Chapter 8: Medical Privacy
Telemedicine and the Pandemic Rule Changes
During COVID-19 the OCR allowed nonpublic-facing videoconferencing even if it did not fully meet HIPAA rules. Nonprivacy changes (CMS reimbursement, DEA suspending Ryan Haight in-person exam rules, cross-state licensing) further accelerated telemedicine.
An estimated one in three adults used telemedicine during the pandemic. A key driver was the OCR allowing Nonpublic-facing technology (secure log-in videoconferencing) even where it did not meet all Privacy, Security, or breach-notification requirements.
- Payment: the Centers for Medicare & Medicaid Services allowed reimbursement for telemedicine visits (previously limited to rural areas, mental health, or substance use)
- Controlled substances: the DEA suspended the Ryan Haight Act in-person exam requirement so qualified prescribers could prescribe regardless of patient location
- Licensing: states issued temporary cross-state licenses and use of the IMLC grew nearly 50 percent
Key terms - quick answers
What is “Nonpublic-facing technology”?
One-to-one or one-to-few videoconferencing with secure log-in that the OCR permitted during the public health emergency even if not fully HIPAA-compliant.
What is “Ryan Haight Act”?
The Online Pharmacy Consumer Protection Act requiring an in-person medical exam before prescribing a controlled substance, which the DEA suspended during the pandemic.
What is “IMLC”?
The Interstate Medical Licensure Compact, whose use grew nearly 50 percent during the pandemic to ease cross-state physician licensing.