It was a question no government official probably ever expected to face, yet this is no ordinary time: Could a quarantined physician provide telehealth services from home or from a quarantine area and not violate HIPAA?

Before answering, Tim Noonan, with the HHS Office for Civil Rights (OCR), briefly paused to reflect on the gravitas of the question.

“So, first, let me say, I do appreciate the willingness of a physician who’s quarantined to want to continue to serve the public by offering to provide telehealth services,” said Noonan, deputy director for health information privacy. “It seems in every crisis there are stories of selfless acts that occur that reflect our good nature and spirit.”

The answer to whether a physician could care for patients under that circumstance is yes, Noonan said.

Telehealth was the topic of a notification of enforcement discretion and FAQs OCR issued in March.^[1] At that time, OCR was envisioning a doctor still in an office and a patient at home, according to its FAQ document. But as increasing numbers of health care providers themselves are falling ill with COVID-19, this specific situation must have arisen for at least one participant in a recent wide-ranging webinar that OCR hosted.^[2]

“Our guidance supporting the notification stated our expectation that health care providers would ordinarily conduct telehealth in private settings and recommended some reasonable safeguards for instances when it cannot be performed in a private setting,” Noonan said.

The webinar, which also featured Marissa Gordon-Nguyen, OCR senior advisor for health information privacy, was itself unusual, marking the first time in memory OCR officials have held such an event. But as Noonan explained, agency staff have not been able to appear in person at any events, and wanted to help explain the myriad documents OCR has been releasing related to COVID-19.

Even for those HIPAA compliance officers who’ve been trying to keep up with OCR’s guidance and FAQs, the webinar offered important insights and nuances, as well as reminders. Of particular note: Covered entities (CEs) and business associates (BAs) should be aware that “good faith” and “reasonableness” are two key considerations that OCR officials are keeping in mind during the pandemic—even as they offer assurances that they’ll show mercy if HIPAA violations occur.

As Noonan put it: “the HIPAA rules are not suspended.”

The webinar occurred on the heels of OCR’s three notices of enforcement discretion related to COVID-19 and HIPAA compliance activities and a number of separate “bulletins” (of which one was about enforcement discretion). The first, issued March 17, described strategies that CEs should use with telehealth technologies, stressing the use of those that offer encryption and other security features.^[3]