Health Care Providers May Now Use Apple FaceTime, Facebook Messenger Video Chat, Google Hangouts Video and Skype to Provide Telehealth to Patients During COVID-19 Public Emergency

On March 18, 2020, the HHS Office for Civil Rights (“OCR”) announced that covered health care providers (“providers”) may now use Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, and Skype to provide telehealth to patients during the COVID-19 nationwide public health emergency without fear or the risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules (“OCR Notice”).  Public facing applications, such as Facebook Live, Twitch, and TikTok, however, are specifically excluded as applications that may be used to provide telehealth under the OCR Notice.

So what does this mean for providers?

Under the OCR Notice, the OCR stated that it will not exercise its enforcement discretion to impose penalties for noncompliance with the HIPAA rules to the extent providers use these applications to provide telehealth to patients for any reason.  Hence, the use of these applications is not limited to the provision of telehealth related to the diagnosis and treatment of health conditions related to COVID-19.

What guidance is there for providers who want to use these applications to provide telehealth?

The OCR stated that providers should (1) ensure that all available encryption and privacy modes are enabled when using these applications to provide telehealth, (2) notify patients that there are privacy concerns with the use of such applications, and (3) use HIPAA-compliant telehealth applications whenever possible from vendors who will enter into Business Association Agreements (“BAA”).  To that end, the following vendors were listed in the OCR Notice as vendors who represented that they provide HIPAA-compliant video communication products and that they will enter into BAAs.

• Skype for Business
• Updox
• VSee
• Zoom for Health Care
• me
• Google G Suite Hangouts Meet.

Note: OCR stated that it has not reviewed the BAAs offered by any of these vendors, and that the list does not constitute an endorsement, certification, or recommendation of specific technology, software, applications, or products.