General Surgery Coding Alert

Compliance:

Maintain Telehealth Compliance in Your Post-PHE Practice

Published on Fri Apr 19, 2024

Vendors under contract are also obligated to adhere to HIPAA rules.

Telehealth services have become a permanent fixture in our healthcare system following the COVID-19 public health emergency (PHE). As the technology evolves and more healthcare organizations adopt the services, your practice will need to stay on top of telehealth regulations and requirements to receive reimbursement and protect your patient data.

Continue reading for useful advice to help your practice maintain compliance for telehealth visits.

Gather the Required Documentation

“Evaluation and management [E/M] codes are very often billed instead of the virtual care visits or the telephone-only visits because they more accurately reflect what happened during that visit,” said Stephanie Sjogren, CPC, COC, CRC, CPMA, CDEO, CPC-I, CCS, HCAFA, during her “Telehealth Beyond the Pandemic” session at AAPC’s Collaborative Compliance Conference 2023.

If the physician performs a telehealth E/M visit and is basing the E/M code on time alone, the documentation must reflect this information. The documentation must show the amount of face-to-face and non-face-to-face time spent on the patient over a 24-hour period. The time-based documentation should include the following information:

Reason for the visit
The visit occurred through video and audio
Medically appropriate physical examination
Assessment and plan
Exact minutes spent on patient care

The provider’s documentation of the time in minutes spent on patient care should mention how the time is accrued.

“You want to put the precise total number of minutes spent on patient care — make sure you note the time parameters. That way you can accurately pick the code that reflects that the time spent and describe how that time was used,” Sjogren said.

Additionally, if the provider is basing their telehealth E/M code on medical decision making (MDM), documentation of the visit’s MDM components should be included in the telehealth visit just as they would for an in-person E/M visit.

Following the telehealth visit, the provider should document as much information as possible to ensure prompt and accurate reimbursement. “Post-visit documentation has to still be as thorough. So, if you’re doing stuff after the visit ends, which obviously most providers are, there are a few things that we want to make sure we’ve captured and documented,” Sjrogen continued.

The telehealth visit documentation is similar to in-person E/M visits, but there are additional elements that need to be included:

Patient consent: Include a note of written or verbal consent for virtual treatment.
Telehealth codes: Use only telephone codes for audio-only visits and office/outpatient E/M codes for audio-video visits. These codes can only incorporate the time spent directly communicating with the patient.
Time of visit: Ensure only the healthcare provider bills for the time they spend on patient care. The provider cannot bill for any time spent by the clinical staff coordinating care.
Asynchronous visits: Review the store-and-forward rules for each state, as some states do not allow reimbursement for store-and-forward visit activities and require telehealth services to be delivered in real time.
Eligible sites: Review which originating and distant sites are eligible for reimbursement for telehealth visits.

Remember That HIPAA Applies to Business Associates

While the patient may not physically be in the office during a telehealth visit, HIPAA rules still apply to all telehealth services covered by healthcare providers. Healthcare providers must take the necessary steps to protect their patients’ protected health information (PHI), and this includes choosing HIPAA-compliant platforms for telehealth services.

For example, not all video conferencing software is developed equally. “If you’re going to have different technology like Zoom for Healthcare, you can’t use the same Zoom you would for healthcare as you would for just your private conversations. Those are different. There are different levels of security with Zoom for Healthcare versus regular Zoom,” Sjrogen explained.

If your practice is using a software vendor, they are considered a business associate, and are also subject to HIPAA laws. In the end, if the software vendor experiences a data breach that could result in your data being compromised, then your practice is still responsible for the data breach.

“Make sure due diligence is followed to protect patient information. Verify all the security practices. As a provider, you’re still responsible. Again, any mistakes that business associates make in protecting security of patient data are your mistakes, too,” Sjrogen said.

Designate a Compliance Officer

One of your responsibilities as a healthcare practice is to ensure the practice is compliant. Healthcare technology has advanced significantly in the past three years, and maintaining compliance is more than just setting up IT defenses — it requires a combination of technical components and physical administration.

“A lot of this updated technology is something very new for people. The practice employees and practitioners thought, ‘I will just lock the cabinet and make sure the charts are secure.’ Once you’re online, it’s a completely different world,” Sjrogen said.

Ensure an effective and adequate compliance program is implemented by selecting a person in your organization to serve as a compliance officer. The compliance officer then has the responsibility to oversee the compliance program’s implementation and allocate the necessary resources to help it succeed.

Provide Regular Staff Training and Education

Simply appointing a compliance officer and partnering with trustworthy, compliant software vendors does not guarantee the establishment of a compliant telehealth program. Your practice should also conduct regular training sessions to educate anyone who works for or with your practice on compliance policies.

Examples of those who should receive continuing education include:

Administrative staff
Physicians and other qualified healthcare professionals
Clinical staff
Business management staff

Through regular webinars, newsletters, memos, and other methods, employees can refresh their knowledge and standard operating procedures. Terri Brame Joy, MBA, CPC, COC, CGSC, CPC-I, product manager, MRO, in Philadelphia, also adds, “If your providers are also remote, it is helpful to create a HIPAA compliance workspace checklist for them to ensure their end of a telehealth visit is secure. If visits originate in the office, complete occasional audits of telehealth visits to ensure compliance. Have a short checklist ready to share with providers to support them in maintaining a secure telehealth visit.”

Michael Shaughnessy, BA, CPC, Development Editor