INSIDE THIS ISSUE: 1) Digital Healthcare in a COVID-19 World 2) Meet The New ILS Council Officers and Members 3) COVID-19 and Cross-Border Furloughs and RIFs Online CLE July 8 4) ILS Announces the 2020 Human Rights Essay Contest Scholarship Winner

Due to the national emergency, note that Medicare has relaxed the requirements for telehealth services and now permits qualified providers to furnish services to patients in their homes.

Nonetheless, online healthcare visits must still comply with the existing statutory framework of:

(i)                  Obtaining the informed consent of the patient residing in Texas for an online visit (Section 111.002 of the Texas Occupations Code);

(ii)                Verifying the identity of BOTH the patient and the provider;

(iii)               Having the technology capabilities of: (a) Real-Time Audio-Visual Interaction; (b) Store-and-Forward Technology; and (c) Audio-Visual Technology that allows a physician to satisfy the standard of care (Section 111.002 of the Texas Occupations Code); and

(iv)               Complying with privacy and data protection under the Health Insurance Portability and Accountability Act (HIPAA).

Despite the national emergency, the Centers for Medicare and Medicaid Services (CMS) still requires a clinician to be a Medicare “qualified provider” and did not expand the list of suitable providers to provide healthcare services that can be reimbursed. [1]  However, some changes have been made in light of the pandemic. For example, the technological standards have now been lowered by CMS and now only requires that the device have both audio and video capabilities. Additionally, for telehealth services administered during the pandemic, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) is being reasonable and waiving penalties for HIPAA violations who are serving patients in good faith using reasonable forms of communication.

In 2017, the Center of Medicare and Medicaid Services (CMS) also pronounced that the texting of patient information is permitted if done through a secure platform such as TigerConnect. [2]

Through telemedicine, a physician’s reach is no longer limited by geographic and governmental boundaries. As such, physicians must be licensed in the state in which the patient is located, but the TMB grants special out of state licenses allowing physicians to treat patients located in another state.[3]  However, in response to the current crisis, CMS has temporarily waived this requirement and now allows qualified providers to furnish telehealth services to patients regardless of location so that those residing in both rural and non-rural areas can receive proper treatment.  Nonetheless, state licensing requirements will still apply to providers practicing across state lines. From an operational standpoint, telemedicine allows for decentralized, as-needed physician staffing which can reduce a hospital system’s personnel costs. From a safety standpoint, telemedicine protects both the patient and physician from unnecessary exposure to each other, especially in the new world of infectious diseases.

[1] The list of qualified providers can be found here: https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet.

[2] https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertificationGenInfo/Downloads/Survey-and-Cert-Letter-18-10.pdf.

[3] http://www.tmb.state.tx.us/page/telemedicine-license.

If the online visit requires a prescription, 22 Tex. Admin. Code § 174.5 stipulates that one of the following must be satisfied:

(i)                  There must be an existing patient-physician relationship;

(ii)                The physician can contact the patient pursuant to a call coverage agreement; or

(iii)               They physician must meet all applicable technology standards (as set forth above).

Given the pandemic, however, the Drug Enforcement Agency (DEA) has granted leniency in the existing patient-physician relationship by now allowing DEA-registered providers to issue prescriptions for controlled substances to patients where there has not been any previous medical evaluation, subject to the following requirements: (a) the prescription is issued for a legitimate medical purpose by a provider acting in the usual course of professional practice; (b) audio-visual, real-time, two-way interactive communication devices are used; and (c) the provider is still subject to federal and state laws. [1] Additionally, CMS will not enforce the existing patient-physician relationship required under H.R. 6074, which stipulates that telehealth services could only be provided to patients who had been treated by the provider within the previous three years and had services billed under Medicare.

After the prescription has been filled, the physician must continue to have follow-up instructions and have access to use all relevant clinical information required by the prescribed standard of care. We have seen an influx of mobile app developers providing follow-up services and monitoring for various healthcare specialties just to address this specific need. Despite such flexibility in Texas law, physicians are limited to using telemedicine to treat acute pain with prescribed drugs and strictly prohibited from treating chronic pain with scheduled drugs.

[1] https://www.deadiversion.usdoj.gov/coronavirus.html.

With such forward-thinking legislation by Texas, technology will be the first pillar of defense to bolster our healthcare system against future diseases and pandemics. For digital healthcare to succeed, a patchwork of existing technologies will need to be integrated seamlessly to provide accurate diagnosis and quality of care, within a frictionless logistics chain. From electronic medical record (EMR) systems to wearable devices, from mobile apps to medical transport, technology will allow officials to track and predict the overall public health of a population so that it can anticipate any unexpected surges that overwhelm the delicate balance of a healthcare system.

Given the staunch requirements of privacy, identity verification, and portability of patient data, it is imperative that healthcare providers incorporating telemedicine into their operations reassess their privacy policies and cybersecurity protocols to identify any areas of vulnerability. For a robust privacy and cybersecurity policy, some structural items to consider are:

(i)                  Properly disclosing what personal data is collected and how it will be used and disclosed;

(ii)                Obtaining all necessary consents or opt-outs required under the jurisdiction of each patient;

(iii)               Identifying all vendors and contractors who have access to patient data and having appropriate security and contractual restrictions in place;

(iv)               Confirming that all services agreements with IT vendors contain audit provisions to police any vendors who are misusing or inadequately protecting patient data;

(v)                Verifying that all cybersecurity defenses in the data supply chain are, at minimum, industry standard;

(vi)               Ensuring the software or app architecture is designed for privacy;

(vii)             Integrating functionality into the software or app that allows patients to access their information and requesting its deletion; and

(viii)           Contractually, limiting any unnecessary exposure by including proper warranty disclaimers and limitations of liability in any related Terms of Service or End User License Agreements.

In response to the pandemic, on March 17, 2020, OCR lowered restrictions and penalties to HIPAA violations for providers implementing telehealth services in the wake of the pandemic so long as they used reasonable care and good faith judgment.

Because telemedicine transcends physical boundaries, a meshwork of privacy laws is now implicated, including HIPAA, the California Consumer Privacy Act (CCPA), and the General Data Protection Regulation (GDPR). How such privacy laws intertwine and supersede each other will still need to be interpreted at the administrative, national, and local levels. As such, the selection of the choice of law and jurisdiction for the telemedicine platform will be critical in reducing any compliance burdens to a healthcare provider.

Given this legal framework, where is the technological frontier of telemedicine heading? Blockchain (an immutable, trusted source of information that is not controlled by a single party) will be a pivotal technology for the transition of physical, in-person patient care into a post-COVID world of digital healthcare. Blockchain technology will aid research, promote efficiency, and instill security in a digital healthcare system where patient data and healthcare records could be safely shared and accessed across multiple institutions. Due to a prevalence of falsified claims by patients, Blockchain will also be crucial in healthcare identity management and records management by reducing patient fraud, inaccuracies, and misdiagnosis by the physician. Any reduction of fraud and improvement of care will certainly be embraced by government payors and private insurers, who are ultimately responsible for determining reimbursements to physicians and facilities.

Here in the Texas Medical Center, artificial intelligence (AI) and machine learning have replaced humans in performing certain critical, life-monitoring functions.. Some of the basic tasks under the previous responsibilities of a nurse or tech are now detected by a variety of devices that alert staff and physicians if readings become abnormal. AI has become an irreplaceable component on the hospital floor to relieve the constraints of human staffing. With infectious diseases, AI can serve as an additional barrier to socially distance and insulate human staff fighting on the frontlines from unnecessary contagion while still ensuring a high quality of care.

Outside of the hospital, wearable devices and the Internet of Things (IoT) will be an additional layer of technology in the next frontier of digital healthcare. The well-being of a patient can be remotely monitored after a patient has returned home and into society. Real-time instructions can be given to a patient if the need arises or something abnormal is detected. Real-time data obtained by the wearables and devices can be simultaneously reconciled with any EMR system (on a Blockchain) containing the patient’s medical history.

Nonetheless, cybersecurity must be the highest priority as healthcare and patient data becomes entwined in a digital web of devices and information. Cybercriminals have used ransomware to hold entire healthcare systems hostage by hacking into the networks of a hospital and threatening to disable all system-critical, life-sustaining devices. As such, it is critical for healthcare administrators and Chief Information Officers to establish a relationship with the U.S. Department of Justice, Computer Crime and Intellectual Property Section (CCIPS) to thwart any potential threats and avail themselves of time-sensitive remedies. Additionally, cybercriminals are also using the internet to submit fraudulent claims, sell fake vaccines, and create a variety of other healthcare related scams. If a healthcare provider or hospital systems suspects foul play with its IT network, it must immediately report such activity with the FBI’s Internet Crime Complaint Center (IC3). But before a cyber-incident cripples a healthcare organization, the Healthcare Information and Management Systems Society (HIMSS) can advise on the latest industry standards and aid with taking proactive and preventative measures.

As the law is forever catching up with innovation, much is still unaddressed by our judicial system. The future of healthcare raises a plethora of policy, legislative, and legal issues that must be considered to promote the overall health of our population while protecting the quality of care and human rights of each individual patient and healthcare provider. Nonetheless, it is reassuring to see the various U.S. healthcare enforcement agencies embrace digital medicine by timely responding with more accommodating telemedicine laws in response to our current national crisis.

About the Author

Aaron Woo represents companies from diverse sectors including energy, software and high-tech. As a former corporate counsel for several global, public high-tech companies, he has guided executives on a variety of corporate strategic matters spanning from negotiation tactics to international transactions. By balancing the protection of legal interest with the achievement of business initiatives he has maximized revenues and mitigated risk on high stakes deals and cross-border operations. Being an entrepreneur himself, Aaron works as a business advisor and is actively involved with early stage companies in Texas. As a strong proponent of entrepreneurship, he advises seed and early stage companies from startup through acquisition by developing IP strategy, implementing business development objectives, and obtaining the necessary financing to position businesses for growth by representing high-tech startups in the investment and fund-raising process. Aaron is based in the Houston   office but also covers the  Austin   market. Aaron is an avid sports enthusiast and volunteers his time to work with individual athletes, coaches and teams on contract negotiations, labor issues, and professional endorsements.

Speaker: Christopher V. Bacon, Counsel-Labor & Employment, Vinson & Elkins LLP

Program Description: Most global human resources managers for multi-national corporations are well-aware of the challenges of terminating a poorly performing expatriate employee who has been working at a company affiliate outside of the United States. After all, it’s usually much easier to terminate employees in the United States because most non-union employees in the U.S. are “at-will” employees who can be terminated without cause so long as the decision is not motivated by unlawful discriminatory or retaliatory motives. In many countries, no-cause layoffs are either illegal or the employer is required to pay separated employees a statutory severance. In addition to the usual concerns about the applicability of foreign labor and employment laws that employers must contend with when terminating a single employee, multi-national employers considering layoffs or furloughs of employees assigned to foreign affiliates will also need to think about other countries’ legal requirements for conducting reductions-in-force or mass layoffs. U.S. companies with employees in other countries should also keep in mind that new laws have been enacted in many countries in response to the COVID-19 pandemic that might make it more difficult to terminate employees at this time. Any company considering layoffs or furloughs in another country should also consider whether governmental benefits are available to employers who retain employees, much like the United States Congress provided in the recently enacted CARES Act. Some U.S. companies may want to repatriate expatriate employees for health and safety reasons depending on the extent that COVID-19 has affected, or will affect the countries where their employees are assigned, and on ability of those countries’ health care systems to treat any employee who becomes sick. A further challenge facing employers with employees in countries where their employees are assigned, and on ability of those countries’ health care systems to treat any employee who becomes sick. A further challenge facing employers with employees in countries where the infection rate is growing exponentially is how to bring those employees home.