Regulatory Risk in Today’s Virtual Care Market

The past few years have been a period of relatively relaxed regulation for the digital health and wellness industry as the emergency nature of the COVID-19 pandemic has necessitated prioritizing patient care over regulatory enforcement. But as management of the pandemic and life around it has evolved, we expect the regulatory exposure landscape to deteriorate as regulatory and compliance pressures increase. From practitioners to platform providers, the virtual care industry must take notice.

Our 2022 Digital Health and Wellness Report reveals there is indeed concern, with regulatory risk identified as a key area of unease for business leaders in the digital health and wellness space. At the individual business level, our research reveals it is regulatory threat to their own business that keeps almost half (47%) of these business leaders awake at night. Some 18% cite meeting regulatory requirements, 11% staying up to date with requirements, and a further 18% complying with historic regulatory restrictions.

It is crucial that investors and business owners understand the complexity of this space and what could happen beyond violations and fines.

It is good that business leaders are thinking about regulatory concerns, but they also need to think through the reasons behind many of the regulations and what makes this space different from other commercial activities.  Business leaders need to consider an approach that embeds compliance into their organizations’ policies and procedures. 

Healthcare regulation is very different than regulatory discussions in other industries due to the potential consequences of non-compliance to patients and customers. From the bodily injury component associated with adverse outcomes to the fact that even tech support can relate directly to someone’s personal health, the implications are significant. 
 
Additionally, some of the regulatory requirements around storing and forwarding personal health information also have consequences beyond the business implications for violations. Specifically, the release of information, and the potential cyber ransom attack for the information, can lead to multi-plaintiff actions for violations of privacy. Potentially worse is the bodily injury that can occur with lost lab results or a provider not having accurate or up to date information when determining diagnosis or treatment plans for patients.   

As such, virtual care leaders need to recognize the reasons that regulations are important for their line of business, and this understanding must be reflected in the way day-to-day operations are conducted.

The plaintiff’s bar is very organized and as this area evolves, it may be next soft target for litigation. 
 
As the plaintiff’s bar learns more about virtual care, they will likely add it as a cause of action in cases where they cannot win on the medical grounds alone.

A regulatory violation such as inadvertently providing care in a state where licenses are not up to date may result in a fine but could also be a presumptive finding of liability (or at least a plaintiff’s attorney will allege the same) in a civil suit. A plaintiff’s attorney may use this as an example of a lack of due care, oversight, and wrongdoing. 

We are seeing more risk with providers who may be stepping in to provide care for small segments of time without seeing the big picture. In the case of a second opinion or consult, it’s essential to note that the consulting physician has a duty to patients, even when the consult is virtual. This is not a new phenomenon in and of itself– smaller hospitals, for example, have always pulled in outside consults, including specialists like radiologists who may have read remotely for years. However, the plaintiffs’ bar is learning to prosecute their cases against telehealth companies by raising allegations of “profits over patients” and focusing on the corporatization of medicine rather than the actual care provided to one singular patient.  As such, they will happily mischaracterize a remote consult – which is beneficial to the patient - as something that is vastly benefitting the provider and providing income to the virtual care business.  In response, providers must do their best to document and personalize the care being rendered.  Industry-wide, compliance exposures are significant.

Globally, 25% of the business leaders we surveyed indicated that they do not have a clear understanding of the regulatory and compliance exposures they face in all territories or states where they operate. Business leaders in the US (29%) and Canada (31%) report the highest levels of concern, with an additional 9% in the US and 7% in Canada reporting they find exposures ‘uncertain.’ 

It is possible that much of the uncertainty over regulatory requirements stems from the changes being made to regulations. In North America in particular, the regulatory requirements, which had been relaxed to enable patients to access care more easily throughout the pandemic, are fast tightening back up again to where they were pre-pandemic. Things like HIPAA compliance and licensing requirements will now be reinforced and strengthened, and telehealth companies – especially new entrants to the market over the past two years – will need to pause to make sure that they have safeguards and risk management programs properly in place. At the same time, courts are again operating on a normal schedule and claims reporting is on the rise, creating a perfect storm for risk.