The End of the Public Health Emergency: What It Means for Telehealth

by Emily A. Johnson, JD •

Do you remember where you were when the COVID-19 public health emergency (PHE) was declared on Jan. 31, 2020? While it may seem like yesterday, you would be forgiven for not recalling your exact location over three years ago, during what felt like an incredible whirlwind for the healthcare industry.

One possible location you may have found yourself in was a meeting room, quickly trying to make adjustments to how you would deliver care during the pandemic. What emerged was a pleasant surprise: Not only did healthcare providers implement telehealth to respond to the pandemic, but it was largely successful—and popular.

But time marches on, and the PHE—due to advances in COVID-19 treatments and widespread availability of vaccines—ended in early May 2023. The end of the PHE signals many changes in the healthcare industry, but among the most important will be changes to the use of telehealth. For those looking to avoid another scramble, this article will assist in a successful transition to the post-PHE telehealth era.

Platform for Telehealth

One of the first telehealth changes taking place, as of the day the PHE expired, is the end of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforcement discretion regarding the use of HIPAA-compliant platforms when providing telehealth services. From March 17, 2020, until May 11, 2023, the OCR stated that any non-public-facing platform could be used for telehealth because it wouldn’t be imposing penalties on providers who followed this.

For clinicians, that meant any number of routes could be used to conduct a telehealth service. So long as the platform didn’t post the service to a public area of the internet, such as someone’s Facebook page, it could be used for telehealth.

This enforcement discretion has ended, however, and clinicians will need to use HIPAA-compliant platforms and have a business associate agreement in place with that platform’s operators. On April 11, 2023, the OCR released a statement that it would institute a 90-calendar-day transition period for covered healthcare providers to come into compliance with HIPAA rules. The OCR’s enforcement discretion will continue from the period of May 12, 2023, until Aug. 9, 2023, after which the OCR will no longer exercise enforcement discretion and will begin once again imposing penalties for noncompliance.

Several platforms are available, so if you aren’t sure which one you use, seek counsel to ensure your platform and the business associate agreement are HIPAA compliant under post-PHE rules.