On April 11, the Department of Health and Human Services Office of Civil Rights (OCR) announced the expiration of COVID-19 Public Health Emergency (PHE) HIPAA Notifications of Enforcement Discretions. With the announcement of the end of the PHE in January, using HIPAA non-compliant communications platforms for telehealth will expire with the PHE on May 11.

OCR stepped in to clarify their regulatory enforcement discretions will give health care providers utilizing noncompliant telehealth a 90-day transition period to come into compliance with the HIPAA rules around telehealth provision. Instead of the waiver for non-compliant telehealth services ending May 12 with the end of the PHE, non-compliant telehealth services can be used until August 9, 2023, with the expectation that providers are working to come into compliance with HIPAA expectations. During this time, from May to August, OCR will not impose penalties on covered providers for noncompliance in connection with good faith provision of telehealth services. OCR stated they will have additional resources for providers during the transition period. Resources for compliance support:

• HIPAA and Telehealth
• HHS Releases Guidance on Audio-Only Telehealth Services