A new Florida law will require certain Florida-licensed providers to ensure that patient information is physically maintained only in the continental United States and its territories or in Canada. Florida SB 264, which goes into effect July 1, 2023, amends the Florida Electronic Health Records Exchange Act, adding a ban on offshoring health information that goes beyond the requirements under HIPAA and most other generally applicable health privacy and security laws. Florida licensees to which the new requirements apply will need to attest upon initial licensure and any renewals that they are in compliance with the new requirements. Applicable licensees will also be required to ensure that no individual or entity with a controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries.

As we previously covered, in March 2023, the Drug Enforcement Agency (DEA) announced a proposed rule on prescribing controlled substances via telehealth, aimed at addressing the “telehealth cliff” that was expected to occur once the COVID-19 Public Health Emergency (PHE) ends on May 11, 2023. The proposed rule provided some flexibility, but required a much more restrictive framework for prescribing controlled substances via telehealth compared to the flexibilities available during the PHE. During the 30-day comment period following the announcement of the proposed rule, the DEA received over 38,000 comments, which the agency says it is closely reviewing. Many commentators across the health care industry criticized the proposed rule because the in-person examination requirement would limit access to care. The DEA, working with the Department of Health and Human Services, is also considering revisions to the proposed rule. 

With just over two months before the COVID-19 Public Health Emergency (PHE) expected expiration on May 11, 2023, the Drug Enforcement Agency (DEA) has finally announced its proposed rule on prescribing controlled substances via telehealth. This post provides continued coverage of telehealth updates and dissects what this DEA's proposed rule could entail. 

Navigating the regulatory frameworks that impact health care transactions can be challenging. These frameworks have the ability to impact multiple aspects of a transaction, including timing, structure, and valuation. Knowing how to identify and avoid these regulatory pitfalls is critical to averting these challenges that can delay or break a deal. And, ultimately, it’s what you know that can make the deal.

The COVID-19 Public Health Emergency (PHE), which was originally declared nearly three years ago, has been renewed through April 2023. As we’ve previously covered, the PHE allowed federal and state regulators to relax certain telehealth requirements, which has led to a rapid expansion in the availability of telehealth services. The Biden Administration has committed to provide at least 60 days’ notice prior to terminating the PHE or allowing it to expire, but several news outlets are reporting that this could be the final extension. 

Covered Entities and Business Associates should promptly and carefully review their use of online tracking technologies on their websites and mobile apps following a bulletin (Bulletin) published by the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) last week.  The Bulletin addresses multiple facets of compliance with HIPAA when using online third-party tracking technologies (Tracking Technologies).  In doing so, OCR significantly expands its interpretation of the definition of Protected Health Information (PHI) to include, in some instances, identifiable information gathered by Tracking Technologies where a user visits a website and does not interact with the entity in any other way. In its Bulletin, OCR interprets the act of an individual visiting a website as evidence of a relationship or anticipated future relationship between the visitor and the entity.

Many of the flexibilities upon which telehealth providers have come to rely in recent years are tied to the federal Public Health Emergency related to the COVID-19 pandemic (PHE). As we move into Fall 2022, we review the current state of the PHE flexibilities around Medicare reimbursement and prescription of controlled substances, examine pending legislation that, if passed, would bring greater certainty to patients and providers, and discuss what we know about the status of a possible PHE extension.

As we’ve previously covered, while Congress has acted to extend certain COVID-era telehealth flexibilities (mostly related to Medicare coverage) beyond the Public Health Emergency (PHE), the future of prescribing controlled substances via telehealth is uncertain.  Although the American Telemedicine Association and other industry groups continue to advocate for changes to allow telehealth providers to prescribe controlled substances in certain circumstances, without further action by Congress or the Drug Enforcement Administration (DEA), telehealth providers who prescribe controlled substances will need to conduct an in-person examination of the patient once the PHE ends. 

Last week saw a lot of great news in the world of telehealth. On March 15, President Biden signed into law H.R. 2471, the “Consolidated Appropriations Act, 2022”, which extends many of the Medicare telehealth flexibilities put in place during the COVID-19 pandemic for a period following the end of the Public Health Emergency (“PHE”). The same day, the OIG issued a report highlighting the positive impact telehealth had on increasing access for beneficiaries during the first year of the pandemic. Then, during a press conference on March 18, HHS Secretary Xavier Becerra said that HHS will seek to sustain and expand access to telehealth services after the public health emergency ends. While these developments signal the continued expansion of telehealth, there is still some uncertainty surrounding coverage, reimbursement and licensure flexibilities that have allowed telehealth to flourish for the past two years.

On Monday, February 7, 2022, U.S. Senators Catherine Cortez Masto, D-Nevada, and Todd Young, R-Indiana, introduced the Telehealth Extension and Evaluation Act, which if passed, would extend several of the telehealth waivers for two years after the end of the federal public health emergency (PHE). See our previous coverage of telehealth during the COVID-19 pandemic. The PHE was most recently renewed for an additional 90 days on January 16, 2022. Since January 2020, providers who pivoted to telehealth in order to deliver care to their patients during the pandemic have had to closely monitor the status of the PHE, which the Secretary of HHS is only authorized to extend for 90 days at a time. Passage of the proposed legislation would provide some much-needed certainty and would give providers time to transition back to in-person care where necessary. It would also further the growth and expansion of telehealth services and continued integration into our health care delivery system.