BSCR Firm News/Blogs Feed Jul 2020 00:00:00 -0800firmwise and Cybersecurity Amid the Pandemic Jun 2020Healthcare Law Blog<div>&ldquo;The New Normal.&rdquo; &ldquo;Social distancing.&rdquo; &ldquo;Stay home.&rdquo; &ldquo;Unprecedented.&rdquo;</div> <div>&nbsp;</div> <div>You&rsquo;ve probably heard the above phrases more than once, twice, or fifty times over the past couple of months during the COVID-19 pandemic.&nbsp; Almost all aspects of life are changing and/or have changed, including the way in which we are seeking medical care.<br /> <br /> Indeed, telehealth is rapidly becoming a&nbsp;new normal&rdquo; for routine healthcare visits, a market predicted to reach <a href="">more than $130 billion worldwide by 2025</a> and <a href="">$10 billion by the end of 2020</a>. What is telehealth?&nbsp;According to the U.S.&nbsp;Department of Health and Human Services, Office for Civil Rights, it is &ldquo;<a href="">the use of electronic information and telecommunications technologies to support and promote long-distance clinical healthcare, patient and professional health-related education, and public health and health administration</a>.&rdquo;&nbsp; <br /> <br /> Examples of telehealth and its technologies include: mobile and/or wireless health platforms, real-time interactive services, such as teleconsultation and telenursing, and remote patient monitoring (such as for diabetes, weight gain/loss, and dementia), which are available via the internet, video, steaming media, webcam, live chat and/or video conference.<br /> <br /> While innovative, convenient, and helpful to our society, especially in these challenging times, such telehealth programs have also raised concerns about cybersecurity risks to healthcare organizations and the public as healthcare organizations continue to speed toward implementing these programs. Examples of such cybersecurity risks include <a href="">hacking and data breaches, phishing attacks, ransomware threats, loss or theft of equipment, data loss, and medical device attacks.</a> These threats are especially concerning considering HIPAA privacy requirements. However, during the COVID-19 pandemic, organizations implementing telehealth programs will not likely be penalized by the HHS, <a href="">Office of Civil Rights</a> for HIPAA violations should the programs fail to comply with the required regulations, as long as they are using <a href="">non-public facing remote communications in good faith</a>. This leniency is not likely to last forever though.<br /> <br /> What makes these threats possible?&nbsp;The fact that these telehealth systems heavily rely on the Internet. Further vulnerabilities of such systems include weak passwords, insecure network services, lack of secure updates, lack of privacy protection, outdated antivirus software, lack of secure data transfer and storage, and lack of device management.<br /> <br /> However, to provide some protection, the following non-public facing remote communications are <a href="">currently permitted: Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, Zoom and Skype</a>.&nbsp;These types of communications use end-to-end encryption, allowing only the person or persons communicating on each end to see what is transmitted, require personal accounts, logins, and passwords, and provide the users some control over how the communication occurs (i.e. video, sound, etc.). Not included in this list are Facebook Live, Twitch, TikTok, and similar video communication applications, as they are public facing.&nbsp;Such public facing forms of remote communication are not secure for such telehealth programs due to being open to the public and permitting more open and uninhibited access to the communications taking place.<br /> <br /> Telehealth is likely here to stay, which is why it is so important that organizations and individuals ensure that steps are continuously taken to protect the platforms from breaches and protect users&rsquo; private information. There are many other organizations providing continuing recommendations of how to mitigate and otherwise address cybersecurity risks and actual breaches. <i>See</i> <a href="">American Hospital Association</a> and <a href="">National Institute of Standards and Technology</a>. &nbsp;To learn even more about cybersecurity risks and practical approaches to effectively defending against and/or addressing breaches, BSCR previously did a three part series on cybersecurity risks, which can be accessed <a href=";an=61608&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here</a>, <a href=";an=62085&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here</a>, and <a href=";an=62097&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here</a>.</div> <div>&nbsp;</div> Healthcare Heroics May Ironically Lead to Future Confrontations - Causation Issues (Part 4) May 2020Healthcare Law Blog<p>In part four of our series of blog articles delving into potential dangers for healthcare providers related to the COVID-19 global pandemic, we consider causation issues for healthcare associated COVID-19 infections.</p> <p><b><u>General Infection Causation Issues</u></b></p> <p>While every corner of American commerce, including food suppliers and sellers, financial institutions, childcare providers and fitness centers, may face increasing liability claims from customers and third parties claiming to have been exposed to COVID-19 during a visit to their premises, in most cases, proving that an infected person caught COVID-19 from a specific source should be a difficult task, especially considering the known virus viability outside the body and incubation time (the time between contracting the virus and onset of symptoms).</p> <p>According to a study published in the New England Journal of Medicine, SARS-CoV-2, the virus that causes COVID-19, can live in the air and on surfaces between several hours and several days. The study found that the virus is viable for up to 72 hours on plastics, 48 hours on stainless steel, 24 hours on cardboard, and 4 hours on copper. It is also detectable in the air for three hours. After interaction with an infection source, most estimates of the incubation period for COVID-19 range from 1-14 days, with most infected individuals exhibiting symptoms around five days.&nbsp;Given the difficulty tracking all interactions of an infected person during the combined length of time between virus viability outside the body and incubation, narrowing the source of infection to one source and effectively ruling out all other possible acquisition more likely than not to a reasonable degree of certainty will likely be a difficult task.&nbsp;</p> <p><b><u>Causation Issues for Healthcare Associated COVID-19 Infections</u></b></p> <p>Nosocomial or healthcare associated infections are infections acquired during care which are not present or incubating at admission or treatment start.&nbsp;Nosocomial infections have been a reality since the origin of medicine and have been the object of litigation for some time.&nbsp;Undoubtedly, the COVID-19 pandemic will result in numerous lawsuits alleging that a healthcare provider&rsquo;s negligence led to infection during treatment.&nbsp;However, given that most infections are asymptomatic for some time after their onset, it can be very difficult to identify with precision whether the infection was indeed contracted after admission or whether the patient was infected before admission but asymptomatic.&nbsp;Several agencies and authorities have attempted to identify time parameters for establishing what generally constitutes a nosocomial infection.&nbsp;For example, the World Health Organization (&ldquo;WHO&rdquo;) &ldquo;usually&rdquo; considers infections occurring more than 48 hours after admission to be nosocomial. However, the &ldquo;usual&rdquo; qualifier in the WHO&rsquo;s definition allows a case-specific analysis of whether an infection can be deemed nosocomial. Thus, the WHO&rsquo;s 48-hour cutoff, or any other third-party&rsquo;s definition is not likely to apply to alleged COVID-19 infections given the longer incubation time discussed above.&nbsp;&nbsp;</p> <p>For long-term care facilities, although a complete causation defense may be complicated by a resident&rsquo;s likely admission predating the COVID-19 outbreak, providers should still attempt to establish a causation defense that a resident cannot prove virus transmission to a reasonable degree of certainty <u>after</u> the facility knew or should have known of the risk of COVID-19 transmission and <u>before</u> the recommended precautions were instituted.&nbsp;In support of this strategy, the Centers for Disease Control (&ldquo;CDC&rdquo;) has recognized that long-term care residents with COVID-19 may not report common symptoms like fever or respiratory symptoms, and some may not report any symptoms at all. The CDC acknowledges that unrecognized asymptomatic and pre-symptomatic infections likely contribute to transmission in long-term care facilities.&nbsp;These two CDC-recognized factors should strengthen a causation defense utilizing the above strategy.</p> <p><strong>Our prior posts in this series can be found<a href=";an=108514&amp;format=xml&amp;stylesheet=blog&amp;p=5258"> here (part 1)</a>, <a href=";an=108572&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here (part 2)</a>, and <a href=";an=108575&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here (part 3)</a>.</strong></p> Healthcare Heroics May Ironically Lead to Future Confrontations - State Executive Orders (Part 3) May 2020Healthcare Law Blog<p>In part three of our series of blog articles delving into potential dangers for healthcare providers related to the COVID-19 global pandemic, we consider the American Medical Association&rsquo;s push for states to pursue liability protections for healthcare professionals during the COVID-19 emergency.</p> <p>In the wake of the COVID-19 Nationwide Public Health Emergency, the Centers for Disease Control and other federal, state and local agencies have published guidelines and recommendations for healthcare providers dealing with patient care in the midst of this crisis and resulting limitations on available resources, equipment, and healthcare staff. Indeed, the evolving response to the national emergency raises many concerns, including concerns for the health of the courageous and dedicated providers themselves.</p> <p>By mid-April 2020, more than 9,000 U.S. healthcare workers had contracted coronavirus, with 27 U.S. deaths, and data suggests healthcare providers may account for approximately 11% of all COVID-19 infections.&nbsp;The authors of this blog series cannot fathom what these providers are going through, especially those caring for COVID patients throughout an entire shift, day after day, observing terrible suffering and outcomes, even with the best care and with healthy patients.&nbsp;These providers cannot help but feel that everything around them, especially in the hospital, could be a source of infection.</p> <p>In addition to very real concerns for the health and wellbeing of these front-line healthcare providers, another significant concern is the risk of potential legal liability arising out of adherence to published guidelines and recommendations while also endeavoring to provide quality care.&nbsp;This is especially important in those areas of the U.S. hit hardest by COVID-19 that have experienced unprecedented patient load and corresponding limitations on supplies and healthcare personnel.&nbsp;Of particular concern are those healthcare professionals providing direct care to COVID-19 patients, those who have shifted their practices to telemedicine, and those guided in treatment decisions by governmental directives.</p> <p>Thus, while federal and state laws provide existing protections to healthcare professionals, the American Medical Association has encouraged each state to consider whether additional protections should be extended to address the potential liability of healthcare providers affording care in response to COVID-19, as well as treatment decisions based on government or healthcare facility COVID-19 directives.&nbsp;For example, the CDC has published <a href="">crisis standard of care recommendations for decontamination and reuse of filtering facepiece respirators</a> which are not approved for routine decontamination and reuse.</p> <p>To that end, the AMA has recommended states provide healthcare providers immunity from civil liability and adverse action by state medical boards for injury or death:</p> <ol> <li>caused while providing medical services in response to the COVID-19 outbreak;</li> <li>caused by volunteer physicians acting in good faith for care provided in response to COVID-19; and</li> <li>resulting from a federal, state, or local directive, including but not limited to those to cancel, delay, or deny care as a result of the COVID-19 pandemic.</li> </ol> <p>In addition to the above recommendation, the AMA has provided recommendations on the appropriate mechanisms to formalize these protections, including through new laws, the expansion of existing laws, and/or by executive order.&nbsp;Some states have issued executive orders or proclamations to provide protections to allow for alternative standards of care. For instance, we have thus far identified executive orders in AL, AR, AZ, CT, GA, IL, MA, MI, MS, NC, NJ, NY, RI, VT. There are pending requests/proposals in other states to issue executive orders.&nbsp;Many of these parallel &ldquo;good Samaritan&rdquo; laws existing throughout the country that have for decades afforded qualified immunity from civil liability for healthcare professionals who volunteer their services as a generous compassionate act unless they engage in willful or intentional misconduct.&nbsp;&nbsp;&nbsp;</p> <p>Thus far, one state that has followed the AMA&rsquo;s recommendation is <a href="">Illinois, which extended by executive order</a> from the governor immunity to healthcare facilities, professionals, and volunteers from civil liability for any injury or death that occurs at a time when the facility or provider was providing healthcare services in response to COVID-19, except injuries or death caused by gross negligence or willful misconduct.&nbsp;Likewise, <a href="">the governor of New Jersey issued an executive order</a> providing immunity from civil damages for licensed healthcare providers for damages alleged to have been sustained as a result of their acts or omissions &ldquo;undertaken in good faith&rdquo; in connection with the State&rsquo;s COVID-19 response.&nbsp; That immunity does not extend to acts or omissions that &ldquo;constitute a crime, actual fraud, actual malice, gross negligence or willful misconduct.&rdquo;&nbsp;For another example, the New York State Senate and Assembly passed the Emergency Disaster Treatment Protection Act that&nbsp;grants immunity from civil and criminal liability to healthcare facilities, professionals, and volunteers for the purpose of, &ldquo;promot[ing] the public health, safety and welfare of all citizens&rdquo; during the pandemic. &nbsp;Though the immunity does not apply to acts or omissions caused by &ldquo;willful or intentional criminal misconduct, gross negligence, reckless misconduct, or intentional infliction of harm,&rdquo; the Act expressly excludes unavoidable resource or staffing shortages as evidence of such conduct.&nbsp;</p> <p>Though the authors of this blog series believe executive orders and laws like those described above are necessary in the current climate and likely helpful in mitigating some litigation risk for healthcare professionals, they will not necessarily end all litigation.&nbsp;These laws have not yet had to withstand scrutiny of the courts in terms of applicability, enforceability and scope.&nbsp;Moreover, even if some consider healthcare professionals likely to win lawsuits or that juries are likely to be sympathetic towards them, we should remember they must still defend themselves and undergo the stress, expense, and other burdens of litigation and threatened litigation in already difficult and truly unprecedented times.&nbsp;See <a href="">here</a> for more information on the recommendations of the American Medical Association.</p> <p><strong>Watch for our next post in this series, which considers COVID-19 causation issues.&nbsp;Our prior posts in this series can be found <a href=";an=108514&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here (part 1) </a>and <a href=";an=108572&amp;format=xml&amp;stylesheet=blog&amp;p=5258">here (part 2)</a>.</strong></p> Healthcare Heroics May Ironically Lead to Future Confrontations – Crisis Standard of Care? (Part 2) May 2020Healthcare Law Blog<p>In part two of our series of blog articles delving into potential dangers for healthcare providers related to the COVID-19 global pandemic, we consider the &ldquo;standard of care&rdquo; for healthcare providers. Specifically, we consider whether the &ldquo;standard of care&rdquo; may not be so &ldquo;standard&rdquo; during this global pandemic. Medical negligence cases are won and lost after a determination of whether a healthcare provider met or failed to meet the standard of care. In these lawsuits, a jury decides whether the healthcare provider was negligent based upon the &ldquo;standard of care.&rdquo;&nbsp;In Missouri, the &ldquo;standard of care&rdquo; means to use that degree of skill and. learning ordinarily used under the same or similar circumstances by members of the defendant's profession.</p> <p>During the COVID-19 pandemic, the &ldquo;same or similar circumstances&rdquo; portion of this definition have drastically changed considering the shortages of masks, face shields, other personal protective equipment (PPE), ventilators, swab kits, and testing capacity, all of which are critical for frontline caregivers and patients.</p> <p>The Institute of Medicine Committee on Guidance for Establishing Standards of Care for Use in Disaster Situations defines &ldquo;crisis standards of care&rdquo; as:</p> <p style="margin-left: 40px;">&ldquo;a substantial change in usual healthcare operations and the level of care it is possible to deliver, which is made necessary by a pervasive (e.g., pandemic influenza) or catastrophic (e.g., earthquake, hurricane) disaster.&nbsp;This change in the level of care delivered is justified by specific circumstances and is formally declared by a state government, in recognition that crisis operations will be in effect for a sustained period.&nbsp;The formal declaration that crisis standards of care are in operation enables specific legal/regulatory powers and protections for healthcare providers in the necessary tasks of allocating and using scarce medical resources and implementing alternate care facility operations.&rdquo;</p> <p>The medical community is working to establish guidelines for the &ldquo;crisis standard of care.&rdquo; The American Medical Association created an ethics resource page titled <a href="">&ldquo;Crisis Standards of Care: Guidance from the AMA Code of Medical Ethics&rdquo;</a> to offer guidance to healthcare institutions and providers on these issues during the pandemic. The Code does not offer specific clinical protocols, but instead provides foundational guidance for the development of ethically sound crisis standard of care guidelines.</p> <p>&ldquo;The goal is to make the decisions that happen at the bedside less ad hoc, so that they're more consistent, fairer and more objective,&rdquo; said Elliott Crigger, PhD, Director of Ethics Policy at the AMA. &ldquo;By having a set of standards, we&rsquo;re not leaving it to somebody who, say, hasn&rsquo;t slept in 48 hours or someone with a subtle bias against a patient.&quot;</p> <p>The National Academies of Sciences, Engineering, and Medicine <a href="">published a 200 page report</a> in 2013 entitled &ldquo;Crisis Standards of Care: A Toolkit for Indicators and Triggers&rdquo; which addresses the standard of care during natural disasters, pandemics, and other catastrophic events.</p> <p>At this stage, crisis measures are already being implemented in healthcare facilities across the U.S.&nbsp;Many of the recommendations involve the <a href="">preservation and reuse of PPE</a> due to the lack of resources.&nbsp;Outside the pandemic context, medical negligence cases commonly involve liability theories of medication errors, inadequate staffing, and ineffective infection prevention policies.&nbsp;These theories are likely to remain, but published &ldquo;standard of care&rdquo; guidelines in these situations during a public health crisis will likely be a moving target.</p> <p>Other medical sources, committees and colleges have published on the crisis standard of care, including the American College of Emergency Physicians, the Institute of Medicine, and the Board on Health Sciences and Policy, among others.&nbsp;Litigators can only speculate how the standard of care for cases that arise during the COVID-19 pandemic will take shape.&nbsp;The only thing that is certain is that the crisis standard of care will be hotly contested and at the center of controversy in suits involving the care of patients with COVID-19 and the care of non-COVID-19 patients during the time of crisis.</p> <p><b>Watch for our next post in this series, which considers the American Medical Association&rsquo;s push for states to pursue liability protections for healthcare professionals during the COVID-19 emergency.</b><b>&nbsp;Our prior post in this series can be found </b><a href=";an=108514&amp;format=xml&amp;stylesheet=blog&amp;p=5258"><b>here</b></a><b>.</b></p> Healthcare Heroics May Ironically Lead to Future Confrontations - Introduction (Part 1) Apr 2020Healthcare Law Blog<p>It has been more than a century since a truly all-enveloping, global pandemic has cut deep into the day-to-day lives of so many people. Discussions of the coronavirus or COVID-19 invariably include at least brief references, if not substantive comparisons, to the global pandemic of 1918-1919, in which more than 600,000 Americans perished.&nbsp;The world-wide death toll is still uncertain, with estimates of 20,000,000, to 50,000,000.&nbsp;Fortunately, at least for now, the current pandemic is not expected to be so devastating.&nbsp;Still, these two pandemics share many features, including the boundless heroism and courage of healthcare providers, both in the high-profile, as well as the seemingly small roles in combatting the virus and saving lives.</p> <p>As the United States makes its way into the third month of dealing with COVID-19, there are already signs of concern for our healthcare providers being attacked in the future.&nbsp;As much as it seems wrong to have to consider this specter, several states have not only been anticipating it, they have taken action to shield certain healthcare providers from legal liability.&nbsp;For example, on April 1, 2020, Illinois Governor JB Pritzker entered an order to protect state employed healthcare workers and state-directed healthcare workers from civil liability for claims arising out of care provided to COVID-19 patients.&nbsp;Other states taking similar action include AL, AR, AZ, CT, GA, IL, MA, MI, MS, NC, NJ, NY, RI, VT.</p> <p>Some might say such action is unnecessary &ndash; after all, who would sue these brave healthcare providers who risked and continue to risk their own health?&nbsp;The fact is that there are already COVID-19 solicitations on the websites of numerous plaintiff lawyers.&nbsp;Many of those focus on long term care facilities, but there is every reason to think that plaintiff lawyers&rsquo; groups and think tanks around the country are already working on different strategies to bring legal actions for COVID-19 care.</p> <p>Much continues to be written about how to prevent or lessen the spread of COVID-19.&nbsp;Over the coming few days we will instead be providing a series of blog articles that delve into potential dangers for healthcare providers and offer observations about possible defense strategies.</p> <p><b>Watch for our next post in this series, which considers the &ldquo;standard of care&rdquo; for healthcare providers during this global pandemic.</b></p> Effects on Long-Term Care Facilities: Potential Increased Litigation Due to COVID-19 Apr 2020Healthcare Law Blog<p>Long-term care facilities face many challenges, and the COVID-19 pandemic appears to be yet another significant challenge for these facilities. Their resident population includes those most vulnerable to illness or death from coronavirus because of advanced age and compromised immune systems.&nbsp;Plaintiffs&rsquo; attorneys are advertising their services to the families of those exposed to coronavirus in long-term care facilities.&nbsp;Each day the numbers of cases and deaths rise, increasing the litigation potential.&nbsp;</p> <p>There are over <a href="">1 million residents</a> in long-term care facilities in the United States, with millions more receiving hospice care and long-term care from home health agencies.&nbsp;As of March 30, more than <a href="">400 of approximately 15,000</a> long-term care facilities in the United States reported coronavirus outbreaks amongst residents, staff or both.&nbsp;On April 2, the Associated Press <a href="">reported</a> approximately 2,300 confirmed coronavirus cases in long-term care facilities and 450 deaths, a mortality rate of nearly 20 percent.</p> <p>Some are blaming a lack of supplies, poor staffing, inadequate policies and procedures, and the failure to follow guidelines published by the Centers for Disease Control and Prevention (CDC) and Center for Medicare &amp; Medicaid Services (CMS) as contributing factors for the spread of the virus and resulting deaths.&nbsp;Medical experts are sure to disagree about the standard of care during this public health crisis and the feasibility of mitigating the spread of coronavirus in long-term care facilities.&nbsp;</p> <p>So, what can long-term care facilities do to prepare for potential litigation or avoid it altogether?&nbsp;There may be no foolproof way to prevent litigation, but certain strategies, when employed correctly, may help to mitigate risk.</p> <ul> <li>To the extent feasible, follow CMS and CDC published recommendations and guidelines for pandemic response, for example: <ul> <li>Restricting all visitors, with exceptions for compassionate care, such as end-of-life situations;</li> <li>Restricting volunteers and nonessential health care personnel and other personnel (i.e. barbers);</li> <li>Cancelling group activities and communal dining; and</li> <li>Implementing active screening of residents and health care personnel for fever and respiratory symptoms;</li> </ul> </li> <li>Ensure adherence to pandemic policies and response plans whenever possible;</li> <li>When practical, separate residents who have tested positive for coronavirus and care for them in a separate area of the facility;</li> <li>When practical, limit the staff caring for those who have tested positive and do not allow the same staff caring for those who have tested positive to care for those who are well;</li> <li>Maintain resident records, staffing and scheduling records, and visitor records in accordance with facility policies and procedures;</li> <li>Keep resident family members apprised of the condition of residents who are ill; and</li> <li>Keep residents and their family members informed of changing facility policies and procedures, posting and providing copies of any changes to residents and their family members whenever practical.<span id="1587402874916E" style="display: none;">&nbsp;</span></li> </ul> <p style="margin-left: 40px;">*A full list of CDC guidance to nursing homes can be found <a href="">here.</a></p> <p>Though numerous states are currently considering or have already passed legislation shielding health care workers and facilities from civil liability for their efforts to treat COVID-19 patients and prevent the spread of coronavirus, it is not yet clear whether these bills will apply to long-term care facilities and the care provided at those facilities.&nbsp;No matter the implications of proposed immunity legislation on long-term care facilities, facilities should continue to do their best to keep residents and staff safe during this extraordinary pandemic and review and amend policies and protocols as new issues arise.</p> Relaxes Enforcement of HIPAA Noncompliance in Telehealth and Mobile Testing Apr 2020Healthcare Law Blog<p>The U.S. Department of Health and Human Services (&ldquo;HHS&rdquo;) has <a href="">announced a plan of enforcement discretion</a> regarding telehealth communications and testing sites during the COVID-19 Nationwide Public Health Emergency. As a result, HHS will not impose penalties for covered healthcare providers&rsquo; noncompliance with HIPAA in connection with the good faith provision of telehealth during the emergency.&nbsp;Roger Severino, Director of the HHS Office for Civil Rights (&ldquo;OCR&rdquo;), explained the decision was motivated by a desire to, &ldquo;empower[..] medical providers to serve patients wherever they are during this national public health emergency. &nbsp;We are especially concerned about reaching those most at risk, including older persons and persons with disabilities.&rdquo;</p> <p>As a result, any covered healthcare provider may use any non-public facing remote communication product, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype, to provide telehealth to patients.&nbsp;Notably, Facebook Live, Twitch, TikTok, and similar video communication applications are considered by OCR to be public facing, and should not be used in the provision of telehealth.</p> <p>HHS&rsquo;s exercise of discretion applies to telehealth provided for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19.&nbsp;Providers are encouraged, however, to enable all available encryption and privacy modes when using technology, as well as notify patients that the use of technology in the provision of telehealth potentially introduces privacy risks.</p> <p>As an example, a provider could, in the exercise of professional judgement, utilize a cell phone video chat application to examine a patient exhibiting COVID-19 symptoms.&nbsp;This practice would permit the provider to evaluate a larger number of patients while also limiting the infection risk associated with in-person consultation.&nbsp; During the public health emergency, the provider could provide those same telehealth services to assess or treat medical conditions unrelated to COVID-19.</p> <p>HHS has<a href=""> published a bulletin</a> advising covered entities of further flexibilities available to them as well as obligations that remain in effect under HIPAA as they respond to crises or emergencies.</p> <p>In addition to its decision regarding telehealth, HHS has announced it will exercise enforcement discretion for violations committed by covered healthcare providers in their work with community-based testing sites during the emergency.&nbsp;As part of the overall effort to increase mobile testing sites across the country, Director Severino explained enforcement discretion in this area &ldquo;supports these critical efforts to test and diagnose patients during this nationwide emergency.&quot;&nbsp;</p> <p>Unlike the decision regarding telehealth, OCR&rsquo;s position on mobile testing sites applies only to certain health care providers, including some large pharmacy chains, that are only offering COVID-19 specimen collection or testing.&nbsp;During the emergency, OCR will not penalize healthcare providers for HIPAA violations stemming from &quot;good faith uses and disclosures of protected health information by business associates for public health and health oversight activities.&rdquo;</p> <p>Covered healthcare providers should be cognizant, however, of the potential interplay between the HHS&rsquo;s decision on enforcement discretion and Missouri law addressing the fiduciary duty of confidentiality and nondisclosure of protected health information.&nbsp;Thus, absent federal or state legislation shielding healthcare providers from civil liability for COVID-19 related services or other services during the public health emergency, providers could still face potential litigation for claimed monetary damages stemming from improper disclosure of protected health information.</p>