Gabriel L. Imperato (gabriel.imperato@nelsonmullins.com) is the Office Managing Partner of the Nelson Mullins Fort Lauderdale office and is a Board-Certified Health Lawyer by the Florida Bar, and Romain Balard (romain.balard@nelsonmullins.com) is an associate of the Nelson Mullins Fort Lauderdale office. He advises clients on a range of healthcare transactional, compliance, and regulatory matters.
On January 31, 2020, in response to the COVID-19 crisis, the Secretary of Health and Human Services (HHS) Alex Azar declared a public health emergency.[1] Following President Donald Trump’s declaration of a national emergency under the National Emergencies Act and emergency determination under the Stafford Act, the Secretary of HHS was allowed to issue waivers of certain Medicare, Medicaid, and Children’s Health Insurance Program requirements pursuant to Section 1135 of the Social Security Act.[2] As a result, on March 13, 2020, the Secretary of HHS authorized the Centers for Medicare & Medicaid Services (CMS) to take waivers and modifications.[3] The purpose of these Section 1135 waivers is to ensure that sufficient healthcare items and services are available to meet the needs of Medicare, Medicaid, and Children’s Health Insurance Program beneficiaries in case of emergency and that providers who furnish such services in good faith can be reimbursed and exempted from sanctions.[4]
Section 1135 waivers are usually issued to respond to specific concerns in a given emergency area. Once a waiver is authorized, healthcare providers must submit requests to operate under that authority to the State Survey Agency or CMS Regional Office. The requests generally include a justification for the waiver and expected duration of the modification requested. The State Survey Agency and CMS Regional Office will then review the provider’s request and make appropriate decisions, usually on a case-by-case basis. However, due to the gravity of the current crisis, and in order to avoid a case-by-case determination, on March 13, 2020, CMS has made the decision to issue certain blanket waivers.[5] Blanket waivers are issued when a determination has been made that all similarly situated providers need such a waiver.[6] Providers may conduct their operations subject to these blanket waivers immediately and with no further action required. These blanket waivers include coverage for the following:
-
Skilled nursing facilities (SNF): Waiver of the three-day prior hospitalization requirement for coverage of an SNF stay provides temporary emergency coverage of SNF services without a qualifying hospital stay for those people who are evacuated, transferred, or otherwise dislocated as a result of the effect of disaster or emergency. “In addition, for certain beneficiaries who recently exhausted their SNF benefits, it authorizes renewed SNF coverage without first having to start a new benefit period.” This waiver provides relief to SNFs on the time frame requirements for Minimum Data Set assessments and transmission.[7]
-
Critical access hospitals: CMS is waiving the requirements that critical access hospitals limit the number of beds to 25, and that the length of stay be limited to 96 hours.
-
Housing acute care patients in excluded distinct part units: Acute care hospitals may house acute care inpatients in excluded distinct part units where the beds are appropriate for acute care inpatients. “The Inpatient Prospective Payment System (IPPS) hospital should bill for the care and annotate the patient’s medical record to indicate the patient is an acute care inpatient being housed in the excluded unit because of capacity issues related to the disaster or emergency.”
-
Durable medical equipment: Contractors may waive replacement requirements such as the face-to-face visit, a new physician’s order, or medical necessity documentation when the Durable Medical Equipment, Prosthetics, Orthotics and Supplies (DMEPOS) is lost, destroyed, irreparably damaged, or otherwise rendered unusable or unavailable as a result of the emergency.
-
Care for excluded inpatient psychiatric unit patients in the acute care unit of a hospital: Acute care hospitals may relocate inpatients from the excluded distinct part psychiatric unit to an acute care bed and unit. “The hospital should continue to bill for inpatient psychiatric services under the Inpatient Psychiatric Facility Prospective Payment System for these patients and annotate the medical record to indicate the patient is a psychiatric inpatient being cared for in an acute care bed because of capacity or other exigent circumstances related to the COVID-19 emergency.”
-
Care for excluded inpatient rehabilitation unit patients in the acute care unit of a hospital: Acute care hospitals with excluded distinct part inpatient rehabilitation units may relocate inpatients from the excluded distinct part rehabilitation unit to an acute care bed and unit. “The hospital should continue to bill for inpatient rehabilitation services under the inpatient rehabilitation facility prospective payment system for these patients and annotate the medical record to indicate the patient is a rehabilitation inpatient being cared for in an acute care bed because of capacity or other exigent circumstances related to the disaster or emergency.”
-
Supporting care for patients in long-term care hospitals (LTCHs): LTCHs may “exclude patient stays where an LTCH admits or discharges patients in order to meet the demands of the emergency from the 25-day average length of stay requirement, which allows these facilities to be paid as LTCHs.”
-
Home health agencies (HHAs): HHAs are entitled to relief on the time frames related to OASIS Transmission. Medicare administrative contractors (MACs) may extend the auto-cancellation date of requests for anticipated payment during emergencies.
-
Provider locations: Temporarily waives requirements that out-of-state providers be licensed in the state where they are providing services when they are licensed in another state. This applies to Medicare and Medicaid.
-
Provider enrollment: Toll-free hotline for “physicians and non-physician practitioners and Part A certified providers and suppliers establishing isolation facilities” to enroll and receive temporary Medicare billing privileges. The application fee, finger-based criminal background checks, and site visits are waived; all revalidation actions are postponed; licensed providers are allowed to render services outside of their state of enrollment; and any pending or new applications from providers are expedited. Despite this waiver, the provider must still comply with the licensure and other laws of each state in which they propose to render services.
-
Medicare appeals in fee-for-service, Medicare Advantage, and Part D: For MACs and qualified independent contractors in the fee-for-service program, as well as the Medicare Advantage and Part D independent review entities, it provides extension to file an appeal; waives timeliness for requests for additional information to adjudicate the appeal; allows processing of the appeal even with incomplete appointment of representation forms but communicating only to the beneficiary; allows processing of requests for appeal that do not meet the required elements using information that is available; and allows use of all flexibilities available in the appeal process as if good cause requirements are satisfied.
Telehealth waiver
Subsequently, on March 17, CMS published an additional blanket waiver to expand access to Medicare telehealth services “so that beneficiaries can receive a wider range of services from their doctors without having to travel to a healthcare facility.”[8] This will help ensure Medicare beneficiaries, who are at a higher risk for COVID-19, are able to visit their doctor from their home, without having to go to a doctor’s office or hospital, which would put themselves and others at risk. Prior to the telehealth waiver, “Medicare could only pay for telehealth on a limited basis: when the person receiving the service is in a designated rural area and when they leave their home and go to a clinic, hospital, or certain other types of medical facilities for the service.” The telehealth waiver addresses the following elements:
-
Expansion of telehealth services: “Under this new waiver, Medicare can pay for office, hospital, and other visits furnished via telehealth across the country and including in patient’s places of residence starting March 6, 2020.”
-
Telehealth is no longer limited to rural areas: While they must generally travel to or be located in certain types of originating sites, such as a physician’s office, SNF, or hospital, for the visit, starting March 6, Medicare will make payment for Medicare telehealth services furnished to beneficiaries in any healthcare facility and in their home across the country.
-
Rate: Clinicians can bill immediately for dates of service starting March 6, 2020. “These visits are considered the same as in-person visits and are paid at the same rate as regular, in-person visits.”
-
Telehealth providers: “A range of providers, such as doctors, nurse practitioners, clinical psychologists, and licensed clinical social workers, will be able to offer telehealth to their patients.”
-
Use of phones: Patients may access their doctors using a wider range of communication tools, including telephones that have audio and video capabilities, making it easier for beneficiaries and doctors to connect.
-
Existing physician-patient relationship: “To the extent the waiver (section 1135(g)(3)) requires that the patient have a prior established relationship with a particular practitioner, HHS will not conduct audits to ensure that such a prior relationship existed for claims submitted during this public health emergency.”
-
Practitioners may furnish Medicare telehealth services from their home: CMS indicated that there are no payment restrictions on distant site practitioners furnishing Medicare telehealth services from their home. The practitioner is not required to update their Medicare enrollment with the home location.
In addition, on March 17, the Office of Inspector General (OIG) issued a policy statement “to notify physicians and other practitioners that they will not be subject to administrative sanctions for reducing or waiving any cost-sharing obligations Federal health care program beneficiaries may owe for telehealth services furnished consistent with the then-applicable coverage and payment rules,” subject to certain conditions.[9] While “routine reductions or waivers of costs owed by Federal health care program beneficiaries, including cost sharing amounts such as coinsurance and deductibles, potentially implicate the Federal antikickback statute, the civil monetary penalty and exclusion laws related to kickbacks, and the civil monetary penalty law prohibition on inducements to beneficiaries … OIG will not subject physicians and other practitioners to OIG administrative sanctions for arrangements that satisfy both of the following conditions”:
-
“A physician or other practitioner reduces or waives cost-sharing obligations (i.e., coinsurance and deductibles) that a beneficiary may owe for telehealth services furnished consistent with the then-applicable coverage and payment rules,” and
-
“The telehealth services are furnished during the time period subject to the COVID-19 Declaration.”
Furthermore, per the Drug Enforcement Administration’s (DEA) guidance, DEA-registered practitioners may, during the public emergency, issue prescriptions for controlled substances to patients for whom they have not conducted an in-person medical evaluation, provided all of the following conditions are met:
-
“The prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of his/her professional practice;
-
“The telemedicine communication is conducted using an audio-visual, real-time, two-way interactive communication system; and
-
“The practitioner is acting in accordance with applicable Federal and State laws.”[10]
This is a major change, since the Ryan Haight Act generally prohibits doctors from electronically prescribing controlled substances to patients they have not examined in person. All state prescribing rules, however, are still in force (unless waived by the state), and practitioners should ensure they review state requirements as well.
HIPAA compliance
The Office for Civil Rights (OCR) at the HHS is responsible for enforcing certain regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, to protect the privacy and security of protected health information, namely the HIPAA Privacy, Security and Breach Notification Rules (the HIPAA Rules).[11] The OCR has indicated in a notification that during the COVID-19 crisis, healthcare providers subject to the HIPAA rules and using remote communication technologies may not fully comply with the requirements of the HIPAA rules. The OCR has announced that it will “exercise its enforcement discretion and will not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency.” The OCR, in a guidance issued separately to the notification, has indicated that it would “consider all facts and circumstances when determining whether a health care provider’s use of telehealth services is provided in good faith.”[12]
Thus, the OCR will consider “conduct or furtherance of a criminal act, such as fraud, identity theft, and intentional invasion of privacy”; “further uses or disclosures of patient data transmitted during a telehealth communication that are prohibited by the HIPAA Privacy Rule (e.g., sale of the data, or use of the data for marketing without authorization)”; “violations of state licensing laws or professional ethical standards that result in disciplinary actions related to the treatment offered or provided via telehealth (i.e., based on documented findings of a health care licensing or professional ethics board)”; or “use of public-facing remote communication products.”
As a result, a provider that wants to use audio or video communication technology to provide telehealth to patients during the COVID-19 crisis can use any non-public–facing remote communication product that is available to communicate with patients.[13] “This exercise of discretion applies to telehealth provided for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19.” The OCR has defined “non-public facing” remote communication as a product that, as a default, allows only the intended parties to participate in the communication.[14] “Non-public facing remote communication products would include, for example, platforms such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, or Skype. Such products also would include commonly used texting applications such as Signal, Jabber, Facebook Messenger, Google Hangouts, Whatsapp, or iMessage. Typically, these platforms employ end-to-end encryption, which allows only an individual and the person with whom the individual is communicating to see what is transmitted. The platforms also support individual user accounts, logins, and passcodes to help limit access and verify participants…In contrast, public-facing products such as TikTok, Facebook Live, Twitch, or a public chat room are not acceptable forms of remote communication for telehealth because they are designed to be open to the public or allow wide or indiscriminate access to the communication. For example, a provider that uses Facebook Live to stream a presentation made available to all its patients about the risks of COVID-19 would not be considered reasonably private provision of telehealth services. [Thus, a] provider that chooses to host such a public-facing presentation would not be covered by the Notification and should not identify patients or offer individualized patient advice in such a livestream.”
State waivers
Federal authorities have issued waivers or relief from a variety of requirements. In response to the crisis, some states have also issued waivers. For example, in Florida, physicians, physician assistants, and advanced registered nurse practitioners who hold a valid, clear, and unrestricted license in another US state, district, or territory are temporarily allowed to furnish telehealth services to persons in Florida.[15] Florida also allows licensed physicians, physician assistants, and advanced registered nurse practitioners who have designated themselves as a “controlled substance prescribing practitioner” in accordance with Florida law to issue renewal prescriptions for a controlled substance to existing patients for the purpose of treating chronic nonmalignant pain without the need to conduct an in-person physician examination, instead substituting it for one conducted through telehealth.
Medicaid waivers
Additionally, in keeping with its commitment to ensure states have the necessary tools to respond to COVID-19, CMS has approved state Medicaid waiver requests under Section 1135 of the Social Security Act.[16] These waivers offer new flexibilities to providers to focus their resources on combatting the outbreak and providing the best possible care to Medicaid beneficiaries in their states. “Many of the waivers temporarily lift prior authorization requirements, permit use of alternative care settings and ease provider enrollment requirements to facilitate beneficiaries’ access to care, and relax timelines for fair hearings and other requirements.” As of April 9, CMS has approved waivers applications for 47 states, the District of Columbia, and the U.S. Virgin Islands.[17]
Conclusion
Combined actions of both federal and state governments offer more flexibility to providers to respond to the COVID-19 crisis. Through Section 1135 waivers, HHS and CMS allow patients to get access to care faster and help healthcare providers treat more patients. The telehealth waiver, in particular, will help protect individuals at a higher risk for COVID-19 infection and limit the spread of the virus at the same time. In light of this unprecedented situation, providers and patients may now use platforms such as FaceTime, Facebook Messenger video chat, Google Hangouts video, WhatsApp video chat, or Skype without risking violating HIPAA rules. In addition, states are also intervening by issuing their own waivers and by requesting CMS to issue Medicaid waivers.
Despite these waivers and statements by enforcement authorities of loosened enforcement in certain specified areas, the Department of Justice and the OIG have stated explicitly that they would be enhancing their enforcement efforts to look for the persons who will take advantage of the situation. Waivers are not a “get out of jail free card,” and the basics still matter (e.g., sufficient documentation, appropriate coding, medical necessity). Waivers are specific, not blank checks, and providers/suppliers must be careful to comply with the specifics of the waivers and ensure that they can prove that they did so if called upon to prove compliance at a later date.
Takeaways
-
The Centers for Medicare & Medicaid Services (CMS) has issued Section 1135 blanket waivers to respond to the COVID-19 crisis.
-
CMS has issued a telehealth waiver to reduce the spread of the virus and protect individuals who are at a higher risk for COVID-19.
-
The Office of Inspector General will not subject physicians and other practitioners to administrative sanctions for reducing or waiving any cost-sharing obligations when providing telehealth services.
-
The Office for Civil Rights will not impose penalties for noncompliance with the Health Insurance Portability and Accountability Act against providers acting in good faith in connection with telehealth services during the COVID-19 crisis.
-
Upon states’ requests, CMS has approved Medicaid waivers to offer more flexibility.