By Chris Jones<\/p>\n
<\/p>\n
I. Introduction<\/strong><\/p>\n COVID-19 sparked a \u201ctsunami of growth\u201d in the United States\u2019 telehealth industry.[1]<\/a> The Office for Civil Rights (\u201cOCR\u201d) Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency<\/em> (\u201cNotification\u201d) allowed medical providers to utilize telehealth platforms that fell short of The Health Insurance Portability and Accountability Act of 1996\u2019s (\u201cHIPAA\u201d) privacy requirements.[2]<\/a><\/p>\n Technology companies and governments have \u201clong shown themselves to be wolves in sheep\u2019s clothing when it comes to privacy: promising privacy while conducting widespread and illicit surveillance.\u201d[3]<\/a> A recent study determined that over 70% of medical applications shared users\u2019 sensitive information with third-party data aggregators, without the user\u2019s knowledge or consent.[4]<\/a><\/p>\n Data aggregators can use this information to potentially damage the individual financially, physically, or psychologically.[5]<\/a> This data is often marketed and sold to a variety of commercial third parties including employers, advertisers, and insurers.[6]<\/a> In one case, a data aggregator sold the digital health-related data of approximately 3 million individuals to an insurance company.[7]<\/a><\/p>\n By allowing medical providers to utilize inferior privacy measures, the risk of individual privacy harm continues to increase. Privacy injuries associated with the unauthorized use of an individual\u2019s data may include reputational, discrimination, physical, psychological, economic, and relationship harms.[8]<\/a> Thus, telehealth platforms should be required to obtain a Telehealth Privacy Certification (\u201cCertification\u201d) of compliance prior to public market release. This Certification would strengthen security and ensure a patient\u2019s privacy rights are protected moving forward\u2014regardless of what the future holds.<\/p>\n II. Telehealth During COVID-19<\/strong><\/p>\n During the COVID-19 pandemic, private telehealth companies and health care systems reported an increase of telehealth use ranging from 100% to 4300%.[9]<\/a> According to the Center for Disease Control and Prevention (\u201cCDC\u201d), 43% of medical providers had telehealth capabilities before the pandemic.[10]<\/a> After the pandemic began, 95% offered telehealth.[11]<\/a><\/p>\n Telehealth is defined as the use of electronic information and communications technologies to deliver clinical and nonclinical health care services.[12]<\/a> Telehealth communications generally consist of three types: (1) Synchronous, which involves direct communication between the provider and the patient using phone, video, or data transmission such as texting; (2) Asynchronous, which involves the storage of information for the provider or patient with the expectation the other party will review it and respond back at some point in the future; and (3) Remote patient monitoring, which involves a mix of both synchronous and asynchronous telehealth that allows the provider to monitor the patient over time.[13]<\/a> Prior to the pandemic, there were many barriers to utilizing telehealth such as provider licensing, insurance approval, lack of equipment, and the overall costs of complying with HIPAA.[14]<\/a> For example, extremely expensive devices were required for both the patient and physician with costs ranging from $799 on up.[15]<\/a><\/p>\n As telehealth appointments have become common events, patients confide in their providers as they would if meeting in person. Patients can be particularly susceptible to privacy harm when being videotaped. Typical telehealth sessions often contain a patient\u2019s personal disclosures of \u201cobjective and highly sensitive statements of fact\u201d that \u201cmay be inherently more revelatory\u201d than the provider\u2019s ordinary notes based on subjective impressions.[16]<\/a> Even when complying with HIPAA, providers are free to retain archived, stored, or transmitted data from telehealth sessions.[17]<\/a><\/p>\n Mental health therapist Tiffany Chhuom worries about the impact of temporarily lifting privacy protections for patient data included in video or text discussions with their doctors.[18]<\/a> \u201cThe ways in which these clients who are so vulnerable on video could be exploited \u2014 I don\u2019t have the words to explain how much that concerns me,\u201d said Chhuom.[19]<\/a><\/p>\n III. Legal Background<\/strong><\/p>\n While it is generally understood that medical providers should use the highest level of standards to assure peace of mind for their patients,[20]<\/a> HIPAA regulates the use of technology to transmit certain medical data at the federal level.[21]<\/a> HIPAA requires covered entities to follow data privacy, data security, and data breach notification requirements when handling applicable medical information.[22]<\/a><\/p>\n The Health Information Technology for Economic and Clinical Health Act (\u201cHITECH Act\u201d) amended HIPAA in 2009 to further define the responsibilities and roles of healthcare providers and business associates.[23]<\/a> The HITECH Act requires that covered entities utilize a Business Associate Agreement (\u201cBAA\u201d)[24]<\/a> and demands that associates comply with the appropriate sections of HIPAA\u2019s Privacy and Security Rules.[25]<\/a> Absent exception, HIPAA\u2019s Privacy Rule requires patient consent in order for a covered entity to share Protected Health Information (\u201cPHI\u201d) with third parties.[26]<\/a> HIPAA\u2019s Security Rule requires that covered entities utilize \u201cadministrative, physical, and technical safeguards to prevent threats or hazards to the security of electronic PHI.\u201d[27]<\/a><\/p>\n Herein lies the broader issue\u2014under the current regulation, the use of specific telehealth equipment or technology cannot ensure an entity is HIPAA-compliant.[28]<\/a> Thus, the burden to utilize HIPAA-compliant telehealth platforms falls on the covered entity.[29]<\/a> If a covered entity utilizes telehealth involving PHI, the entity must comply with the same HIPAA requirements that it would if the patient visited the office.[30]<\/a> This requires the entity to have technical knowledge in order to conduct a thorough assessment of any potential risk or vulnerability that may affect the confidentiality or integrity of the patient\u2019s PHI.[31]<\/a> Pandemic or not, this level of technical compliance can be difficult for medical specialists to ascertain.<\/p>\n IV. OCR’s Notification of Enforcement Discretion<\/strong><\/p>\n During the COVID-19 pandemic, patients across the country were asked to accept a trade-off between access to remote health care and protection of their sensitive health data.[32] \u00a0<\/a>In March 2020, the United States government further relaxed its already anemic privacy standards by enacting the Notification that allowed medical providers to utilize telehealth platforms, which fell short of HIPAA privacy requirements.[33]<\/a> This Notification declared the OCR would not impose penalties for noncompliance with HIPAA regulatory requirements regarding telehealth during the pandemic, as long as the activities were carried out in good faith\u2014even if the appointment was not related to COVID-19.[34]<\/a> Without stringent privacy and security features employed, a telehealth appointment can have devastating effects on a patient\u2019s employment status, insurance ratings, and personal reputation.[35]<\/a><\/p>\n Any non-public facing remote communication products were allowed to be utilized for medical appointments, regardless of the privacy and security features.[36]<\/a> For example, this Notification allowed a provider to examine a patient utilizing a videoconferencing application on the patient\u2019s phone.[37]<\/a> Additionally, it only suggested the provider notify their patients of potential third-party privacy risks and only recommended they should utilize all encryption and privacy modes available.[38]<\/a> This waiver applied to HIPAA\u2019s Privacy, Security, and Breach Notification Rules.[39]<\/a><\/p>\n The OCR provided a list of potential video communication platforms that claimed to be HIPAA-compliant and were willing to enter into a BAA;[40]<\/a> yet did not specifically endorse them.[41]<\/a> This Notification recommended that providers concerned about additional privacy protections for their patients continue to utilize services through HIPAA-compliant vendors.[42]<\/a><\/p>\n For example, this Notification allowed medical providers to utilize the consumer version of Zoom for confidential telehealth visits.[43]<\/a> Zoom experienced a 10-fold increase in usage since the COVID-19 pandemic began, including increased use in healthcare.[44]<\/a> According to a study by Sermo, Zoom was the most common telehealth platform in use during the COVID-19 pandemic.[45]<\/a><\/p>\n Zoom has come under fire as a myriad of articles and lawsuits exposed its privacy flaws.[46]<\/a> Zoom users encountered Zoom Bombing, which occurs when someone joins a meeting they weren\u2019t invited to and \u201cdrops gross or disturbing images.\u201d[47]<\/a> Confidential secrets are easily revealed when random people join private videoconferences.[48]<\/a> For example, online classes at UCLA were disrupted by a Zoom Bomber shouting slurs and insulting individuals.[49]<\/a> Zoom Bombers have even posted pornographic content during video chats like AA meetings.[50]<\/a><\/p>\n As this Notification allowed for any non-public teleconferencing platform to be used,[51]<\/a> the privacy issues exposed here are not unique to Zoom alone\u2014Zoom likely only scratches the surface.[52]<\/a><\/p>\n This Notification of Enforcement Discretion was inadequate as it essentially stripped consumers of their right to privacy by allowing providers to utilize random videoconferencing applications with no guarantees of confidentiality or security. The importance of privacy and security concerns surrounding telehealth cannot be overlooked as medical data necessitates a higher standard of security due to its personal and sensitive nature.[53]<\/a> The effects of this Notification may be felt for years or decades to come if the medical data makes its way into the hands of data brokers,[54]<\/a> unscrupulous actors, or onto the Dark Web.<\/p>\n V. Two Years In – Where Do We Go From Here?<\/strong><\/p>\n For the past two years, medical providers and patients have become accustomed to utilizing telehealth without the safety of regulatory oversight. As the state of emergency declarations are lifted, this compliance waiver will likely end. Covered entities will no longer be allowed to utilize whatever nonpublic telehealth modality patients have chosen, and will be required to resume utilizing only telehealth platforms that comply with HIPAA.<\/p>\n In October 2021, the American Medical Association (\u201cAMA\u201d) called on the OCR to extend this Notification for yet another year, in order to provide its members with more time to adapt to HIPAA-compliant technologies.[55]<\/a> The AMA has requested that the OCR assist providers by establishing \u201cguidance documents that specifically speak to telemedicine platforms and what HIPAA requires for use of such technology.\u201d[56]<\/a> As the AMA explained, \u201cmany clinicians are using telemedicine for the first time and may not be well-versed in the unique risks and vulnerabilities associated with the new tools they are using.\u201d[57]<\/a><\/p>\n This chain of events is taking Americans\u2019 privacy concerns even further off track.\u00a0 As the AMA confirmed, medical providers are not technologists and do not specialize in decrypting the intricate privacy concerns involved with third-party applications.<\/p>\n In order to protect both health and privacy, Congress should enact a comprehensive federal regulation to require Telehealth Privacy Certification (\u201cCertification\u201d), administered by the OCR, for all platforms prior to public market release. The OCR already has a trained staff of technologists currently tasked with HIPAA auditing and enforcement. Thus, the OCR should implement a new system to standardize and simplify the necessary HIPAA-compliant technological requirements for telehealth platforms and control how personal telehealth data is maintained.[58]<\/a> This Certification should also implement one standardized BAA required for use with all approved telehealth platforms.<\/p>\n By requiring telehealth platforms to meet or exceed HIPAA regulations upfront, entities that specialize in medicine would no longer be tasked with attempting to analyze whether or not technology platforms comply with the applicable laws. Instead, medical providers can confidently focus their resources on treating patients\u2019 health concerns\u2014the true purpose of telehealth.<\/p>\n With Certification, it is possible to leverage the public health benefits of telehealth without subjecting unsuspecting patients to abusive or illicit surveillance. This long-term solution would safeguard the privacy rights of telehealth users and ensure that patients\u2019 medical data is protected\u2014both during a pandemic and beyond.<\/p>\n <\/p>\n [1]<\/a> See<\/em> Marie Fishpaw & Stephanie Zawada, Telehealth in the Pandemic and Beyond: The Policies That Made It Possible, and the Policies That Can Expand Its Potential<\/em>, Heritage Found. (July 20, 2020), https:\/\/www.heritage.org\/health-care-reform\/report\/telehealth-the-pandemic-and-beyond-the-policies-made-it-possible-and-the.<\/p>\n [2]<\/a> See<\/em> Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency<\/em>, U.S. Dep\u2019t Health & Hum. Servs., https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/emergency-preparedness\/notification-enforcement-discretion-telehealth\/index.html (last updated Mar. 30, 2020) [hereinafter Notification of Enforcement Discretion<\/em>]; Telehealth and Telemedicine: Frequently Asked Questions<\/em>, Cong. Research Serv. (Mar. 12, 2020), https:\/\/crsreports.congress.gov\/product\/pdf\/R\/R46239.<\/p>\n [3]<\/a> Jake Goldenfein, Ben Green, & Salome Viljoen, Privacy Versus Health Is a False Trade-Off<\/em>, Jacobin, https:\/\/jacobinmag.com\/2020\/4\/privacy-health-surveillance-coronavirus-pandemic-technology (last visited Sept. 19, 2020).<\/p>\n [4]<\/a> Lori Andrews, A New Privacy Paradigm in the Age of Apps<\/em>, 53 Wake Forest L. Rev. 421, 421 (2018).<\/p>\n [5]<\/a> Id.<\/em> at 424.<\/p>\n [6]<\/a> Id. <\/em>at 421.<\/p>\n [7]<\/a> Id.<\/em> at 461.<\/p>\n [8]<\/a> See<\/em> Daniel J. Solove & Danielle Keats Citron, Privacy Harms, <\/em>GW L. Fac. Publ\u2019n & Other Works, 1534, (2021), https:\/\/scholarship.law.gwu.edu\/faculty_publications\/1534\/.<\/p>\n [9]<\/a> Fishpaw, supra<\/em> note 1.<\/p>\n [10]<\/a> Hanna B. Demeke, Sharifa Merali, Suzanne Marks, et al., Trends in Use of Telehealth Among Health Centers During the COVID-19 Pandemic \u2014 United States<\/em>, June 26\u2013November 6, 2020 (Morbidity and Mortality Weekly Report)<\/em>, CDC (Feb. 19, 2021), https:\/\/www.cdc.gov\/mmwr\/volumes\/70\/wr\/mm7007a3.htm.<\/p>\n [11]<\/a> Id.<\/em><\/p>\n [12]<\/a> Telehealth and Telemedicine: Frequently Asked Questions<\/em>, Cong. Research Serv. (Mar. 12, 2020), https:\/\/crsreports.congress.gov\/product\/pdf\/R\/R46239<\/a>. While the World Health Organization limits the term \u201ctelemedicine to services provided by doctors,\u201d whereas \u201ctelehealth is broader, including services from other health providers such as nurses, psychologists and pharmacists;\u201d the terms telehealth and telemedicine are often used interchangeably. Dana Shilling, Telemedicine in the age of COVID-19<\/em>, 35 Elder L. Advisory NL 1, 1 (2020).<\/p>\n [13]<\/a> See<\/em> David A. Hoffman, Increasing Access to Care: Telehealth During COVID-19<\/em>, 7 J. L. & Biosciences<\/em> 1, 3 (2020).<\/p>\n [14]<\/a> See <\/em>Miranda A. Moore & Dominique D. Monroe, COVID-19 Brings About Rapid Changes in the Telehealth Landscape<\/em>, Mary Ann Liebert, Inc., Publishers (Aug. 14, 2020), https:\/\/www.liebertpub.com\/doi\/10.1089\/TMJ.2020.0228.<\/p>\n [15]<\/a> Id.<\/em><\/p>\n [16]<\/a> Josh Sherman, Double Secret Protection:\u00a0 Bridging Federal and State Law to Protect Privacy Rights for Telemental and Mobile Health Users<\/em>, 67 Duke L. J. 1115, 1143 (2018).<\/p>\n [17]<\/a> See id.<\/em> at 1141\u201343.<\/p>\n [18]<\/a> Kate Kaye, HHS Notice on Telehealth Penalties Raises Privacy Concerns<\/em>, Int\u2019l Ass\u2019n of Privacy Prof\u2019ls (Mar. 20, 2020), https:\/\/iapp.org\/news\/a\/hhs-notice-on-telehealth-penalties-raises-privacy-concerns\/. Chhuom worked with the Washington State Health Care Authority to utilize digital technology in its response to the COVID-19 pandemic. Chhuom has first-hand experience with patient technology as she owns Eth Tech, a digital training firm. See id.<\/em><\/p>\n [19]<\/a> Id.<\/em><\/p>\n [20]<\/a> See <\/em>Geoffrey Lottenberg, COVID-19 Telehealth Boom Demands Better Privacy Practices<\/em>, Lexis Law 360 (July 2, 2020), https:\/\/www.law360.com\/articles\/1287404\/covid-19-telehealth-boom-demands-better-privacy-practices-.<\/p>\n [21]<\/a> HIPAA, Telehealth, and COVID-19<\/em>, Cong. Res. Serv. (June 5, 2020), https:\/\/crsreports.congress.gov\/product\/pdf\/LSB\/LSB10490.<\/p>\n [22]<\/a> See id<\/em>. (A Covered Entity is one that is (1) A health plan, (2) A health care clearinghouse, or (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by 45 CFR \u00a7 160.103). HIPAA imposes obligations on covered entities, those that have entered into a Business Associate Agreement (\u201cBAA\u201d) with a covered entity, and subcontractors of covered entities or business associates. See<\/em> Business Associate Contracts<\/em>, U.S. Dep\u2019t of Health & Hum. Servs., https:\/\/www.hhs.gov\/hipaa\/for-professionals\/covered-entities\/sample-business-associate-agreement-provisions\/index.html (last reviewed June 16, 2017).<\/p>\n [23]<\/a> See<\/em> Business Associate Contracts<\/em>, supra <\/em>note 22. (A Business Associate is a person or entity, including subcontractors, who \u201cperform[s] functions or activities on behalf of, or provides certain services to, a covered entity that involve access by the business associate to protected health information.\u201d).<\/p>\n [24]<\/a> A covered entity may share PHI with another entity only after a BAA has been entered into that provides \u201csatisfactory assurances\u201d the business will appropriately safeguard the information. Therefore, the business associates themselves are directly liable for breaches of HIPAA. See<\/em> HIPAA, Telehealth, and COVID-19<\/em>, supra<\/em> note 21.<\/p>\n [25]<\/a> See<\/em> Leslie Lenert & Brooke Yeager McSwain, Balancing Health Privacy, Health Information Exchange, and Research in the Context of the COVID-19 Pandemic<\/em>, J. Am. Med. Infomatics Ass\u2019n (Apr. 26, 2020), https:\/\/academic.oup.com\/jamia\/article\/27\/6\/963\/5814212.<\/p>\n [26]<\/a> See<\/em> HIPAA, Telehealth, and COVID-19<\/em>, supra<\/em> note 21.<\/p>\n [27]<\/a> See<\/em> HIPAA, Telehealth, and COVID-19<\/em>, supra<\/em> note 21.<\/p>\n [28]<\/a> HIPAA and Telehealth<\/em>, Ctr. for Connected Health Policy, https:\/\/www.cchpca.org\/sites\/default\/files\/2018-09\/HIPAA%20and%20Telehealth.pdf (last visited Dec. 18, 2020).<\/p>\n [29]<\/a> Id.<\/em><\/p>\n [30]<\/a> Id.<\/em><\/p>\n [31]<\/a> Id.<\/em><\/p>\n [32]<\/a> Goldenfein, Green, & Viljoen, supra <\/em>note 3.<\/p>\n [33]<\/a> See Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [34]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [35]<\/a> See <\/em>Lothar Determann, Healthy Data Protection<\/em>, 26 Mich. Tech. L. Rev. 229, 256 (2020).<\/p>\n [36]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [37]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [38]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.\u00a0 <\/em><\/p>\n [39]<\/a> FAQs on Telehealth and HIPAA During the COVID-19 Nationwide Public Health Emergency<\/em>, U.S. Dep\u2019t of Health & Hum. Servs., https:\/\/www.hhs.gov\/sites\/default\/files\/telehealth-faqs-508.pdf (last viewed Dec. 17, 2020).<\/p>\n [40]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [41]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [42]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [43]<\/a> See<\/em> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [44]<\/a> Mohammad S. Jalali, Adam Landman, & William Gordon, Telemedicine, Privacy, and Information Security in the Age of COVID-19<\/em>, SSRN 1, 2 (July 8, 2020), https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3646320.<\/p>\n [45]<\/a> Deborah R. Farringer, A Telehealth Explosion: Using Lessons from the Pandemic to Shape the Future of Telehealth Regulation<\/em>, SSRN 1, 28 (Aug. 5, 2020), https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3681070.<\/p>\n [46]<\/a> See <\/em>Ajay Chawla, Coronavirus \u2013 Covid 19 \u2018Zoom\u2019 Application Boon or Bane<\/em>, SSRN (May 20, 2020), https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3606716.<\/p>\n [47]<\/a> Id.<\/em><\/p>\n [48]<\/a>\u00a0 See<\/em> Michael Goodyear, The Dark Side of Videoconferencing: The Privacy Tribulations of Zoom and the Fragmented State of U.S. Data Privacy Law<\/em>, 10 Hous. L. Rev. 76, 80-81 (2020).<\/p>\n [49]<\/a> Emily MacInnis, Students, Professors Report Multiple Incidents of Zoombombing in One Day<\/em>, Daily Bruin (Oct. 11, 2020, 6:00 PM), https:\/\/dailybruin.com\/2020\/10\/06\/students-professors-report-multiple-incidents-of-zoombombing-in-one-day.<\/p>\n [50]<\/a> Chawla, supra<\/em> note 46.<\/p>\n [51]<\/a> Notification of Enforcement Discretion<\/em>, supra<\/em> note 2.<\/p>\n [52]<\/a> See<\/em> Goldenfein, Green, & Viljoen, supra <\/em>note 3.<\/p>\n