skip to main content


COVID-19: OCR HIPAA Enforcement Discretion for Telehealth

March 19, 2020 - Updated March 20, 2020

Following CMS’ announcement of expanded Medicare and Medicaid coverage for telehealth, HHS’ Office for Civil Rights (“OCR”) announced on March 17 that it will exercise its enforcement discretion and will not impose penalties for noncompliance with HIPAA rules against health care providers providing good faith telehealth during the COVID-19 national public health emergency. See more at

1. Telehealth Technologies

In its notice, OCR sanctions the use by covered health care providers of any non-public facing audio or video remote communication product that is available to communicate with patients to provide telehealth during the public health emergency. And OCR states that it will exercise its enforcement discretion for any good faith provision of telehealth services during the public health emergency, whether for diagnosing and treating COVID-19 and related conditions, or to assess and treat any other medical condition such as a sprained ankle, psychological or dental evaluation, in the exercise of professional judgment.

OCR specifically permits the use of certain popular, public facing video chat applications, including Apple FaceTime, Facebook Messenger video chat, Skype, and Google Hangouts video, which are all available with private, non-public video components. However, OCR also specifically disallows the use of certain other public facing video apps such as TikTok, Facebook live, and Twitch, which should not be used for providing telehealth.

2. Business Associate Agreements

Providers can of course continue to comply with HIPAA and engage technology vendors that are HIPAA-compliant through BAAs, but OCR will not impose penalties against a covered entity for lacking a BAA with a video communication vendor relating to the good faith provision of telehealth during the COVID-19 public health emergency. OCR also published a list of some vendors that are willing to enter a BAA to comply with HIPAA, which is available through accessing the above link.

3. Telehealth - Best Practices

If a provider chooses to utilize a video communication product that may not comply with HIPAA (e.g. Apple FaceTime, Facebook Messenger video chat, Skype, and Google Hangouts video) or for which the vendor will not execute a BAA, we reiterate OCR’s suggestion that the provider notify its telehealth patients of the potential heightened risks to privacy. For example, we believe that a verbal notice of potential privacy risks at the start of a telehealth session would suffice. We also remind providers to continue to follow their administrative and physical safeguards to the extent possible, like making sure the provider is not providing telehealth services in a public place or in a location where other non-clinical provider staff would be part of the conversation. Providers can also encourage their telehealth patients to not receive telehealth in a public place, and to be mindful of who else can see and hear their conversation with their health care provider.

3/20/20 - UPDATE:  OCR Issues Guidance (FAQs) on HIPAA Enforcement Discretion for Telehealth

On Friday March 20, 2020, OCR issued guidance following its recent notification of HIPAA enforcement discretion for the provision of telehealth during the COVID-19 public health emergency. The guidance is in the form of Frequently Asked Questions (“FAQs”) and addresses which parts of the HIPAA Rules are: (i) included in the enforcement discretion; (ii) which covered entities are excluded from the OCR’s enforcement discretion; (iii) whether the enforcement discretion of OCR extends beyond HIPAA to other patient privacy rules; and (iv) clarifies how providers should interpret the guidance. The FAQs can be read in their entirety at:

From our perspective, the big new takeaways are as follows:

  • Telehealth services may be provided synchronously or asynchronously using videoconferencing, landline and wireless audio only communication, store-and-forward images, text messaging, and other remote communication technologies. However, be sure that your local regulations, such as for state Medicaid plans, similarly permit the use of such technologies;
  • OCR’s enforcement discretion only applies to health care providers that are providing telehealth services in good faith during the public health emergency, and not health insurance companies that pay for telehealth services only;
  • All HIPAA Rules are included in the enforcement discretion, including the Privacy Rule, the Security Rule, and the Breach Notification Rule;
  • OCR’s enforcement discretion does not apply to violations of 42 CFR Part 2, and instead providers should consult SAMHSA’s guidance regarding the medical emergency exception under Part 2: This guidance reminds providers that Part 2’s medical emergency exception permits the disclosure of patient information to medical personnel, without patient consent, to the extent necessary to a meet medical emergency in which the patient’s prior informed consent cannot be obtained; and
  • Examples of “bad faith” provision of telehealth services include conduct in furtherance of a criminal act (fraud, identity theft, invasion of privacy), further using or disclosing patient data in violation of the HIPAA Rules (sale of data, use for marketing without authorization), violating state licensing laws or professional conduct standards in the provision of telehealth services, or using public facing remote communication products like TikTok, Facebook live, or Twitch to provide telehealth.

The FAQs also confirmed a number of aspects of the earlier guidance, including:

  • The enforcement discretion applies to the provision of any telehealth services the health care provider believes can be provided during the public health emergency, whether that is for diagnosis and treatment of COVID-19 or not;
  • “Non-public facing” remote communications platforms like Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, Skype, and commonly used texting applications such as Signal, Jabber, Facebook Messenger, Google Hangouts, Whatsapp, or iMessage are acceptable, because these apps typically employ end-to-end encryption; and
  • To the extent possible, providers should always use private locations and patients should not receive telehealth services in public or semi-public settings without patient consent. When this is not possible, providers should remember to keep their voices down, avoid using speakerphone, and recommend to their patients to move a reasonable distance away from others before discussing PHI.
© Shipman & Goodwin LLP 2021. All Rights Reserved.