Risk Management Amid a Global Pandemic

The standard of care provided via telehealth is the same as the standard of care for traditional face-to-face encounters, including patient evaluation and assessment, treatment plans, medication, and documentation.

If planning to provide telepsychiatry services, choose a HIPAA-compliant telehealth vendor and obtain a Business Associate Agreement (BAA) to ensure data protection and security. If using one of the non-HIPAA-compliant platforms, such as Skype or FaceTime, which are temporarily allowed during this national emergency, enable all available encryption and privacy modes.

Regardless of the technology platform, obtain informed consent from each patient authorizing the use of telehealth. Include in the discussion the potential for privacy and security breaches; emphasize the need for interactions to be conducted in a location that provides auditory and visual privacy; and point out that Skype, FaceTime, or similar services are not secure, HIPAA-compliant systems. Document the patient’s understanding prior to use.

One of the major changes impacting care during the COVID-19 crisis involves licensure in the state where the patient is located. During this pandemic, governors in many states have issued executive orders waiving licensure requirements, and many have expedited temporary licenses for out-of-state physicians wishing to provide telehealth services to the residents of their state. Check the executive orders for the states in which your patients are now located. Refer to the Council of State Governments’ “COVID-19 Resources for State Legislators” for a listing of the executive orders.

With the COVID-19 public health emergency, the Drug Enforcement Administration (DEA) has suspended the requirement of the Ryan Haight Act that a health care professional conduct an initial, in-person exam of a patient before electronically prescribing a controlled substance. Comply with state laws or regulations on prescribing controlled substances that may not have been suspended.

If practicing telepsychiatry in multiple states, only one DEA registration is required under federal law to dispense controlled substances in those states. Refer to the Drug Enforcement Agency Diversion Control Division’s COVID-19 information page.

If notified that a patient has or highly suspects he or she has the COVID-19 virus, best practice is to contact your patients who may have encountered that individual. Inform the patients that another patient has tested positive or highly suspects he or she may have the COVID-19 virus and was at the office on the same day. To maintain privacy compliance under HIPAA, do not provide names, appointment times, or information that may make it possible to identify that individual.

The HIPAA Privacy Rule permits disclosure of protected health information without individual authorization to a public health authority, such as the Centers for Disease Control and Prevention or state/local health departments. Limit the disclosure to the “minimum necessary,” such as the name and phone number of the patient, but do not release the clinical record or patient diagnosis. ■