Health care providers and other entities face a host of legal and practical challenges as they implement telehealth and telemedicine initiatives.

For example, providers of telehealth services, and the entities creating or hosting telehealth platforms, must determine which federal and state privacy and security laws apply to them.  These laws, such as the federal Health Insurance Portability and Accountability Act (HIPAA), may impose privacy and security restrictions, as well as restrictions on the use of data for marketing.  Additional privacy and security complications may arise if providers choose to store data from telehealth encounters on the “cloud.”

Provider licensing laws also affect the provision of telehealth; these vary from state to state and may prevent providers from remotely treating patients in other states.  The Federation of State Medical Boards, a non-profit group representing state medical boards, is currently developing an Interstate Medical Licensure Compact which would expedite the licensure process for physicians looking to practice in multiple states, and would regulate which state medical board has jurisdiction over cross-border medical interactions.  Similarly, telehealth makes provider credentialing and privileging decisions more challenging.

Given the sometimes overlapping jurisdiction of federal and state agencies, there is also some uncertainty regarding which agencies will regulate and oversee various aspects of telehealth.  For example, the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services enforces HIPAA.  The FDA’s Center for Devices and Radiological Health (CDRH) ensures the safety and effectiveness of “medical devices” used in telehealth systems.  Similarly, the FTC has become increasingly involved in the health care sphere and may use its authority to protect patients from “unfair or deceptive acts or practices”; the FTC has also asserted jurisdiction over certain health care data breaches.

Telehealth also raises novel questions regarding medical liability.  For example, it is unclear whether liability could attach to a failure to identify patterns flagged by remote monitoring technologies or in health-related apps used by patients.  Additionally, where providers treat patients in other states, it is not certain which state medical liability laws or standards of care will apply, and whether medical malpractice policies will cover suits arising from these interactions.

In addition to these legal and regulatory questions, practical considerations in telehealth expansion include gaps in broadband access, rapidly changing technologies, and the fact that telehealth may not easily fit into a providers’ current practice patterns.  Finally, reimbursement practices are inconsistent across public and private payers, making the financial viability of telehealth programs uncertain.