<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".04" citation="COMAR 10.38.13.04" title_num="10" subtitle_num="38" chapter_num="13" heading="Standards of Practice for Telehealth.">
  <paragraph num="A.">
    <text>Before providing telehealth services, a telehealth practitioner shall develop and follow a procedure to:</text>
    <paragraph num="(1)">
      <text>Verify the identification of the patient receiving telehealth services through use of:</text>
      <paragraph num="(a)">
        <text>A government-issued photograph identification;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>An insurance, Medicaid, or Medicare card; or</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Documentation of the patient’s:</text>
        <paragraph num="(i)">
          <text>Date of birth; and</text>
        </paragraph>
        <paragraph num="(ii)">
          <text>Home address;</text>
        </paragraph>
      </paragraph>
    </paragraph>
    <paragraph num="(2)">
      <text>For an initial patient-telehealth practitioner encounter, disclose the telehealth practitioner’s:</text>
      <paragraph num="(a)">
        <text>Name;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Maryland license number and type or compact privilege number, if applicable, and</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Contact information;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(3)">
      <text>Obtain oral or written consent from a patient or patient’s parent or guardian if State law requires the consent of a parent or guardian, including informing patients of the risks, benefits, and side effects of the recommended treatment plan;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Securely collect and transmit a patient’s medical health information, clinical data, clinical images, laboratory results, and self–reported medical health and clinical history, as necessary, and prevent access to data by unauthorized persons through encryption or other means;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Notify patients in the event of a data breach;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Ensure that the telehealth practitioner provides a secure and private communication modality that complies with federal and state privacy laws; and</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Establish safety protocols to be used in the case of an emergency, including contact information for emergency services at the patient’s location.</text>
    </paragraph>
  </paragraph>
  <paragraph num="B.">
    <text>Except when providing asynchronous telehealth services, a telehealth practitioner shall:</text>
    <paragraph num="(1)">
      <text>Obtain or confirm an alternative method of contacting the patient in case of a technological failure;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Confirm whether the patient is in Maryland and identify the specific practice setting in which the patient is located; and</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Identify all individuals present at each location and confirm they are allowed to hear the patient’s health information.</text>
    </paragraph>
  </paragraph>
  <paragraph num="C.">
    <text>A telehealth practitioner shall be held to the same standards of practice and documentation as those applicable for in-person physical therapy practice appointments.</text>
  </paragraph>
</regulation>