![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.
Will Gentler HIPAA Rules on Telehealth Now Protect Us From Breach Litigation Later?
To enable medical care while encouraging social distancing during the COVID-19 pandemic, the Department of Health and Human Services temporarily loosened up on some of its HIPAA noncompliance enforcement on telehealth. But what happens if there's a PHI slip-up?
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt06c87d46d70fca2f/64f0d08bce538f271ae3f037/telemedicine_602x250.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Question: Should I worry that looser telehealth regulations now might cause me security and legal problems later?
Patricia Calhoun and Patricia Carreiro, attorneys at Carlton Fields: The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) — the government office responsible for enforcing the Health Insurance Portability and Accountability Act (HIPAA) — has exercised its enforcement discretion to not impose penalties for noncompliance with certain HIPAA rules during the COVID-19 emergency. However, this may not deter state regulators and/or private plaintiffs (i.e., patients) from suing telehealth providers if personal health information (PHI) is breached.
While HIPAA does not provide a private right of action to patients, patients can still allege (among other things) that providers' use of unsecure technology is negligent, a breach of the provider–patient contract, and/or an unfair trade practice. Depending on the provider's representations, patients could even allege fraud. While some claims can be dealt with using an early motion to dismiss, others almost always survive, typically resulting in a not insignificant settlement.
There are, however, steps providers can take to reduce their litigation exposure, including notifying patients of technology risks posed by their methods of communication, enabling all available privacy protections, only contracting with HIPAA-compliant telehealth service providers that are willing to enter into a business associate agreement, and only using approved technologies to provide their services.
And remember, even during the COVID-19 pandemic, providers are still responsible for complying with HIPAA's administrative, technical, physical, and organizational requirements.
Patricia Calhoun and Patricia Carreiro are attorneys at Carlton Fields. Ms. Calhoun is a healthcare attorney with an interest in privacy issues and Ms. Carreiro is a data privacy and cybersecurity litigation attorney.
Related Content:
A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024