Summary of Changes to the Telemental Health Landscape Due to the COVID-19 Emergency

Author: Roy Huggins, LPC NCC

HIPAA Security

In short: HIPAA will temporarily allow the use of videoconferencing services we would normally see as unacceptable due to a lack of Business Associate Agreements. HHS specifically called out “Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype” as viable options.

The Department of Health and Human Services released a temporary rule change which affects which software services can be used for telehealth without fear of penalty under HIPAA. The announcement, called the “Notification of Enforcement Discretion for telehealth,” makes the following statements:

OCR is exercising its enforcement discretion to not impose penalties for noncompliance with the HIPAA Rules in connection with the good faith provision of telehealth using such non-public facing audio or video communication products during the COVID-19 nationwide public health emergency. This exercise of discretion applies to telehealth provided for any reason, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19. … Under this Notice, covered health care providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency. 

Cited from:

In my experience, this is an unprecedented level of specificity in rulemaking or guidance from HHS. 

They are clear that services which are visible to the public are not acceptable. For example, they state:

Under this Notice, however, Facebook Live, Twitch, TikTok, and similar video communication applications are public facing, and should not be used in the provision of telehealth by covered health care providers. 

Cited from:

They also state that if a clinician uses a service that normally would not be allowed under HIPAA, the clinician needs to inform patients/clients that there are privacy risks involved in the use of the software. 

This change is welcome for several reasons, including the fact that many online services are having difficulty carrying the load of increased traffic during this emergency. The availability of numerous backup options allows us to spread the load around. 

This change also makes it easier to ensure that telehealth services are appropriate for clients. 

For example, older seniors are especially vulnerable at the moment due to being isolated from loved ones for their safety. This population typically has a very hard time using videoconferencing software. Receiving an Apple Facetime video call, however, can be as simple as answering their phone. Before the emergency, Facetime was likely unacceptable under HIPAA. Now it is acceptable during the emergency, which makes access to care for certain populations far more viable.

Cross-State Practice

In short: more and more US states are temporarily allowing cross-state practice with clients who are within their borders at the time of session. 

During the COVID-19 response emergency, many licensing boards and state governors are enacting temporary rules which permit out-of-state clinicians to work within their borders. 

At the time of writing, Colorado and Ohio were 2 of several states where this occurred in some form. 

Colorado released a blanket allowance for all health care providers who possess a license to practice in any US state to practice telehealth with patients located in Colorado. 

In Ohio, there was a more limited rule made by the CSWMFT board (the board for Counselors, Social Workers, and Marriage and Family Therapists.) That rule allowed clinicians of those professions, who are licensed in other states but not in Ohio, to work with clients in Ohio despite their lack of Ohio licensure. 

Many more rules like this were made at the time of writing, and far more are expected to come. If your client is present in a state where you are not licensed, check with the board there to see if they are allowing out-of-state practitioners. During the COVID-19 emergency, they may start doing so.


In short: Restrictions on telehealth reimbursement and coverage are being quickly lifted, and many private insurers are paying for phone sessions (before the emergency, they nearly always paid only for secure videoconferencing sessions.) Medicare has also lifted many restrictions. 

All clinicians will still need to check with their panels to see exactly what changes have been made. Several organizations and individuals are attempting to collate the emergency insurance policies within their state. Try contacting your state professional association to see if they have any information on that. 

An excellent source of information on reimbursement policies, especially from Medicare, is the Center for Connected Health Policy.