In new guidance, the HHS Office for Civil Rights (OCR) said that audio-only telehealth services may flip the switch of the HIPAA security rule, depending on the type of phones used (traditional landlines vs. electronic communication technology).^[1] At the same time, OCR explained that audio-only telehealth generally complies with the HIPAA privacy rule, as long as covered entities observe basic protocol, such as verifying the identity of the patient and minimizing the risk of incidental disclosures.

The subtext of the guidance seems to be OCR preparing for permanent Medicare coverage of audio-only telehealth, said Richelle Marting, an attorney in Olathe, Kansas. So far, Congress has extended Medicare coverage of audio-only for 151 days beyond the end of the COVID-19 public health emergency (PHE) in the 2022 Consolidated Appropriations Act, although she noted that CMS could permanently cover audio-only telehealth delivery through rulemaking.^[2] OCR in 2020 announced HIPAA enforcement discretion for telehealth provided during the COVID-19 PHE, and Marting doubts OCR would clarify the confluence of HIPAA and audio-only telehealth unless it saw a promising future for audio-only telehealth delivery.^[3]