HIPAA Security, AI Strategy, and OTP Telehealth Billing – The February Newsletter is Here!
| HHS Proposes Major Updates to HIPAA Security Rule to Strengthen Cybersecurity For the first time in two decades, the Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule to better protect electronic protected health information (ePHI) from increasing cyber threats. The Notice of Proposed Rulemaking (Proposed Rule) seeks to modernize security safeguards in response to a significant increase in large-scale healthcare breaches caused by hackers and ransomware between 2018 and 2023. If enacted, the rule would require all HIPAA-regulated entities to enhance cybersecurity practices, including maintaining an up-to-date inventory of technology assets, conducting annual risk analyses, implementing stronger patch management policies, and using multi-factor authentication. Additionally, covered entities would be obligated to encrypt ePHI, perform vulnerability scans and penetration testing, and ensure more rigorous oversight of business associates handling sensitive health data. As remote care platforms manage vast amounts of ePHI, these new cybersecurity rules could significantly impact telehealth services. The Proposed Rule also emphasizes stricter compliance documentation and monitoring, including mandating a 72-hour disaster recovery plan, annual compliance audits, and stronger incident response protocols. Notably, business associates would be required to notify covered entities of any contingency plan activation within 24 hours. The proposed rule also seeks comments on emerging technologies such as artificial intelligence, quantum computing, virtual and augmented reality, and HIPAA’s role in regulating these emerging technologies. For more information, read the complete text of the Notice of Proposed Rulemaking. Comments on the proposed rule are due by March 7, 2025 and can be submitted through the federal register. HHS Releases AI Strategic Plan to Enhance Healthcare and Public Health The Department of Health and Human Services (HHS) has unveiled its Strategic Plan for the use of Artificial Intelligence (AI) in Health, Human Services and Public Health. The plan focuses on advancing AI innovation while ensuring safety, equity, and accessibility. With AI’s potential to revolutionize medical breakthroughs, improve care delivery, and optimize public health systems, HHS emphasizes responsible implementation to mitigate risks and uphold ethical standards. The Plan identifies four key priorities: – Catalyze health AI innovation and adoption to unlock new ways to use AI to improve people’s lives; – Promote trustworthy AI development and ethical and responsible use to avoid potential harm; – Democratize AI technologies and resources to promote equitable access for all; and – Cultivate AI-empowered workforces and organizational cultures to allow staff to make the best use of AI. To learn more, visit the HHS AI Strategic Plan and explore how AI is shaping the future of health and human services. CMS Provides Billing Instructions for Opioid Treatment Programs (OTP) Telecommunications Add-On Codes In the 2025 Final Physician Fee Schedule, the Centers for Medicare & Medicaid Services (CMS) finalized important updates for Opioid Treatment Programs (OTPs) aligning with regulations previously adopted by the Substance Abuse and Mental Health Services Administration (SAMHSA). These changes aim to enhance access to care for individuals with opioid use disorder (OUD) by expanding telehealth options. Key updates include: – Periodic assessments may now be conducted via audio-only technology on a permanent basis if live video is unavailable, as long as they meet all applicable SAMHSA and DEA requirements. – The OTPs intake add-on code (G2076) can now be billed when using live video for the initiation of methadone treatment. As a result of these changes, CMS has updated its Opioid Treatment Program (OTP) webpage to reflect proper billing practices. OTPs should use the following HCPCS add-on codes when treating eligible patients: – G2076 – Used to initiate buprenorphine or methadone treatment via two-way interactive audio-video or audio-only technology when video is unavailable. – G2077 – Covers periodic patient assessments via audio-only technology when video is unavailable. – G2080 – Applies to additional counseling or therapy provided via audio-only technology when video is unavailable. For more details on the finalized policy, review the 2025 Final Physician Fee Schedule. To learn more about billing and G-codes for OTPs, visit the CMS Opioid Treatment Program webpage. In Case You Missed It: CCHP Released “Federal Telehealth Policy FAQs” Last week, the Center for Connected Health Policy (CCHP)’s newsletter included a summary of frequently asked questions (FAQs) along with CCHP’s responses, based on requests for technical assistance that CCHP has recently received as well as questions asked during the January 9th CCHP and National Consortium of Telehealth Resource Centers (NCTRC) hosted webinar on federal telehealth policy. Key Topics Covered in CCHP’s FAQ resource include: – Medicare Telehealth Waivers Extended: The recent Continuing Resolution (HR 10545) extends key Medicare telehealth waivers until March 31, 2025, including waived originating site location requirements, coverage for audio-only visits, expanded provider eligibility, and flexibility for mental health services. – Audio-Only Telehealth Changes: CMS removed specific audio-only codes (99441-99443) in the 2025 Physician Fee Schedule (PFS) but clarified that codes 99202-99215 can be used with appropriate modifiers for reimbursement. – In-Person Mental Health Visit Requirement Delayed: The waiver delaying the in-person visit requirement for telehealth mental health services has been extended but may return on April 1, 2025, if no further action is taken. – New Telehealth Codes Not Adopted by Medicare: CMS declined to adopt most of the AMA’s new 98000-series telehealth codes, except for 98016, which replaces G2012. Medicaid and private payers may handle these codes differently. – Controlled Substance Prescriptions via Telehealth: The DEA extended its waiver through 2025, allowing telehealth prescribing of controlled substances without a prior in-person visit. However, state-specific prescribing rules may still apply. Additionally, the DEA has adopted two new final rules creating exceptions from in-person visit requirements for veterans’ affairs and prescribing buprenorphine. They have also proposed a rule for a special telemedicine registration. Uncertainty Surrounding CMS Telehealth Guidance Amid Administrative Delays While CCHP does it’s best to provide answers to the majority of questions we receive, the answer to some questions still remains unclear as we await further guidance from CMS. Compounding the uncertainty, an article posted to the Post-Acute and Long-Term Care Medical (PALTmed) Association website on January 27, 2025 indicates that CMS has yet to release temporary guidance for Medicare administrative contractors (MACs) on the telehealth billing extensions contained in HR 10545 (many of which are bulleted above). The delay, coupled with the new administration’s two-week health communication freeze, has added to the uncertainty and could mean a longer wait for clarity on lingering telehealth questions. CMS is only making exceptions for “mission critical” announcements, leaving it uncertain whether telehealth guidance will be issued before March 31, 2025 when the current telehealth extensions are set to expire. For more details, access CCHP’s full FAQ newsletter write-up. CURRENT FEDERAL TELEHEALTH POLICY FAQs Latest Developments in CCHP’s Telehealth Policy Finder and Policy Trend Map CCHP’s Telehealth Policy Finder look-up tool and Policy Trend Maps were updated throughout the past month based on the latest information from our ongoing state telehealth policy tracking. The latest states to be updated include California, District of Columbia, Georgia, Iowa, Massachusetts, Michigan, Mississippi, Missouri, New York, Nebraska, Nevada, New Hampshire, New York, North Carolina, Oregon, Pennsylvania, South Dakota, Tennessee, Texas, Virginia, Washington, and Wisconsin. Over the past month, multiple states made changes to their telehealth policies in an array of policy areas, including their Medicaid programs, professional regulations, and cross-state licensing. Highlighted changes from this group of states include: – CALIFORNIA: California Medicaid (Medi-Cal) updated their Telehealth Manual to include coverage of e-consult code 99452, defined as interprofessional telephone/internet/electronic health record referral services provided by a treating/requesting physician or other qualified health care professional that includes 30 minutes of time. The manual was also updated to remove references to HCPCS code G2012 from the brief virtual communications and check-ins section. Additionally, the Evaluation and Management Manual was updated to remove the requirement that RPM should be limited to individuals over the age of 21. Medi-Cal also released a Provider News Update in September 2024 stating that Federally Qualified Health Centers (FQHC), Rural Health Clinics (RHC), Indian Health Services – Memorandum of Agreement (IHS-MOA) and Tribal FQHC providers must submit claims for telehealth services with the applicable telehealth modifier. Finally, in December 2024 a Medi-Cal News Update, addressed billing codes for the Justice-Involved Reentry Initiative. It specifies that the services can be rendered via telehealth. – DISTRICT OF COLUMBIA (DC): The DC Department of Behavioral Health issued an emergency regulation to specify that community support services may be provided via audio-only or audio-visual telemedicine. Audio-only telemedicine services are limited to six (6) units per one hundred eighty (180) day period, unless otherwise authorized by the Department pursuant to the Department’s billing manual. Telemedicine is specified as a modality eligible for reimbursement for certain mental health rehabilitation services when its use is supported by evidence-based practices. Two rules were also finalized by the Department of Health Care Finance (one dealing with Governing Home and Community Based Services Waiver for Individuals and Family Support, and the other related to Home and Community Based Waiver for Individuals with Intellectual and Developmental Disabilities). The rules expand services for persons with developmental disabilities in the Medicaid Home and Community-Based Services programs. It allows the use of remote support services that employ technology. Remote supports are defined as the provision of supports by staff of an appropriately certified provider at a remote location and/or through an electronic method of service delivery who are engaged with individual(s) through equipment with the capability for live two-way communication. DC also passed B 25-0287 enacting the Counseling Compact. – MISSOURI: Missouri HealthNet Division (MHD) announced through a Provider Bulletin that effective December 22, 2024, they will accept place of service (POS) codes 10 and 27 on Telemedicine claims. POS 10 indicates that services are provided to the patient in their home. POS 27 indicates that services are provided to the patient at an outreach site/street, such as a non-permanent location on the street or found environment. POS 02 will indicate that telemedicine services are being provided to a patient outside of their home, in a location such as a hospital or other facility. – NEW YORK: New York Medicaid issued an update in October that expanded reimbursement of remote patient monitoring to include CPT code 99457, which is the first 20 minutes of remote physiologic monitoring treatment management services by clinical staff, a physician or other qualified health care professional in a calendar month requiring interactive communication with the patient/caregiver. Additionally, the October Update also provided for reimbursement of eConsults (also known as electronic consultations or interprofessional consultations) between a dentist and another medical health care professional, including a physician, physician assistant (PA), nurse practitioner (NP), midwife (MW). In August, New York Medicaid also clarified through an Update that doula services can be administered in-person or via telehealth. Finally, the Office for People with Developmental Disabilities (OPWDD) announced that crisis services provided by individuals with developmental disabilities (CSIDD) providers who provide clinical coverage for CSIDD cases outside of their program catchment area may use remote delivery of CSIDD through telephonic or other technology in accordance with State, Federal, and Health Insurance Portability and Accountability Act (HIPAA) requirements, upon approval from OPWDD. – NORTH CAROLINA: North Carolina Medicaid updated their Billing and Policy Manual for Birth to Three Non-School District Providers to clarify that speech language pathologist services can be provided via telemedicine if it meets the therapy services requirements in the Telemedicine manual. The service must be provided by means of “real-time” interactive telecommunications system. To ensure that a patient’s care needs are assessed by a health care provider in person and the provider must have a face-to-face visit within the first 30 days and every 90 days thereafter. – OREGON: Oregon Medicaid revised their school-based health services (SBHS) administrative code, to include a section specifically on telehealth. It states that the authority may reimburse SBHS delivered by telehealth under certain criteria, including obtaining consent. It states that the authority must provide reimbursement at the same rate as if the service was delivered in person and allows either the GT or 93 modifier (for audio only) to be used. It also creates special allowances for telehealth in the event of a national or state declaration of emergency. – PENNSYLVANIA: Pennsylvania Medicaid revised their School-Based ACCESS Provider Handbook to specify that while the Department of Health Services (DHS) has historically expressed its intent for medical assistance (MA) services to be rendered to MA beneficiaries in person, some services may be delivered using telehealth. They direct providers to refer to the states general telehealth policy for more information. Pennsylvania Medicaid also specifies that telehealth place of service (POS) indications are distinguished by where the student was at the time of service, regardless of where the direct service provider was at the time of service. Whenever a service is delivered via telehealth to a student who is in their own home, POS 10 is to be used. Whenever a service is delivered via telehealth to a student who is somewhere other than their own home, POS 02 is to be used. This may include situations where the student is physically in the school setting and the direct service provider uses telehealth to remotely provide the service. – TEXAS: Texas Medicaid updated their Clinics and Other Outpatient Facility Services Handbook to indicate telemedicine and telehealth services may be provided for end stage renal disease (ESRD) clients if clinically appropriate and safe, as determined by the provider, and agreed to by the person receiving services. Whenever possible, The Texas Health and Human Services Commission (HHSC) encourages face-to-face interactions, such as an in-person visit. Texas Medicaid also updated their Telecommunications Manual to update telemonitoring guidelines, including adding federally qualified health centers and rural health clinics as home telemonitoring providers and updating prior authorization requirements. – VIRGINIA: Virginia Medicaid added telehealth and telemedicine information to their Developmental Disabilities (DD) Waiver Services Manual Chapter, including that for Independent Living Supports, up to 25% of monthly services can be billed as telemedicine; limited to no more than 2 hours per day. Virginia Medicaid also released a bulletin altering their continuous glucose monitoring criteria to align with InterQual CGM criteria which are derived from a systematic, continuous review and critical appraisal of the most current evidence-based literature from various sources, including American Diabetes Association (ADA), Centers for Disease Control and Prevention (CDC), Centers for Medicare and Medicaid Services (CMS), and the National Institute for Health and Clinical Excellence (NICE). Previously patients were required to have type 1, 2 diabetes or be pregnant and injecting insulin. – WASHINGTON: Washington State Health Care Authority (Apple Health) updated their Applied Behavior Analysis (ABA) Program Billing Guide to specify (among other things) that CPT code 97156 (used by Applied Behavioral Analysis providers) is allowed via telemedicine. Apple Health also replaced HCPCS code G2012 with CPT code 98016 (brief synchronous communication technology evaluation and management service). This replacement follows Medicare’s replacement of the same code with 98016. Apple Health also made additional updates to their telemedicine and store and forward telemedicine policy guides, including replacing the teledermatology information with new policy information for e-consults including best practices, payment and billing, and documentation requirements. A permanent rule was also passed by the Insurance Commissioner to update health insurance-related regulations to be consistent with enacted legislation and revised the definition of an established relationship for purposes of audio-only consistent with recent statutory changes. Finally, the Washington Medical Commission rescinded their previous telemedicine policy through a memo, because it was replaced by the Uniform Telemedicine Act which went into effect June 6, 2024. A new Telehealth Policy Statement was also adopted by the Chiropractic Quality Assurance Commission and permanent rules adoptedregarding certified behavioral health support specialist standards, which includes a requirement that specialists providing clinical services through telemedicine complete a one-time telemedicine training. Permanent rules stating that a certified dietitian or nutritionist may provide services in person or through telehealth to residents of Washington, as appropriate, based on the needs of the client were also adopted. Given the nuanced and varied approaches states are taking with their telehealth policies, please reference CCHP’s telehealth Policy Finder to link to additional details and access each states’ policies in their entirety. Study Highlights Barriers to Expanding CMS Hospital-at-Home Program A new study [subscription required] conducted by researchers from the University of California, Los Angeles (UCLA), published in JAMA explores the adoption of the Centers for Medicare and Medicaid Services (CMS) acute hospital-at-home program, which allows patients to receive acute medical care at home rather than in a traditional hospital setting. The program launched by CMS in November 2020, grants hospitals waivers to receive full diagnosis-related group (DRG) payments for hospital-at-home admissions. This initiative aims to address hospital capacity challenges exacerbated by the COVID-19 pandemic while providing safe care for non-COVID-19 patients. All hospital-at-home programs under the waiver operate as hybrid care models, blending in-person and telehealth services. The waiver requires at least two in-home visits per day, typically conducted by nurses or mobile integrated healthcare (MIH) paramedics, who coordinate care via telemedicine with supervising physicians. Originally set to expire in December 2022, the waiver was extended through March 2025 by HR 10545 (American Relief Act, 2025) that also extended other Medicare telehealth flexibilities. The study found that 98% of post-extension hospitals adopting the program were in metropolitan areas, with participation highest in the Northeast and West. Researchers highlight that expanding hospital-at-home programs to non-teaching and rural hospitals will require targeted incentives and strategies, especially as the hybrid model demands both physical and virtual infrastructure. Congress and CMS will need to address these challenges to broaden access and ensure equitable adoption across diverse hospital types. For more information, read the full study in JAMA [subscription required]. What’s New at CCHP this Month? CCHP is continually working to create helpful informational content to keep those interested in telehealth and related policies up to date via our policy finder, informational factsheets, webinars, reports and email blasts. As you may already be aware, CCHP regularly distributes a single topic specific email every Tuesday titled “Telehealth Tuesdays”. If you are not yet on our distribution list to receive these emails, and would like to be added, you can do so by registering on the CCHP website. Quick links to recently curated and featured insightful topics in our Telehealth Tuesday email blasts: FEBRUARY 4, 2025: Your Frequently Asked Questions Regarding Current Telehealth Policy covering questions and answers to some of the more frequently asked questions regarding current federal telehealth policy that CCHP has received. Questions cover current CMS policy, including the extended telehealth flexibilities currently set to end March 31, 2025 and recent DEA final and proposed regulations. JANUARY 28, 2025: Net Neutrality Ends (Again!) – What’s New & What’s Next covering net neutrality, which is the concept of ensuring an open and equally accessible internet through regulating internet service providers (ISPs) similar to public utilities. On January 2, 2025, a three-judge panel of the U.S. Court of Appeals for the Sixth Circuit ruled that the Federal Communications Commission (FCC) lacks authority to reinstate net neutrality rules preventing broadband providers from limiting consumer internet access, such as through blocking or slowing down speeds for certain services and websites. JANUARY 21, 2025: New DEA Telehealth Prescribing Rules Released covering the U.S. Drug Enforcement Administration (DEA) three new rules impacting prescribing controlled substances via telehealth, including the long-awaited regulations regarding establishing a telehealth prescribing registration process that was first mandated by Congress back in 2008. In addition, the DEA also finalized two additional rules regarding buprenorphine and Veterans Affairs. JANUARY 14, 2025: Federal Medicare Telehealth Waivers covering the extended telehealth flexibilities included in HR 10545 signed by President Biden on December 21, 2024. Included in that bill was an extension of the major statutory telehealth waivers, (such as waiving geographic and originating site requirements and maintaining the expanded eligible provider list for telehealth services), but only until March 31, 2025. JANUARY 7, 2025: RTRC Telehealth Policy Brief Highlights Need for More Health Equity Focused Research covering the Rural Telehealth Research Center (RTRC)’s release of a Research and Policy Brief titled, The Role of Relaxed Telehealth Policy on Health Equity in Telehealth Utilization and Outcomes During the COVID-19 Public Health Emergency: A Living Systematic Review. The brief underscores the significant telehealth policy changes that have occurred since the beginning of the COVID-19 pandemic as the foundation for enabling the ability to better understand the variety of implications of increased telehealth use, such as access to care, health outcomes, and cost. For this study in particular, the RTRC sought to conduct a systematic review of the ways in which telehealth has been shown to address health disparities. In addition to our featured topics in CCHP’s Telehealth Tuesday emails we have also released the following valuable resources: On January 9, 2025 CCHP recorded a live webinar covering federal telehealth policy in 2025. Co-hosted with the National Consortium of Telehealth Resource Centers (NCTRC), this webinar examined recent actions Congress has taken, including the passage of HR 10545 which extended the Medicare telehealth flexibilities until March 31, 2025 and the newly finalized DEA rules and proposed regulation related to prescribing controlled substances. The recording can be accessed on CCHP’s webinars webpage, and the PowerPoint slides are also available. FEDERAL LEGISLATION CCHP typically highlights key federal telehealth legislation we are tracking in this section. However, since the start of the 2025 legislative session, we have not identified any new federal bills addressing telehealth. We will continue monitoring for relevant developments and provide updates in future newsletters as legislation is introduced.~~~ STATE LEGISLATION HAWAII HB 557 / SB 1281 – Updates Hawaii’s laws on telehealth services to conform with federal Medicare regulations including adopting the definition for “interactive telecommunication system.” Requires the Insurance Commissioner to report to the Legislature on reimbursements claimed in the previous year for certain telehealth services. (Status: 1/23/25 – Introduced and passed first reading) INDIANA SB 473 – Allows a prescriber to prescribe an agonist opioid through telehealth services for the treatment or management of opioid dependence if certain conditions are met. Current law allows only a partial agonist to be prescribed through telehealth. (Status:1/13/25 – First reading, referred to Committee on Health and Provider Services) MARYLAND SB 372 – Permanently includes audio-only within the definition of telehealth in the states’ private payer telehealth law. It would also make permanent a provision that requires payers to provide reimbursement for telehealth on the same basis and at the same rate as if the health care services were delivered in person. Currently both provisions will expire on June 30, 2025 (unless this law is enacted). (Status: 1/17/25 – First Reading) OKLAHOMA HB 1915: Establishes regulations for the deployment and use of artificial intelligence (AI) in healthcare. It defines key terms and mandates that AI devices be used only by qualified individuals in compliance with specific guidelines. Deployers must implement a Quality Assurance Program, review AI-generated data, and allow authorized users to amend or overrule outputs. The bill requires regular performance evaluations, proper documentation, and the creation of an AI governance group. Deployers must maintain an updated AI inventory and continuously monitor device performance. The State Department of Health is tasked with enforcing these provisions. (Status: 2/3/25 – First Reading) OREGON HB 2222 – Directs the Oregon Health Authority (OHA) to create and maintain a registry of mobile integrated health care providers. OHA is also given the authority to establish billing codes and provide technical support in submitting claims for reimbursement for services provided by mobile integrated health care providers. (Status: 1/17/25 – Referred to Behavioral Health and Health Care with subsequent referral to Ways and Means) NEW MEXICO SB 12 – Allows out of state health care providers who have not obtained a New Mexico Telehealth License to provide second opinions and consultations for treatment to patients in New Mexico. (Status: 1/21/25 – Sent to Senate Health and Public Affairs Committee & Senate Judiciary Committee) TEXAS SB 815 – Prohibits utilization review agents from relying solely on AI-based algorithms to deny, delay, or modify healthcare services based on medical necessity or appropriateness. Only a physician or licensed healthcare provider may make such determinations. Additionally, the bill grants the commissioner authority to audit and inspect an agent’s use of AI in the utilization review process. (Status: 1/16/25 – Filed) WASHINGTON SB 5395 – Stipulates that a health plan and any contracted health care benefit manager that uses an artificial intelligence, algorithm, or other software tool for the purpose of prior authorization or prior authorization functions, based in whole or in part on medical necessity, shall meet certain requirements related to transparency and accountability. (Status: 2/7/25 – Hearing in the Senate Committee on Health & Long-Term Care) |