Doctors in the states can start using Facebook Messenger and FaceTime to diagnose patients, without worrying about violating privacy laws.
The coronavirus crisis is pushing the US government to loosen one of its only laws on data privacy. The Department of Health and Human Services said Tuesday that it'll waive penalties for potential violations of the Health Insurance Portability and Accountability Act.
HIPAA protects patients from having their medical data shared by health care providers, preventing the data from being used for advertising and marketing, for example. Those privacy protections limit what kinds of technology health care providers can use, but the coronavirus pandemic is changing that.
"During the COVID-19 national emergency, which also constitutes a nationwide public health emergency, covered health care providers subject to the HIPAA Rules may seek to communicate with patients, and provide telehealth services, through remote communications technologies," the HHS said in a statement Tuesday
Not every video communications service is HIPAA-compliant, as specialized services like Zoom for Healthcare and Skype for Business are. But with the ability of COVID-19, the respiratory disease caused by the coronavirus, to spread at a rapid rate, and with governments urging people to stay home to contain the outbreak, HHS has decided to open up more common video chatting services for doctors to use.
That includes popular apps like FaceTime, Facebook Messenger, Google Hangouts and Skype. The HHS' Office of Civil Rights said it wouldn't be imposing penalties on health care providers using those noncompliant video chatting services.
This change isn't just for diagnoses related to the coronavirus, the agency said, and can include things like sprained ankles, psychological evaluations or dental consultations.
"For most privacy regulations around the world, there is an exigency carve-out for privacy requirements," said Charlotte Tschider, a visiting assistant professor of law at the University of Nebraska who studies HIPAA. "In some situations, such as emergencies or for public health benefits, you do not have to require consent, for practical reasons."
A covered health care provider "may request to examine a patient exhibiting COVID-19 symptoms, using a video chat application connecting the provider's or patient's phone or desktop computer," the agency said, "in order to assess a greater number of patients while limiting the risk of infection of other persons who would be exposed from an in-person consultation."
The HIPAA waiver is effective immediately, the agency said. HHS is still encouraging medical professionals to tell patients that these third-party apps can introduce privacy risks, and health providers should enable all encryption and privacy modes when using them.
The department also said that public-facing platforms, like Facebook Live, Twitch and TikTok, shouldn't be used for teleconferencing.