hospital at Home. The Acute Hospital Care at Home initiative, which allows hospitals to provide inpatient care in an individual’s home, has been extended through December 31, 2024.
- Nurse Aide Training for Nursing Homes. During the PHE, CMS provided a blanket waiver for nurse aide training and certification requirements to permit nurse aides to work even if they had not completed a state-approved Nurse Aide Training and Competency Evaluation Programs (NATCEP) or Competency Evaluation Program (CEP). Although all nursing aide training emergency waivers ended upon expiration of the PHE, CMS has granted facilities four months (until September 10, 2023) to have all nurse aides hired prior to the end of the PHE complete a state-approved NATCEP/CEP. Nursing home providers should evaluate which of their nurse aides were hired prior to the end of the PHE and have not completed the required training and certification requirements, so they can actively monitor and ensure compliance before September 10, 2023.
- Dispensing Controlled Substances via Telehealth. During the PHE, the Drug Enforcement Administration (DEA) and HHS adopted policies allowing DEA-registered practitioners to prescribe controlled substances to patients without in-person interaction. Although this allowance ended upon expiration of the PHE, on February 24, 2023, the DEA proposed rules that would extend these flexibilities, allowing a 30-day supply of Schedule III-V non-narcotic controlled medications; or a 30-day supply of buprenorphine for the treatment of opioid use disorder, without an in-person evaluation or referral from a medical practitioner that has conducted an in-person evaluation. (See Press Release here.) Healthcare providers should monitor the proposed rule and confirm the requirements of the final rule in order to ensure compliance when dispensing controlled substances via telehealth.
HIPAA Enforcement and Expiration of the PHE
During the PHE, OCR declined to impose penalties for violations of certain provisions of the HIPAA Privacy Rule by covered healthcare providers or their business associates for uses and disclosures of PHI by business associates for public health and health oversight activities. In addition, OCR declined to impose penalties for noncompliance with HIPAA by covered healthcare providers and their business associates, in connection with the good faith participation in the operation of COVID-19 specimen collection and testing sites and for good faith use of online or web-based scheduling applications for the limited purpose of scheduling individual appointments for COVID-19 vaccinations. With the expiration of the PHE, the Secretary of HHS stated that it would no longer defer its enforcement authority. Accordingly, covered entities and their business associates must ensure that these activities comply with the applicable requirements of HIPAA and its regulations.
Additional Resources
- If you have any questions about whether your business processes are and will remain compliant with applicable law in light of the expiration of the PHE, we encourage you to seek the advice of legal counsel.
- For specific details about the waivers and flexibilities granted by CMS for specific types of healthcare providers, please refer to the provider-specific Fact Sheets available here.
- For Georgia-specific information about the end of the PHE, see the News Release here.
Please contact MMM’s healthcare group with any questions regarding this update.
