Telemedicine & Mobile Health Compliance Concerns Michael H. Cohen, Esq. Robert A. Polisky, Esq.

1. Telemedicine & Mobile Health • Compliance Concerns • Michael H. Cohen, Esq. Robert A. Polisky, Esq. • www.michaelHcohen.com www.rphealthlaw.com • Annual Healthcare Law Compliance Symposium • Los Angeles County Bar Association • October 9, 2014

2. Case Study: App Developer • BACKGROUND • Treats skin conditions • Patient takes picture with mobile phone – sends to Company • Company uses outsourced Consultants to diagnose • Product roll-out: • Phase 1 – Consultants make recommendations • Phase 2 – App’s algorithm gives treatment advice

3. Overview • Who are our Clients: • Telemedicine & Mobile Health • Compliance Concerns • Licensing Issues • HIPAA Compliance • FDA Concerns • Reimbursement • Takeaways • Q&A

4. Telemedicine & Mobile Health Clients • Individual physician • Multi-state telemedicine venture • Mobile Medical App developer • Wearable tech manufacturer • “Business associate”

5. Telemedicine & Mobile Health Clients

6. Telemedicine & Mobile Health Clients

7. Telemedicine & Mobile Health Clients • http://www.curely.co/

8. Compliance Concerns Licensing • Licensure: • State law issue • “Remote State” vs. “Home State” • Hagseth v. Superior Court • Review by Colorado MD of an online questionnaire from a California resident • Prescription • Patient died • Colorado MD “prescribed” in CA • Unlawful practice of medicine by CO doc in CA • Criminal

9. Clinical Advice vs. Information • Definition of “practicing medicine:” • Diagnosis • Treatment • Operation • Prescription • Licensing required for clinical (medical) practice • Information / education as “free speech”

10. CA Medical Board (Telehealth) • Video-conferencing and store-and-forward (asynchronous) • Telephone, email, IM and fax are not telehealth • Standard of caresame as in-person • Verbal and written informed consent • Same privacy/security requirements • Need “appropriate prior exam to diagnose and/or treat the patient.”

11. Appropriate Prior Exam • Diagnosis • Usually can be virtual if: • Equivalent to in-person exam under the same standard of care • Prescription • Usually an in-person exam is required, either because: • Rules require it, or • Standard of care requires it. • “where the threshold information to obtain any accurate diagnosis has been obtained.” (NC proposed) • Controlled substances—Ryan Haight Online Pharmacy Consumer Protection Act of 2008

12. Strategic advice to clients • Options: • Avoid telemedicine in states with tough laws (e.g., NYS) • Limit telemedicine to “State MD consultation with patient’s Home State doc” • Provide only “limited and occasional patient care” in Remote State • Obtain a “special purpose telemedicine” license • Limit advice to “information/education” and use disclaimers in the terms of use

13. Strategy – Sample Disclaimer • The contents of this website are for informational purposes only and do not render medical, psychiatric, or psychological advice, opinion, diagnosis, prescription, or treatment. Use of this website does not create a doctor-patient relationship. The Company does not practice medicine and does not employ or retain any health care providers to practice medicine or any other health care profession.

14. Federation of State Medical Boards • Interstate Medical Licensure Compact (September 5, 2014) • Practice of medicine occurs where Patient is. • Remote State’s board can discipline MD/DO. • “Expedited license” • Vetting process by Remote State • Fee • Coordinated database for complaints • Joint investigations, sanctions

15. Licensing • Much legislative activity (ATA Report) • ·   Reimbursement of telemedicine by naturopathic providers (AZ) • ·   Inclusion of telemedicine in scope of practice for psychologists (AZ) • ·   Telemedicine for physical therapy and athletic training (DE) • ·   Telepharmacy (NE) • ·   Inclusion of telemedicine in scope of practice for dental therapy hygienist (NM) • ·   Telepractice for speech-language pathologists and audiologists (SC) • ·   Telemental health (WI)

16. Tele-Shrink

17. FDA • Mobile Medical App Guidance • Medical device • Intended Use • Enforcement Discretion

18. FDA • Not an MMA • • Providing general information about disease • • Organize and track health information (log blood pressure measurements) • • Help patients document, show or communicate (e.g., video-conferencing) • • Automate simple tasks for providers (like calculating BMI) • • Enable patients or providers to interact with EHR

19. FDA • Probably an MMA • Transform the mobile platform into a device, because they use the built-in feature (such as camera) to diagnose or treat disease. Example: app uses an attachment to measure blood glucose levels. • App controls the operation or function of a medical device. Example: app controls the inflation or deflation of a blood pressure cuff. • App displays, transfers, stores, or converts patient-specific medical device data from a connected medical device. Example: app connects to bedside monitor and transfers the patient’s data to a central viewing station.)

20. FDA • Maybe an MMA • • Provide behavioral tips (example: for smokers to quit) • • Provide patient-specific recommendations once patients input their characteristics such as age, sex, and behavioral risk factors • • Record a clinical conversation and send it to the patient after • • Keep track of medications and provide reminders, or compare vital signs • • Allow individuals to log, record, track, evaluate, or make behavioral decisions relating to general fitness, health or wellness, such as those that provide meal planners or recipes, calculate calories burned in a workout, help people track sleep.

21. HIPAA • Applicability for m-health? • Covered entity? • Business Associate?

22. HIPAA • Security Rule requirements include: • Security management process • Workstation security • Security incident procedures • Contingency plan • Access controls • Workstation use

23. HIPAA • Security Rule requirements include: • Workstation security • Device and media controls • Audit controls • Person or entity authentication • Transmission security

24. HIPAA • Encryption? Addressable implementation specification. • Covered entity / business associate must take into account the following factorsin deciding which security measures to adopt: • Its size, complexity, and capabilities; • Its technical infrastructure, hardware, and software security capabilities; • The costs of security measures; and • The probability and criticality of potential risks to ePHI.

25. HIPAA • Miscellaneous issues: • Compliance with state privacy laws • Business Associate Agreements with subcontractors • Distribution and acknowledgement of Notice of Privacy Practices • Training • Breach notification

26. Reimbursement - Medicare • Telehealth services covered by Medicare include consultations, office visits, psychotherapy, and pharmacologic management. • See CMS’s website. • Proposed 2015 Medicare Physician Fee Schedule: CMS proposes adding initial and subsequent annual wellness visits via telehealth if they include a personalized prevention plan of service.

27. Reimbursement - Medicare • Telehealth services need to be delivered via interactive audio and video telecommunications system. • Needs to permit two-way, real-time interactive communication between the beneficiary and practitioner. • Telephones, fax machines, and email systems do not qualify.

28. Reimbursement - Medicare • Telehealth services need to be furnished to a beneficiary located at “originating site”: • Office of a physician/practitioner • Hospital, including CAH • Rural health clinic • FQHC • Hospital-based dialysis center • SNF • Community mental health center

29. Reimbursement - Medicare • Originating site must be: • Located in a rural HPSA; • Located in a rural county outside of an MSA; or • An entity participating in a federal telemedicine demonstration project, regardless of geographic location.

30. Reimbursement - Medicare • Eligible distant site practitioners: • Physician • PA • NP • Clinical nurse specialist • Nurse midwife • Clinical psychologist • Clinical social worker • Registered dietician / nutrition professional

31. Reimbursement - Medicare • The service must be within a practitioner’s scope of practice under state law. • The beneficiary’s exam needs to be under the control of the distant site practitioner.

32. Reimbursement - Medicare • A medical professional is not required to present the beneficiary to the distant site unless medically necessary. • Medicare pays an originating site fee to the originating site and provides separate payment to the distant site practitioner for furnishing the service. • See 42 CFR § 410.78; Medicare Benefit Policy Manual, Ch. 15, § 270; Medicare Claims Processing Manual, Ch. 12, § 190.

33. Reimbursement – Medicaid • State Medicaid programs have flexibility to determine whether and to what extent they cover telehealth services. • 47 state Medicaid programs, including California’s, provide some type of coverage for telehealth. (American Telemedicine Association, Sept. 2014)

34. Reimbursement – Medi-Cal • California law: appropriate telehealth services must be covered and reimbursed under the Medi-Cal program. (CA Welfare and Institutions Code § 14173.72) • Setting not limited for the originating site. • Except for teleophthalmology and teledermatology, telehealth needs to be delivered via a real-time interactive communications system.

35. Reimbursement – Medi-Cal • Medi-Cal will reimburse for store-and-forward services for teleophthalmology and teledermatology. (CA Welfare and Institutions Code § 14173.725) • Medi-Cal reimburses originating site and practitioner.

36. Reimbursement – Commercial • 21 states (including California) and D.C. have parity laws requiring that commercial payors cover telehealth services the same as they cover in-person services (American Telemedicine Association, Sept. 2014) • Commercial payors in many other states cover at least some telehealth service, and have expressed interest in expanding their telehealth coverage. (American Telemedicine Association)

37. Reimbursement – Commercial • California parity law prohibits health insurers and health care service plans from doing either of the following with respect to covered services appropriately provided through telehealth: • Requiring in-person contact between patient and provider; or • Limiting setting for originating site or practitioner. • (CA Insurance Code § 10123.85; CA Health & Safety Code § 1374.13)

38. Case Study – HIPAA & Reimbursement • HIPAA • Applicability • Privacy and Security Rules • Business associates • Reimbursement • Medicare • Medi-Cal

39. Case Study – Licensing & FDA • Licensing issues • Use of Consultants • Mobile medical app issues • Smart App Dilemma

40. The Future • Blurring of lines of between medical advice (regulated) vs. general wellness (education/information) • Overlap between state-law regulation of physical providers (licensing laws) and federal regulation of healthcare products (FDA rules) • Trends • More ease of licensing and greater reimbursement • Technology continually outpacing regulation • Edgy clients pushing technological & regulatory boundaries

41. Telemedicine & Mobile Health • Compliance Concerns • Michael H. Cohen, Esq. Robert A. Polisky, Esq. • www.michaelHcohen.com www.rphealthlaw.com • Annual Healthcare Law Compliance Symposium • Los Angeles County Bar Association • October 9, 2014 • www.michaelhcohen.com