Legal, Regulatory, and Ethical Issues in the Use of Telemedicine



Fig. 10.1
Concept diagram of a fully developed patient-centered medical home (PCMH) to include Multiple telemedicine applications. Clouds represent existing remote technology (orange) or future applications (gray). Green lines represent “virtual” movements via telemedicine communications. CC o care coordinator office, CC H care coordinator hospital, CC NH care coordinator nursing home, CC LTAC care coordinator long-term acute care hospital, CCAo, CCA H , CCA NH , CCA RH l, CCA H CCA LTAC , (“A” represents actions performed by the respective care coordinators), IM internal medicine, FP family practice, OB obstetrics and gynecology, RN registered nurse, PA physician’s assistant, NP nurse practitioner, PT physical therapy, OT occupational therapy, SLP speech language pathologist, NH nursing home, SNF skilled nursing facility



The political landscape driving telemedicine forward versus the evolving barriers to expansion of telemedicine are significant. On the one hand, during 2013, 15 state medical boards and state legislatures considered proposals to revise standards for telemedicine suggesting high level of interest [15]. On the other hand, some states are imposing standards for the practice of telemedicine that are higher or more cumbersome than the practice of face-to-face medicine. Some have considered requiring an initial face-to-face encounter prior to any telemedicine encounters in order to qualify for reimbursement mostly in a direct to consumer-type model, which could effectively challenge emergent stroke telemedicine, most of the tele-ICU activity, emergent cardiac consultation, etc. Similar requirements have been proposed for establishing “physician–patient relationship” prior to any telemedicine encounters with a similar impact upon emergent consultations. If such regulations were to be implemented, large telemedicine networks, such as tele-ICU programs, where the physician may never meet the patient face-to-face, would be impossible. Similarly, certain state medical boards have considered requiring very complex and demanding patient consent for telemedicine, far in excess of what is done with traditional face-to-face medicine. Furthermore, some states have mandated a tele-presenter be with the patient and require a subsequent face-to-face encounter after the telemedicine encounter. All of the above act as barriers to intrastate practice of telemedicine in certain states. Medical licensure remains the primary barrier to interstate practice of medicine which may be changing with the new Federation of State Medical Board (FSMB) ruling in favor of license sharing between states. How states choose to adopt and implement this remains to be seen.

The American Telemedicine Association (ATA) has published the “State Telemedicine Gap Analysis: Physician Practice Standards and Licensure” in 2014 [15]. This document should be consulted for the specific limitations and requirements in each state. Other than licensure issues, which are discussed later, several issues are noted in the ATA gap analysis.





  • Tele-presenter required to be on-site: six states


  • About half of the USA requires a pre-, post-, or intra-event face-to-face visit


  • About seven states require some form of patient consent


  • Regarding nuances of licensure requirement, essentially every state has at least one barrier to interstate practice of telemedicine when the physician does not already have full state licensure. Options available to the State Medical Boards to facilitate interstate practice of telemedicine include accepting physician-to-physician consultations without licensure, full reciprocity or reciprocity of bordering states, and/or conditional or limited telemedicine licenses limited to telemedicine

Clearly, it is a fluid time in the regulatory atmosphere surrounding telemedicine. The following sections are designed to educate the reader regarding ethics, regulatory, medical legal aspects, practical administrative aspects, legislative, licensure, and reimbursement issues. We will also review barriers to the growth and expansion of telemedicine: known, potential, and future.



General Principles of Patient Management


Several basic principles must be considered when using telemedicine technologies such as fundamental ethical principles, establishment of the patient–physician relationship, patient privacy, confidentiality, and informed consent (informed decision-making). Furthermore, when using either asynchronous (not in real time: see appendix) or synchronous (occurring in real time: see appendix) telecommunication systems to exchange information, consult, or provide direct care, additional procedures may be required to ensure that the telemedicine encounter is both ethically sound and functional. It is imperative when providers embark on using technology in the management of patients, the following is considered:





  • Is the telemedicine/telecommunication process ethically sound for a particular patient and/or situation?


  • When is the patient–physician relationship established?


  • Is the patient information kept private, confidential, and secure before, during, and after a telemedicine encounter?


  • What delivery model and treatment methods are best for meeting the patient’s care needs?


  • How and when is informed consent obtained?


Ethical Principles


Ethical principles applicable to traditional in-person encounters apply equally for the telemedicine evaluation and management of patients including non-maleficence, beneficence, fidelity, justice, and patient autonomy [16, 17]. In general, as stated by the FSMB, “there should be parity of ethical and professional standards whether care is rendered face-to-face or remotely” [18]. The accepted definitions of each ethical principle with relevant discussion related to the application in telemedicine are presented as follows:





  • Non-maleficence (do no-harm) and beneficence (do good):





    • Non-maleficence: It requires that a procedure or therapy do no harm to the patient involved, to others, or to society in general. If there is a risk of harm, the risk versus benefit must be understood and judged generally in favor of benefit.


    • Beneficence: Procedures and therapeutics be provided with the intent of doing good for the patient. This implies that, health-care providers are capable of doing good and therefore, must maintain the skills and knowledge necessary to provide net benefit.

The FSMB in their Model Guidelines for State Medical Boards Appropriate Regulation of Telemedicine [19] has opined that “the evaluation, treatment recommendations when made via telemedicine technologies will be held to the same standards of practice as when making the same evaluations during traditional in person encounters.” Specifically, when the technology is appropriate for the care being provided and provides benefit, and the provider maintains the necessary skills, concepts of non-maleficence and beneficence are met. Generally, telemedicine would not be appropriate for performance of surgical procedures in today’s landscape but could be appropriate for remote monitoring and proctoring during surgical procedures, if needed. Telemedicine is highly appropriate for tele-mental health or any of the disease states characterized by review of symptomatology and provision of advice. In highly monitored environments, such as the intensive care unit, where decisions are largely made based upon monitoring data, risk of harm would parallel on-site care and yet be fully translatable to the remote environment while providing benefit by early preemptive interventions. Telemedicine would be ethically appropriate for “store-and-forward” interventions such as tele-dermatology, tele-pathology, or teleradiology where direct provider-to-patient interaction is typically limited. In these examples, the telemedicine patient receives beneficence by increased access to specialty care, increased timely care yet no perceived enhancement of risk.





  • Justice (be fair): Health care must be fairly distributed, scarce resources allocated and competing needs, rights, and obligations be fairly considered, and conflicts with established legislation resolved while upholding existing laws. Risks, burdens, and benefits of new or experimental treatments must be distributed equally among all groups. Fundamentally, telemedicine reduces barriers to health care to include distance, time, and/or burdens of travel. The principle of justice is, therefore, well served via telemedicine through improved distribution of health care and reductions in the disparities of health care. With wide application of telemedicine, those living in rural areas could enjoy similar health care to those in the major metropolitan areas. Disparities in the distribution of specialists, such as gastroenterologists with unique intellectual expertise, can be largely mitigated.


  • Patient autonomy (patient choice): The patient (or patient’s legitimate surrogate) must maintain autonomy of thought, intention, and action when making decisions regarding health care. This implies that the patient has mental “capacity” and/or the surrogate is rational without external motives. With telemedicine, the patient maintains full autonomy and can always opt out of the interaction with the rare exceptions of telestroke cases. In some cases, where extensive informed consent is mandated, autonomy is greater than the face-to-face encounters, which do not require such level of prior informed consent. There are certain situations, such as the tele-ICU, where that patient may not be interactive and surrogate not available. However, most of these environments have global informed consent at time of admission. To complete informed consent, patients should be given the risks and benefits of the tele-encounter.


  • Fidelity (patient first): Fidelity [20] requires care providers to maintain the patient’s trust and confidence by keeping their patients’ interests first in their mind above all others. The principle of fidelity is upheld through the relationship established between the patient and the physician with telemedicine technologies. The care provider is able to attend to patients’ needs more frequently and more on the patients’ terms (such as from their home), satisfying patient fidelity.

Ultimately, the basic ethical foundations to medicine are to be applied independent of how the medical service is delivered or advice provided. A simple telephone call between a care provider and patient, store-and-forward interpretation of a radiograph, an emailed image of a skin lesion, or a full face-to-face real-time audio-video all must be founded in the same underlying ethical principles.


Patient–Physician (Provider) Relationship


The American Medical Association (AMA) [21] emphasizes the importance of establishing the patient–physician relationship as a core aspect of medical ethics. Certain technologies have challenged the medical community in defining the process of how and when a patient–physician relationship is established. Therefore, before engaging in any forms of telemedicine, it is crucial to have knowledge and follow any current international, national, state, and specialty practice standards for establishing the patient–physician relationship.

According to the Council on Medical Services [22] of the AMA, this relationship can be established in-person or with real-time audiovisual equipment [23]. However, the 2014 ATA State Telemedicine Gap Analysis [15] reported that certain states mandate physician practice standards for telemedicine that are very stringent requiring the patient–physician relationship be established through an in-person exam or a visit prior to any telemedicine encounters. Furthermore, some states may require a separate in-person visit for prescribing medications while other aspects such as consultation may not. The ATA has developed operational and specialty guidelines to direct providers to current best practices and resources [24].

Miller [25] reported in a review of 38 studies, the use of telemedicine elicited a high degree of satisfaction regarding physician communication, and supported its use in establishing patient-centered relationships. Others [26] have cautioned that quality of and methodology(s) used for interactions between the physician and the patient should be evaluated to ensure communication is open and clear. As it may be difficult to communicate when face-to-face, so it may also be difficult when done so remotely. As a consequence of the seeming disarray between the states and to foster wider adoption to telemedicine/telehealth, the FSMB recently proposed “Model Guidelines for State Medical Boards Appropriate Regulation of Telemedicine” [19]. These guidelines are provided as a template for a more unified approach to growing telemedicine. The following are several specific points from the guidelines:





  • The FSMB guidelines support a consistent standard of care and scope of practice independent of the delivery tool enabling physician-to-patient communications.


  • The “physician–patient relationship” can be established during a telemedicine encounter and would not necessarily have been established before an encounter. But in doing so, the physician should:



Verify the identity and location of the patient to the extent possible

The physician should disclose his/her identity and credentials

Obtain the patients consent, written or verbal after disclosing the technology and limitations (FSMB language is silent on the value of video recording verbal consents)





  • The remote care provider must arrange for follow-up and develop a mechanism for transfer of information from the telemedicine encounter to follow-up medical personnel when necessary.


  • A mechanism should be established to arrange or refer patients for emergency care in the event where such care is needed.


Information Exchange and Patient Privacy


The Health Insurance Portability and Accountability Act (HIPAA) [27] of 1996 charged Department of Health and Human Services (HHS) to establish regulations for electronic data transmission and security standards. Embedded in these rules are privacy regulations with regard to patient information being transmitted electronically that went into effect in 2003. The general foundation is that the same “laws and regulations governing on-site patient health-care records” apply to telemedicine providers [18, 19]. And, since telemedicine is not static, consideration should be given to how patient information is exchanged before, during, and after a telemedicine encounter. All entities in the chain of patient information exchange must address local security concerns by maintaining a secure server, having unique individual passwords with access set up on a need-to-know basis and timed automatic return to screen savers. Additionally, these safeguards should be internally and continuously audited with random checks to ensure users are compliant. Because of the complexity of HIPAA, there remains the real risk of “horror stories” related to unintended HIPAA violations [28].

Compliance with these regulations requires that the patients be informed that their data is being sent electronically to a remote site. In addition, HIPAA establishes that the federal regulations will supersede state regulations when there is regulatory conflict although practitioners will remain subject to the state regulations. The HIPAA laws have evolved like many federal regulations. Under the recent potential threats of an international outbreak of ebola, HHS issued a recent bulletin on “HIPAA Privacy in Emergency Situations” [29] allowing for much more liberal exchange of personal health information (PHI) when there is a national threat.

Simple and practical guidelines would suggest that the provider conducting audiovisual telemedicine encounters should do so in a private room where passersby and other health-care workers cannot see or overhear. The patient should be made aware of any additional persons in the audience at the distant site.

Both synchronous and asynchronous encounters must follow regulatory standards for encryption. Encryption [30] is the coding of the transmitted information to minimize the chances of unauthorized individuals understanding the information. Furthermore, decryption tools (technology for reversing the coding) should be stored on a device or location separate from where the data are being encrypted. The National Institutes of Standards and Technology (NIST) has provided encryption guidelines for both Personal Health Information (PHI) “in motion” during transmission and information “at rest” or information “in storage” [31].

Telehealth resource centers [32] are an excellent resource for providers to access operational, legal and regulatory, training, and program development tool kits to ensure that the telemedicine environment is both ethical and functional. Telehealth resource centers are regional centers of expertise to help with operational and logistical issues associated with the safe practice of telemedicine.


Informed Consent


Although telemedicine technology is available in many forms, the technology may not be the right fit for all situations. “Informed Consent” should begin with the care provider determining whether the patient is comfortable with and has the ability to use the technology required during the telemedicine encounter. In some cases, the patient may simply need assistance at the “originating site” from a nurse or other medical personnel converting a bad-fit situation into a good-fit situation.

The FSMB (2014) in their Model Policy for the Appropriate Use of Telemedicine recommends support of patient autonomy by obtaining and maintaining informed consent [19]. Informed consent includes the patient’s right to make decisions in accordance with the 1990 congressional Patient Self-Determination Act (PSA) [33, 34].

According to FSMB, at a minimum, informed consent should include the following:

(note: significant overlap with physician–patient relationship as noted previously)





  • Identification of the patient.


  • Identification of the physician and the physician’s credentials.


  • Types of interaction permitted using telemedicine technologies (e.g., prescription refills, appointment scheduling, patient education, virtual examination, therapeutics, etc.).


  • The patient agrees that the physician determines whether or not the condition being diagnosed and/or treated is appropriate for a telemedicine encounter.


  • Details on security measures taken with the use of telemedicine technologies, such as encryption, password-protected screen savers and data files, or utilizing other reliable authentication techniques as well as potential risks to privacy notwithstanding such measures.


  • Hold harmless clause for information lost due to technical failures.


  • Requirement for expressing patient’s consent to forward patient-identifiable information to a legitimate third party.

In addition, the patient should be informed and give consent to any audio or video recording of the tele-encounter. Furthermore, written policies and procedures should be created to outline privacy, all health-care personnel who will process information, hours of operations, types of electronic transmissions, archival and retrieval of information, and quality oversight [18]. The authors of this chapter do not necessarily endorse all the FSMB requirements and judge some elements to be excessive.


Regulatory


Telemedicine is directly and indirectly regulated by a variety of national and state regulatory agencies. The Center for Medicare and Medicaid Services (CMMS) [35, 36] has set general guidelines for eligibility, established acceptable providers and locations, and limited billing codes for Medicare-related telemedicine encounters (see section “Coding for Reimbursement for Telemedicine Services”). The Food and Drug Administration (FDA) [37, 38] has established regulations for nondrug, medical devices to include a rating and classification system for medical device data systems (MDDS) and medical information storage and communications Devices (i.e., picture archiving systems for radiology) (Table 10.1).




Table 10.1
Federal Food and Drug Administration classification of medical monitoring devices




























Device type

Classification

Medical device data systems (MDDS)

Class I

Medical information storage and communications devices

Class I

Picture archiving systems for radiology (PACS)

Class II

Nurse call systems

Class II

Active patient monitoring

Class II or III

Clinical decision support

Probably Class II


Class I: “Low Risk” device, Class II: “Moderate Risk” device, Class III: “High Risk” device

Generally, devices used for telemedicine monitoring are MDDS Class I which are defined as devices that store, transfer, or display information without modifying the information.

The Joint Commission (JC) [39] has focused primarily on the interaction of medical staff and the hospital. The Agency for Healthcare Research and Quality (AHRQ) with its “Health Information Portfolio,” via granting opportunities is promoting a national “strategy to put information technology to work in health care by developing secure and private electronic health records for Americans, and making health information available electronically when and where it is needed” [40]

Ultimately the AHRQ is developing quality indicators to measure telemedicine projects. The positive granting opportunities countered by potentially burdensome quality monitoring obligations could impact a beginning telemedicine programs. Finally, the HHS, primarily via the Health Resources Services Administration (HRSA) [41], aims to increase the utilization of telehealth to improve the care of underserved primarily through developmental initiatives such as:





  • Promoting partnerships between HRSA, other federal/state agencies, and private sector for the creation of telehealth projects.


  • Administering telehealth grant programs such as telehealth resource centers.


  • Providing technical assistance.


  • Evaluating the use of telehealth technologies and programs.


  • Developing telehealth policy initiatives to improve access to quality health services.


  • Promoting knowledge exchange about “best telehealth practices.”

While HRSA works primarily on the developmental side of telemedicine, each grant will have its incumbent reporting obligations.


Credentialing and Privileging


The rules for credentialing at Medicare facilities are primarily determined by CMMS. In 2008, CMMS established independent rules for telemedicine credentialing that required each individual physician engaged in the practice of telemedicine to be independently and fully credentialed at each hospital where the care was being delivered. Prior to the CMMS ruling, telemedicine credentialing could follow the Joint Commission (JC) rules that allowed for credentialing by proxy. In 2009, the JC revised their rules for telemedicine to fall more in line with those of CMMS mandating that all practitioners be completely credentialed at each facility where the care is being delivered without the use of credentialing by proxy. Subsequently, in 2011, the CMMS reversed its position, issuing the current rules which allow for credentialing by proxy under the following circumstances:





  • The originating hospital (site where the patient is located) can rely on distant site (where the care provider is located) for credentialing and privileging.


  • The distant site must be a Medicare-participating hospital or telemedicine entity.


  • There must be written agreements between the originating and distant entity establishing the practice agreement: Memorandum of Understanding (MOU).


  • The distant Medicare-participating hospital or entity must ensure Medicare compliance.


  • The distant site must provide a list of privileges for all of the providers to the originating site.


  • The distant site practitioner must hold an active license to practice medicine in the originating site’s state.


  • The originating hospital must maintain an internal review of the practitioners’ performance, reporting all adverse events to the distant site.

From the hospital perspective, credentialing can significantly inhibit development and maintenance of a new telemedicine service. Smaller hospitals reliant upon limited medical staff offices may find processing a sudden onslaught of applications daunting ultimately delaying initiation of telemedical services. Additionally, the telemedicine-related credentialing may also add significant personnel requirements or overhead costs to the local hospital. Beyond the initial credentialing, the medical staff office will need to manage the work load of biannual reappointments.

When initiating a new telemedicine program, telemedicine credentials and delineation of privileges (DOP) may not exist at a specific facility. Development of policy [42], credentials, and DOP could require a medical staff by-law’s change or amendment before the credentialing process may proceed, again adding expense and delay to start of a telemedicine program. Knowledgeable medical personnel or direct consultation with the telemedicine vendor/organization will be required to specify the DOP [43, 44] and render the DOP consistent with the hospital DOP format.

Since telemedicine physicians are generally not local, the telemedicine-privileged physicians cannot be required to serve on local hospital committees, take emergency room call, may not be available for on-site interviews, and unable to attend the minimum required number of medical staff meetings. Consequently, telemedicine privileges may require a significant deviation from the usual standards required of full-time staff. Allowances in requirements are necessary but can cause consternation and resistance to change from existing staff members. Other considerations include medical staff application fees and yearly staff dues. Since the remote telemedicine staff may arguably participate differently with the hospital, there may be room to negotiate these fees or at the very least budget for the fees when designing a telemedicine program.


Compliance


Authorization for payment of telemedicine services was initiated in 1997 with the Balanced Budget Act [45]. Imbedded within that law was a directive to Medicare to initiate reimbursement for certain specific telemedicine services. Reimbursement for telemedicine was expanded in the year 2000 via the Medicare, Medicaid, and SCHIP Program Benefits Improvement Act [46]. With the foundation laid for payment of telemedicine services, issues of fraud and abuse were raised [47]. For instance, concerns about violations of the “Anti-Kickback-Law” have been raised but no in-fact violations have been reported to date. But the law continues to evolve [48] and subtle violations could easily go unnoticed by a program administrator. Specifically, the Anti-Kick Back-Law states:



it is illegal to “knowingly and willfully” offer or pay “remuneration” directly or indirectly, overtly or covertly, in cash or in kind to “induce” a person to (1)“refer” a person to someone for the furnishing (or arranging for the furnishing) of any item or service for which payment may be made under a federal health care program; (2) “purchase” or “order” any item or service for which payment may be made under a federal health care program; or (3) “arrange for or recommend” purchasing or ordering any item or service for which payment may be made under a federal health care program.

Violations of the Anti-Kickback- law could be as obscure and subtle as a physician accepting an e-venture offer to establish a free website. This could be construed as “in-kind remuneration” and therefore a violation of Anti-Kickback-Law. The “Ethics in Patient Referral Act” [49], commonly known as the Stark law (or Stark I and Stark II as the law evolved), was passed in 1989 which disallowed physicians from referring Medicare patients to clinical labs in which they had financial interest. This law has gone under multiple evolutions [50] and continues to evolve. As there seems to be little or no case law pertaining to self-referral neither within telemedicine networks nor specific telemedicine-related language in the law, it is easy to imagine that a financially vested individual could easily violate the spirit of Stark law within physician-owned telemedicine systems.

Only gold members can continue reading. Log In or Register to continue

Stay updated, free articles. Join our Telegram channel

May 9, 2017 | Posted by in GENERAL & FAMILY MEDICINE | Comments Off on Legal, Regulatory, and Ethical Issues in the Use of Telemedicine

Full access? Get Clinical Tree

Get Clinical Tree app for offline access