Telehealth expanded dramatically in response to the COVID pandemic. Now that providers, patients, payers and public officials have seen the benefits, it is almost certain that telehealth will continue to play an increasingly important role in our healthcare delivery system. Providers wishing to practice telehealth in Idaho (and elsewhere) must beware the legal and practical requirements, including those set forth in statute or licensing board regulations.
1. Licensure. Many states eased or waived licensure requirements during the COVID pandemic; however, absent such a waiver, the general rule remains that a provider wishing to practice telehealth must be licensed in the state in which the patient is located. Idaho’s Telehealth Access Act (“the Act”) provides:
A provider offering telehealth services1 must at all times act within the scope of the provider's license and according to all applicable laws and rules, including, but not limited to, this chapter and the community standard of care.
(Idaho Code § 54-5704).
"Provider" means a person who is licensed, required to be licensed, or, if located outside of Idaho, would be required to be licensed if located in Idaho, pursuant to title 54, Idaho Code, to deliver health care consistent with his or her license.
(Id. at § 54-5703(4)).
Idaho Board of Medicine regulations confirm that an Idaho license is generally required for physicians, physician assistants and certain other practitioners to provide telehealth services in Idaho:
IDAHO LICENSE REQUIRED. Any physician, physician assistant, respiratory therapist, polysomnographer, dietitian, athletic trainer, or naturopathic medical doctor who provides any telehealth services to patients located in Idaho must hold an active Idaho license issued by the Idaho State Board of Medicine for their applicable practice.
(IDAPA 24.33.03.202). During the COVID pandemic, the Board of Medicine has temporarily waived the licensure requirement to allow practitioners with a license in good standing in another state to practice telehealth in Idaho without an Idaho license, but practitioners must still comply with the remaining provisions of the Act and Board regulations, including those requiring compliance with the applicable standard of care. (See Administrative Rules Temporarily Suspended by the Idaho State Board of Medicine in Response to COVID-19, available at https://bom.idaho.gov/BOMPortal/BOM/Procedures/Temporary_Suspension_of_Rules_for_COVID-19_Response.pdf; see also Idaho Board of Medicine Frequently Asked Questions—COVID-19, available at https://bom.idaho.gov/BOMPortal/BOM/Procedures/FAQ%20COVID-19.pdf).
Other licensing boards also expressly require an Idaho license to render telehealth services in Idaho. For example, Idaho Board of Dentistry regulations require that “[a]ny dentist who provides any telehealth services to patients located in Idaho must hold an active Idaho license.” (IDAPA 24.31.01.055). The Board of Psychologist Examiners require telehealth providers to have an Idaho license unless it is an emergency. (IDAPA 24.12.01.550.07).
2. Provider-Patient Relationship. In response to internet pharmacies that sprang up in the 1990’s, many states passed laws that require healthcare providers to establish or have an established provider-patient relationship before they may prescribe drugs. (See, e.g., I.C. § 54-17332 ). Those laws may extend to telehealth services and specify the method for establishing the relationship. For example, the Idaho Act states:
PROVIDER-PATIENT RELATIONSHIP. (1) If a provider offering telehealth services does not have an established provider-patient relationship with a person seeking such services, the provider shall take appropriate steps to establish a provider-patient relationship by use of two-way audio or audio-visual interaction; provided however, that the applicable Idaho community standard of care must be satisfied. Nothing in this section shall prohibit electronic communications:
(a) Between a provider and a patient with a preexisting provider-patient relationship;
(b) Between a provider and another provider concerning a patient with whom the other provider has a provider-patient relationship;
(c) Between a provider and a patient where the provider is taking call on behalf of another provider in the same community who has a provider patient relationship with the patient; or
(d) In an emergency.3
(I.C. § 54-5705(1)). The Idaho Board of Medicine regulations impose additional requirements:
PROVIDER-PATIENT RELATIONSHIP. In addition to the requirements set forth in Section 54-5705, Idaho Code, during the first contact with the patient, a provider licensed by the Idaho State Board of Medicine who is providing telehealth services must:
01. Verification. Verify the location and identity of the patient;
02. Disclose. Disclose to the patient the provider's identity, their current location and telephone number and Idaho license number;
03. Consent. Obtain appropriate consents from the patient after disclosures regarding the delivery models and treatment methods or limitations, including a special informed consent regarding the use of telehealth technologies; and
04. Provider Selection. Allow the patient an opportunity to select their provider rather than being assigned a provider at random to the extent possible.
(IDAPA 24.33.03.203). The Board of Dentistry has similar requirements. (See IDAPA 24.31.01.055.02).
3. Standard of Care. Providers rendering telehealth must ensure they comply with the applicable standard of care. In Idaho, there does not appear to be a special standard of care for telehealth services; instead, the provider will be held to the same standard that applies in face-to-face encounters. The Act states that providers must act “according to … the community standard of care.” (I.C. § 54-5704; see also id. at §§ 54-5705(1), 54-5707, and 54-5712). Specifically, “[t]reatment recommendations provided through telehealth services shall be held to the applicable Idaho community standard of care that applies in an in-person setting.” (I.C. § 54-5706). Thus, even if a provider has the appropriate licensure, they must still determine whether rendering the services through telehealth is consistent with the standard of care. If not, the provider risks adverse licensure actions even if there is no adverse outcome, and malpractice liability if there is.
The Idaho Board of Medicine regulations are more specific:
204. STANDARD OF CARE. A provider providing telehealth services to patients located in Idaho must comply with the applicable Idaho community standard of care. The provider is personally responsible to familiarize themself with the applicable Idaho community standard of care. If a patient's presenting symptoms and conditions require a physical examination, lab work or imaging studies in order to make a diagnosis, the provider shall not provide diagnosis or treatment through telehealth services unless or until such information is obtained.
(IDAPA 24.33.03.204). Idaho Board of Dentistry regulations are similar. (IDAPA 24.31.01.55.03).
4. Informed Consent. Providers engaging in telehealth must ensure they have informed consent, including informed consent for the telehealth services. The Idaho Act states, “A patient's informed consent for the use of telehealth services shall be obtained as required by any applicable law.” (I.C. § 54-5708). Under Idaho law, effective consent generally requires that the provider explain
the need for, the nature of, and the significant risks ordinarily attendant upon such a person receiving such care… Any such consent shall be deemed valid and so informed if the health care provider to whom it is given or by whom it is secured has made such disclosures and given such advice respecting pertinent facts and considerations as would ordinarily be made and given under the same or similar circumstances, by a like health care provider of good standing practicing in the same community.
(Id. at § 54-4506). “Obtaining sufficient consent for health care is the duty of the attending health care provider upon whose order or at whose direction the contemplated health care, treatment or procedure is rendered,” although the provider may use others to document the consent. (Id. at § 54-4508). These consent standards likely require the provider to explain any risks and benefits associated with the provision of telehealth along with the underlying treatment. The Idaho Board of Medicine regulations, for example, require additional specific information for telehealth consents:
INFORMED CONSENT. In addition to the requirements of Section 54-5708, Idaho Code, evidence documenting appropriate patient informed consent for the use of telehealth technologies must be obtained and maintained at regular intervals consistent with the community standard of care. Appropriate informed consent should, at a minimum, include the following terms:
01. Verification. Identification of the patient, the provider and the provider's credentials;
02. Telehealth Determination. Agreement of the patient that the provider will determine whether not the condition being diagnosed and/or treated is appropriate for telehealth services;
03. Security Measures Information. Information on the security measures taken with the use of telehealth technologies, such as encrypting data, password protected screen savers and data files, or utilizing other reliable authentication techniques, as well as potential risks to privacy and notwithstanding such measures;
04. Potential Information Loss. Disclosure that information may be lost due to technical failures.
(IDAPA 24.33.03.205). The Board of Dentistry and Board of Psychologist Examiners have similar requirements for informed consent for telehealth. (IDAPA 24.12.01.550.03 and 24.31.01.55.04). Providers should review their consent forms to ensure they include the required regulatory language.
5. Provision of Care. Relevant statutes and/or regulations may also impose certain practice requirements for telehealth providers. For example, the Idaho Act states:
54-5706. EVALUATION AND TREATMENT. Prior to providing treatment, including a prescription drug order, a provider shall obtain and document a patient's relevant clinical history and current symptoms to establish the diagnosis and identify underlying conditions and contraindications to the treatment recommended. Treatment recommendations provided through telehealth services shall be held to the applicable Idaho community standard of care that applies in an in-person setting. Treatment based solely on an online questionnaire does not constitute an acceptable standard of care.
54-5707. PRESCRIPTIONS. (1) A provider with an established provider-patient relationship, including a relationship established pursuant to section 54-5705, Idaho Code, may issue prescription drug orders using telehealth services within the scope of the provider's license and according to any applicable laws, rules and regulations, including the Idaho community standard of care; provided however, that the prescription drug shall not be a controlled substance unless prescribed in compliance with 21 U.S.C. section 802(54)(A).
(2) Nothing in this chapter shall be construed to expand the prescriptive authority of any provider beyond what is authorized by the provider's licensing board.
…
54-5709. CONTINUITY OF CARE. A provider of telehealth services shall be available for follow-up care or to provide information to patients who make use of such services.
54-5710. REFERRAL TO OTHER SERVICES. A provider shall be familiar with and have access to available medical resources, including emergency resources near the patient's location, in order to make appropriate patient referrals when medically indicated.
(I.C. §§ 54-5706 to 54-5710). Regulations governing telepsychology in Idaho contain additional practice requirements. (IDAPA 24.12.01.550.06).
6. Medical Records. Telehealth statutes and regulations may impose requirements related to medical records. For example, the Idaho Act states:
MEDICAL RECORDS. A provider offering telehealth services shall generate and maintain medical records for each patient using telehealth services in compliance with any applicable state and federal laws, rules, and regulations, including the Health Insurance Portability and Accountability Act (HIPAA) … and the Health Information Technology for Economic and Clinical Health Act (HITECH)…. Such records shall be accessible to other providers, if the patient has given permission, and to the patient in accordance with applicable laws, rules, and regulations.
(I.C. § 54-5711). Thus, the Idaho Act requires telehealth providers to ensure they implement the HIPAA security rule requirements governing the secure maintenance and transmission of electronic protected health information as well as the confidentiality provisions in the HIPAA privacy rule.
The Idaho Board of Medicine regulations go a step further:
MEDICAL RECORDS. As required by Section 54-5711, Idaho Code, any provider providing telehealth services as part of his or her practice shall generate and maintain medical records for each patient. The medical record should include copies of all patient-related electronic communications, including patient-physician communications, prescriptions, laboratory and test results, evaluations and consultations, relevant information of past care, and instructions obtained or produced in connection with the utilization of telehealth technologies. Informed consents obtained in connection with the provision of telehealth services should also be documented in the medical record. The patient record established during the provision of telehealth services must be accessible and documented for both the physician and the patient, consistent with all established laws and regulations governing patient healthcare records.
(IDAPA 24.33.03.206). The Board of Psychologist Examiner has regulations covering the security and confidentiality of telepsychology services. (IDAPA 24.12.01.550.05).
7. Enforcement. Absent a specific waiver of licensure rules, providers who render telehealth in Idaho without a license may be guilty of practicing without a license, which may subject them to criminal fines and penalties. (See, e.g., I.C. § 54-1804 (practicing medicine without an Idaho license is a felony); IDAPA 24.12.01.07.c (practicing telepsychology without a license is a misdemeanor). Those who are licensed but who otherwise violate the Act or associated regulations may be subject to discipline by their applicable licensing board. The Act states:
ENFORCEMENT AND DISCIPLINE. A provider is prohibited from offering telehealth services in his or her practice if the provider is not in full compliance with applicable laws, rules and regulations, including this act and the Idaho community standard of care. State licensing boards shall be authorized to enforce the provisions of this chapter relating to the practice of individuals they license. A provider who fails to comply with applicable laws, rules and regulations is subject to discipline by his or her licensing board.
(I.C. § 54-5712). It is possible that such statutory violations may be used to support a private cause of action for malpractice, lack of informed consent, or other recognized tort.
Conclusion. Although licensure requirements may have been waived during the COVID pandemic, providers wishing to engage in telehealth must still ensure they comply with other statutory and regulatory standards, many of which may come as a surprise. More importantly, providers must ensure that the services they render are appropriate for telehealth, i.e., that rendering the services through telehealth are consistent with the local standard of care. Failure to do so may result in malpractice as well as regulatory fines and penalties.
1In Idaho, "Telehealth services" means health care services provided by a provider to a person through the use of electronic communications, information technology, asynchronous store and forward transfer or synchronous interaction between a provider at a distant site and a patient at an originating site. Such services include but are not limited to clinical care, health education, home health and facilitation of self-managed care and caregiver support, and the use of synchronous or asynchronous telecommunications technologies by a provider to deliver patient health care services, including but not limited to assessment of, diagnosis of, consultation with, treatment of, and remote monitoring of a patient; transfer of medical data; patient and professional health-related education; public health services; and health administration. The term "telehealth services" does not include audio in isolation without access to and review of the patient's medical records, electronic mail messages that are not compliant with the health insurance portability and accountability act (HIPAA), or facsimile transmissions. (I.C. § 54-5703(6)).
2Idaho Code § 54-1733 states:
VALIDITY OF PRESCRIPTION DRUG ORDERS. (1) A prescription drug order for a legend drug is valid only if it is issued by a prescriber for a legitimate medical purpose arising from a prescriber-patient relationship which includes a documented patient evaluation adequate to establish diagnoses, if applicable, and identify underlying conditions and/or contraindications to the treatment.
(2) A prescriber who is otherwise authorized to perform any of the activities listed in this section may prescribe or perform any of the following activities for a patient with whom the prescriber does not have a prescriber- patient relationship under the following circumstances:
(a) Writing initial admission orders for a newly hospitalized patient;
(b) Writing a prescription drug order for a patient of another prescriber for whom the prescriber is taking call;
(c) Writing a prescription drug order for a patient examined by a physician assistant, advanced practice registered nurse or other licensed practitioner with whom the prescriber has a supervisory or collaborative relationship;
(d) Writing a prescription drug order for a medication on a short-term basis for a new patient prior to the patient’s first appointment;
(e) Writing a prescription for an opioid antagonist pursuant to section 54-1733B, Idaho Code;
(f) In emergency situations where the life or health of the patient is in imminent danger;
(g) In emergencies that constitute an immediate threat to the public health including, but not limited to, empiric treatment or prophylaxis to prevent or control an infectious disease outbreak;
(h) Epinephrine auto-injectors in the name of a school pursuant to section 33-520A, Idaho Code; and
(i) If a prescriber makes a diagnosis of an infectious disease in a patient, prescribe or dispense antimicrobials to an individual who has been exposed to the infectious person in accordance with clinical guidelines.
(3) Treatment, including issuing a prescription drug order, based solely on an online questionnaire or consultation outside of an ongoing clinical relationship does not constitute a legitimate medical purpose.
(4) A prescription drug order shall be issued only by a prescriber including a prescriber who is licensed in a jurisdiction other than the state of Idaho and is permitted by such license to prescribe legend drugs in the course of his professional practice as long as the individual is acting within the jurisdiction, scope and authority of his license when issuing the prescription drug order.
3“’Emergency’ means a situation in which there is an occurrence that poses an imminent threat of a life-threatening condition or severe bodily harm.” (I.C. § 54-5705(2)).
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.