CTP Legal and Ethical Standards 2 — Questions and Answers
Question 1: A telehealth provider licensed in New York wants to treat a patient currently located in California. Which legal principle governs this situation?
- The provider's home state license is sufficient for all US patients
- The provider must be licensed in the state where the patient is physically located (Correct answer)
- Federal telehealth law overrides all state licensing requirements
- The patient's insurance determines which state law applies
Correct answer: The provider must be licensed in the state where the patient is physically located
Telehealth practice is governed by the laws of the state where the patient is physically located at the time of the encounter.
Question 2: Under HIPAA, which of the following is NOT considered a covered entity required to comply with privacy rules?
- Health insurance companies
- Healthcare clearinghouses
- A self-employed personal trainer offering nutritional advice (Correct answer)
- Hospitals providing telehealth services
Correct answer: A self-employed personal trainer offering nutritional advice
HIPAA covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically — a personal trainer offering general advice is not a covered entity.
Question 3: A patient requests that their telehealth therapist share session notes with their employer. What is the ethically correct response?
- Comply immediately since the patient consented
- Refuse and explain that employer disclosure is never permitted
- Obtain written authorization from the patient and assess any potential harm before disclosing (Correct answer)
- Provide a summary only, as full notes cannot be shared
Correct answer: Obtain written authorization from the patient and assess any potential harm before disclosing
The provider should obtain proper written authorization and carefully consider potential harms to the patient before releasing records to an employer.
Question 4: Which federal law specifically extended telehealth flexibilities during the COVID-19 public health emergency by waiving the originating site requirement?
- The Affordable Care Act
- The HITECH Act
- The Coronavirus Aid, Relief, and Economic Security (CARES) Act (Correct answer)
- The Mental Health Parity Act
Correct answer: The Coronavirus Aid, Relief, and Economic Security (CARES) Act
The CARES Act and subsequent emergency declarations waived originating site restrictions under Medicare, allowing patients to receive telehealth from their homes.
Question 5: A telehealth clinician discovers a patient may be in immediate danger of self-harm during a video session. What is the primary ethical obligation?
- Terminate the session and document the conversation
- Ensure the patient's safety by contacting emergency services if necessary, regardless of confidentiality (Correct answer)
- Refer the patient to an in-person provider and end the telehealth relationship
- Obtain the patient's permission before taking any action
Correct answer: Ensure the patient's safety by contacting emergency services if necessary, regardless of confidentiality
Duty to protect life overrides confidentiality obligations when a patient poses an imminent risk of harm to themselves.
Question 6: Which of the following best describes the 'originating site' in a traditional Medicare telehealth reimbursement model?
- The location where the treating provider is situated
- The billing address of the healthcare organization
- The location where the Medicare patient receives the telehealth service (Correct answer)
- The server location hosting the telehealth platform
Correct answer: The location where the Medicare patient receives the telehealth service
The originating site is where the patient is located when receiving telehealth services, which historically needed to be a qualifying healthcare facility for Medicare reimbursement.
Question 7: A telehealth provider using a third-party video platform must ensure the vendor signs which type of agreement under HIPAA?
- A Business Associate Agreement (BAA) (Correct answer)
- A Patient Authorization Form
- A Service Level Agreement (SLA)
- A Notice of Privacy Practices
Correct answer: A Business Associate Agreement (BAA)
Any third-party vendor that handles protected health information on behalf of a covered entity must sign a Business Associate Agreement (BAA).
CTP Legal and Ethical Standards 2
A telehealth provider licensed in New York wants to treat a patient currently located in California.
Which legal principle governs this situation?