The Ryan Haight Online Pharmacy Consumer Protection Act of 2008

Ryan Haight was a 18 year-old from California who died after ingesting a fatal dose of Vicodin, which he had ordered and received from an online pharmacy, without having been examined by a physician.

The Ryan Haight Online Consumer Protection Act of 2008 (RHA) represents an appropriate attempt on the part of the US Government to limit access to controlled substances over the internet - without legitimate physician oversight. The Act's intent is to limit the online pharmacy industry and to control the prescribing of unlimited quantities of dangerous, addictive substances, "by means of the internet". In so doing, the federal government has for the first time defined a "valid prescription" as requiring at least one in-person evaluation - with a number of exceptions, telemedicine being an important one.

[By coincidence, the RHA was passed in the same month (October 2008) that my Letter to the Editor was published regarding the treatment of patients with buprenorphine without an in-person evaluation.]

In April of 2009, the DEA released its Final Rule regarding the implementation of the RHA and some have been concerned about the implications this law may have with regard to the prescribing of controlled substances via Skype telepsychiatry, i.e. in the absence of an in-person evaluation.

[Recall that Skype telepsychiatry allows for maintenance of the standard of care for traditional in-person evaluation - including the documentation of vitals signs ($40 pressure cuff on patient side) and mental status examination. An associated visit to a primary care provider can be made a prerequisite for continued treatment, as indicated. Patients may also be required to participate in random urine toxicology screening and more traditional psychosocial treatments for addiction.]

So how damaging is the RHA to the notion of prescribing a Schedule III controlled substance without an in-person evaluation?

In my view the answer will depend on case law which does not yet exist, so is now up for interpretation...

Since the clear intent of the RHA is appropriately and specifically to target the rogue internet pharmacy industry (and not the legitimate practice of telemedicine), it therefore has no relevance whatever to Skype telepsychiatry as defined here, which by definition meets standard of care by allowing for a bona fide medical evaluation.

Allowing that there is relevance (likely through the "valid prescription" argument), the language in the RHA still refers only to prescriptions "issued by means of the internet" and does not refer to prescriptions issued by traditional means i.e. telephone, fax, hard copy. In the model we have been describing, the internet is used to facilitate the examination, not the prescription.

And still there is the telemedicine exception. See the following text taken from the Final Rule:

The definition of the ‘‘practice of telemedicine’’ includes seven distinct categories that involve circumstances in which the prescribing practitioner might be unable to satisfy the Act’s in-person medical evaluation requirement, yet nonetheless has sufficient medical information to prescribe a controlled substance for a legitimate medical purpose in the usual course of professional practice. In these circumstances, provided certain safeguards are in place to ensure that the practitioner who is engaged in the practice of telemedicine is able to conduct a bona fide medical evaluation of the patient at the remote location, and is otherwise acting in the usual course of professional practice, the Act contemplates that the practitioner will be permitted to prescribe controlled substances by means of the Internet despite not having conducted an in-person medical evaluation.

I therefore believe that the RHA has no relevance to the prescribing of controlled substances without an in-person evaluation, providing that the prescriber has completed a bona fide medical evaluation of the patient at the remote location.

I invite discussion on this topic because I predict it will be the treatment of opioid dependence with buprenorphine that will eventually propel this model of treatment to wide acceptance, thus revolutionizing telepsychiatry and in the process providing treatment for a myriad of patients who would otherwise go without this effective treatment.

Prescribing without Physical Proximity

The holy grail for the process of home-based telepsychiatry would be the wide-based acceptance of the prescribing of medicines without an in-person evaluation. Even many avid supporters of telemedicine run for cover at the thought of prescribing without the physician having been in the same room with the patient - at least once. But why must this be so when physical examination is not part of the standard of care in traditional outpatient psychiatry?

Skype telepsychiatry allows for a routine medical evaluation which meets standard of care, and therefore prescribing without physical proximity should be considered appropriate. Skype telepsychiatry allows for a review of the patient identification and chief complaint, present illness, psychiatric and medical history, family and social history, cognitive screening, and visual inspection of the patient for documentation of the all-important mental status examination. If there are medical concerns then the patient may be referred to primary care for physical examination and/or basic labs.

The various state BME's approach this concept very differently; some have addressed it directly and have signified broad-based approval; others have not. For example, New York has offered its approval for prescribing without physical proximity in the following quote taken from the New York State Department of Health Statement on Telemedicine:

The fact that an electronic medium is utilized for contact between parties or as
a substitute for face-to-face consultation does not change the standards of care.

California has offered its approval in the following quote

There are prohibitions relating to prescribing over the Internet, which can
result in license discipline, and carries hefty fines for prescribing without an
appropriate prior examination. This examination, however, need not be in-person,
if the technology is sufficient to provide the same information to the physician
if the exam had been performed face-to-face

from the Medical Board of California's document on Practicing Medicine through Telemedicine Technology. Texas also implies its approval of this process in its State Board of Medical Examiner's statement on Telemedicine, and Maryland Board of Physicians does so in its analogous statement.

Conversely, Florida and New Jersey are examples of states who do not formally sanction prescribing without physical proximity, based on the requirement for a "physical examination" for the prescribing of medicines in their statements on Telemedicine Prescribing Practice and BME Regulations, respectively.

The Federation of State Medical Boards was keeping track of the emergence of legislation governing Internet Prescribing, but this document seems somewhat out of date and it does not address the question of whether Skype telepsychiatry qualifies as "internet prescribing" or whether Internet Prescribing refers only to the illegitimate dispensing of medications through so-called Online Pharmacies. I will address the Ryan Haight Online Consumer Protection Act of 2008 in an upcoming entry.

In the meantime I'd like to reference two particularly relevant and current documents from the American Telemedicine Assocation: the Challenge of Regulating Internet Prescribing and Practice Guidelines for Videoconference-Based Telemental Health, both of which address the issues with realism and practicality, and both of which appear to support the prescribing of medicines without physical proximity.

Skype and HIPAA: Myth Buster

The potential of home-based telepsychiatry assumes that both patient and remote physician use a clinically and technologically appropriate combination of encrypted consumer-based video-teleconferencing equipment (i.e. Skype (TM)) and high-speed internet to conduct routine psychiatric consultations from their own homes or offices.

One potential reason this process has not yet blossomed fully is the concern regarding confidentiality, especially as pertaining to the dreaded HIPAA Privacy Rule and health-related data transmission via the internet. Please recall that not all providers are considered to be a covered entity under HIPAA, and it is not clear whether live video-teleconferencing data qualifies as an electronic transmission (sending) of a "covered transaction".

In any event, Skype (TM) is HIPAA-compliant. According to emails I have received from representatives of The Office of eHealth Standards and Services at the CMS Headquarters in Baltimore, Maryland,

"CMS does not advise on technology specific issues,
because the HIPAA [Privacy] Rule specifically allows for flexibility
in the approach to safeguarding information..."

So there you have it, myth busted. Who can argue that use of Skype's 256-bit encryption technique does not meet HIPAA's intentionally vague requirement that covered entities safeguard the transmission of private health information?

The representatives further communicate that to be absolutely compliant, a covered entity must assemble a Risk Management Plan, documenting its understanding of the risks (i.e. transmission via standard internet lines means potential access to the data at all nodes, and a plan to address them (i.e. sophisticated 264-bit encryption).

In my next entry I will address the issue of the Ryan Haight Act, otherwise known as the Internet Pharmacy Consumer Protection Act of 2008, and its potential impact on home-based telepsychiatry, or lack thereof...

Is Skype Telepsychiatry compliant with HIPAA?

I am currently awaiting an answer on this topic from CMS (i.e. the Centers for Medicare & Medicaid Services). But it occurs to me that when HIPAA was enacted (1996), there was no such entity as consumer-level telepsychiatry, otherwise known as "home-based telepsychiatry" or "Skype telepsychiatry", so clearly it was not addressed in the original legislation.

In fact, Skype (TM) employs an extremely sophisticated 264-bit encryption technique, essentially eliminating the possibility of interception for all but the most proficient and criminally motivated of hackers.

Does that qualify for HIPAA compliance?

Home-based telepsychiatry will revolutionize psychiatric treatment.

The advent of free consumer video teleconferencing equipment and inexpensive webcams has the potential to revolutionize the delivery of psychiatric treatment. The promise of telepsychiatry is realized through technology as the cost-benefit ratio for the use of this medium rapidly diminishes.

Patients may now receive counseling, medication management, and cognitive based therapies while sitting alone in their own homes. Even in the absence of an in-person examination, the standard of care for traditional outpatient psychiatry is maintained because patients are required to visit with a primary care doctor for physical examination and/or indicated laboratory tests. See my recent Letter to the Editor in Psychiatric Services.

But what are the legal, clinical, and ethical implications when one receives telepsychiatric treatment from home? What implications are there with regard to safety and malpractice? Specifically, how does this process differ from more 'traditional' clinic-based telepsychiatry, in which the patient accesses a remote specialist from a local clinic?

What impact does the Ryan Haight Act have upon the future of telepsychiatry and telemedicine in general?

I would like to invite an open discussion regarding the merits and pitfalls of the use of this medium to deliver psychiatric treatment.