<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".04" citation="COMAR 10.40.12.04" title_num="10" subtitle_num="40" chapter_num="12" heading="Standards of Practice for Telehealth.">
  <paragraph num="A.">
    <text>Before providing telehealth services, a telehealth practitioner shall develop and follow a procedure to:</text>
    <paragraph num="(1)">
      <text>Verify the identification of the patient receiving telehealth services through use of:</text>
      <paragraph num="(a)">
        <text>A government-issued photograph identification;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>An insurance, Medicaid, or Medicare card; or</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Documentation of the patient’s:</text>
        <paragraph num="(i)">
          <text>Date of birth; and</text>
        </paragraph>
        <paragraph num="(ii)">
          <text>Home address;</text>
        </paragraph>
      </paragraph>
    </paragraph>
    <paragraph num="(2)">
      <text>For an initial patient-telehealth practitioner encounter, disclose the telehealth practitioner’s:</text>
      <paragraph num="(a)">
        <text>Name;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Contact information; and</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Maryland license number;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(3)">
      <text>Except for interpretive services, obtain oral or written acknowledgement from a patient or a patient’s parent or guardian if State law requires the consent of a parent or guardian, including informing patients of the risks, benefits, and side effects of prescribed treatments;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Securely collect and transmit a patient’s medical health information, clinical data, clinical images, laboratory results, and self-reported medical health and clinical history, as necessary, and prevent access to data by unauthorized persons through encryption or other means;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Notify patients in the event of a data breach;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Ensure that the telehealth practitioner provides a secure and private communication modality that complies with federal and state privacy laws; and</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Establish safety protocols to be used in the case of an emergency, including contact information for emergency services at the patient’s location.</text>
    </paragraph>
  </paragraph>
  <paragraph num="B.">
    <text>Except when utilizing store and forward technology to provide telehealth services or remote patient monitoring, a telehealth practitioner shall:</text>
    <paragraph num="(1)">
      <text>Obtain or confirm an alternative method of contacting the patient in case of a technological failure;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Confirm whether the patient is in Maryland and identify the specific practice setting in which the patient is located; and</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Identify all individuals present at each location and confirm they are allowed to hear the patient’s health information.</text>
    </paragraph>
  </paragraph>
  <paragraph num="C.">
    <text>A telehealth practitioner shall be held to the same standards of practice and documentation as those applicable for in-person health care settings.</text>
  </paragraph>
  <paragraph num="D.">
    <text>A telehealth practitioner may not prescribe opioids for the treatment of pain through telehealth except if the patient is in a health care facility as defined in Health-General Article, §19-114, Annotated Code of Maryland.</text>
  </paragraph>
</regulation>