.04 Standards of Practice for Telehealth.

A. Before performing telehealth services, a telehealth practitioner shall develop and follow a procedure to:

(1) Verify the identification of the patient receiving telehealth services through use of:

(a) A government issued photograph identification;

(b) An insurance, Medicaid, or Medicare card; or

(c) Documentation of the patient’s:

(i) Date of birth; and

(ii) Home address;

(2) For an initial patient-telehealth practitioner encounter, disclose the telehealth practitioner’s:

(a) Name;

(b) Contact information;

(c) Maryland license number and type or compact privilege number, if applicable; and

(d) Medical specialty, if applicable;

(3) Except for interpretive services, obtain oral or written consent from a patient or patient’s parent or guardian if State law requires the consent of a parent or guardian, including informing patients of the risks and benefits of the services to be provided;

(4) Securely collect and transmit a patient’s medical health information, clinical data, clinical images, laboratory results, and self-reported medical health and clinical history, as necessary, and prevent access to data by unauthorized persons through encryption or other means;

(5) Notify patients in the event of a data breach;

(6) Ensure that the telehealth practitioner provides a secure and private communication modality that complies with federal and state privacy laws; and

(7) Establish safety protocols to be used in the case of an emergency.

B. Except when providing asynchronous telehealth services, a telehealth practitioner shall:

(1) Obtain or confirm an alternative method of contacting the patient in case of a technological failure;

(2) Confirm whether the patient is in Maryland and identify the specific practice setting in which the patient is located; and

(3) Identify all individuals present at each location and confirm they are allowed to hear the patient’s health information.

C. A telehealth practitioner shall be held to the same standards of practice and documentation as those applicable for in-person health care settings.

D. The requirements set forth under §§A and B of this regulation may be delegated.