What entities are included and excluded under the Notification of Enforcement Discretion regarding COVID-19 and remote telehealth communications?

The Notification of Enforcement Discretion issued by the HHS Office for Civil Rights (OCR) applies to all health care providers that are covered by HIPAA and provide telehealth services during the emergency. A health insurancecompany that pays for telehealth services is not covered by the Notification of Enforcement Discretion.

Under the Health Insurance Portability and Accountability Act (HIPAA), a “health care provider” is a provider of medical or health services and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. Health care providers include, for example, physicians, nurses, clinics, hospitals, home health aides, therapists, other mental health professionals, dentists, pharmacists, laboratories, and any other person or entity that provides health care. A “health care provider” is a covered entity under HIPAA if it transmits any health information in electronic form in connection with a transaction for which the Secretary has adopted a standard (e.g., billing insurance electronically). See 45 CFR 160.103 (definitions of health care provider, health care, and covered entity).

By contrast, a health insurance company that merely pays for telehealth services would not be covered by the Notification of Enforcement Discretion because it is not engaged in the provision of health care.