DELTA and DASA Collaborate to Deliver Secure Telehealth Options at NC State

A collaboration between DELTA and the Division of Academic and Student Affairs (DASA) addressed the need for secure virtual healthcare options for NC State students during the COVID-19 pandemic. 

NC State University offers a wide range of healthcare and counseling services to students, faculty and staff through Student Health Services (SHS) and the Counseling Center. 

Under normal operations, these offices provide physical and mental health services to students in-person while complying with the Health Insurance Portability and Accountability Act (HIPAA), which protects sensitive patient health information from being disclosed without patients’ consent or knowledge. In March 2020, all student services transitioned to remote delivery as a result of the COVID-19 pandemic. SHS and the Counseling Center moved patient appointments online and began offering telehealth sessions for those who wished not to come in person. Telehealth allows providers and patients to meet via video conference to talk about health-related issues. 

At the beginning of the pandemic, the Office for Civil Rights in the Department of Health and Human Services introduced enforcement discretion, announcing it would not impose penalties for non-compliance with the HIPAA Rules against covered healthcare providers in connection with the good faith provision of telehealth. 

While this was an appropriate temporary solution, DASA wanted to find a longer-term, HIPAA-compliant option, so Assistant Director for DASA Technology Services Fred Eaker reached out to DELTA for help, hoping that they could continue to use NC State’s Zoom license and get a portion of users on a HIPAA-compliant version.  

Process

Eaker initially reached out to Associate Vice Provost Donna Petherbridge, who put him in contact with Jonathan Champ, DELTA associate director for data, integrations and custom applications. Champ is responsible for the creation of and enhancements to a variety of web-based products, including NC State’s enterprise Zoom account. Prompted by Eaker, Champ learned that Zoom offers a HIPAA Business Associate Agreement (BAA), a contract that protects personal health information (PHI) in accordance with HIPAA guidelines. 

With Zoom’s BAA option, DASA could achieve its goals for remote healthcare –– to assign and manage Zoom Healthcare accounts to SHS and Counseling Center staff; to manage users who receive a BAA designation; to communicate with SHS and the Counseling Center about the impact of this agreement; and to implement these changes before the enforcement discretion goes away. 

Champ got to work setting up a Zoom subaccount for NC State, which behaves as a separate account under the same license but allows users to log in to the BAA-compliant space with their Unity ID and password. Champ granted access to Eaker and the DASA Technology Services team, who now manage user permissions and can add and remove users as needed. For example, when the Counseling Center takes on student interns, they can give them access to the subaccount and revoke that access when their internships end. 

“I worked closely with Jonathan to get everything set up and make sure that we understood the best practices associated with managing the users in Zoom healthcare,” Eaker says. 

This solution was effective, but it still came with challenges. Champ needed to configure the healthcare subaccount with other systems, including Shibboleth. There are also limitations to certain tools that interact with the subaccount. Employees who are a part of the subaccount can’t schedule Zoom through Moodle and can’t receive reports of student attendees because it does not record that information for privacy purposes. Cloud recording was also initially disabled as information was either fully encrypted or discarded for security reasons, prompting substantial changes for the Counseling Center and their processes. 

During the process of enacting the subaccount, which began in August 2020 and finished in November 2020, Champ and Eaker learned that other campus entities were also interested in gaining access, including the Department of Psychology’s Psychoeducational Clinic. The Clinic serves as a training facility for the department’s accredited doctoral and master’s degree programs. Champ and Eaker gave the unit access so that its students can practice and prepare for careers in clinical counseling. The subaccount makes it simple to grant this access to multiple groups. 

“If there are 12 different groups on campus that need to have HIPAA compliance, all 12 of those groups can join under a single BAA,” Champ says. “It was pretty cool to be able to help out [multiple] different groups all in one effort.”

Other campus partners were critical to the project’s success. The Office of Information Technology performed a rigorous security and compliance review, and NC State’s legal team reviewed the BAA to ensure it complies with legal privacy standards.   

Practice

Those who rely on the Zoom healthcare subaccount are pleased with the quality, secure service they can provide to students. Amy Johnson, MS BSN-RN-BC, is the clinical informatics coordinator for SHS. Her team began using Zoom for telehealth services as soon as COVID-19 limited in-person appointments. 

“We established what type of health problems could be addressed via telehealth, created a consent form specifically for telehealth to inform the students what the visit may entail and what the limitations are, and providers reached out to students via secure messages from our electronic health record with their Zoom links. As the year progressed, we made several system and process updates to automate sending of the Zoom links upon appointment scheduling making it easier for both the providers and the patients to connect via Zoom,” Johnson says. 

The most common types of primary care telehealth appointments are for anxiety, depression and stress, general illness, ADD/ADHD, chronic condition management, skin conditions and preventative health and wellness. Students can also connect with a provider in Gynecological Services to discuss contraception options. In both clinics, students can easily connect with a provider to follow up on a previous visit, discuss any lab results or request prescription refills without having to come into the clinic. Nutritional counseling has transitioned nearly all visits to telehealth, and there are some options for physical therapy telehealth visits as well.

The transition online introduced changes to the office’s workflows, in which a nurse or medical assistant assesses the patient first to collect vital signs, medical history and other pertinent information before transferring the patient to their provider. 

“When we started telehealth, this step was skipped and providers were connecting directly with the students. Eventually, we figured out a way to re-incorporate the nursing portion of the visit. Essentially, our telehealth nurses are ‘co-hosts’ of the providers’ Zoom rooms and are able to meet with the patient first to collect information and update the medical record, and then they hand the meeting off to the provider. This change more closely aligned the telehealth visits with those that might occur in the clinic,” Johnson explains. 

Overall, Zoom healthcare services have been a good option for SHS during COVID-19. 

“When the pandemic began, our department meetings were shifted to Zoom meetings, which was completely new to some people. However, we adapted quickly and learned the technology and began using it to deliver care. Of course, there are limitations to telehealth visits since a provider can not do a physical exam. However, there are many healthcare visits where the discussion between the patient and provider is key, and Zoom allows us to connect with patients in this way,” she says. 

Johnson adds that while SHS has never completely shut its doors, telehealth has become a preferred method for many students, as they can easily fit in a visit between classes and not have to worry about transportation to the clinic. The team plans to continue offering telehealth services after the risk of COVID-19 has diminished. 

Eaker, Champ and others involved in this project learned that while privacy and compliance matters take a long time to achieve, the effort was well worth it to continue to provide the NC State community with secure and reliable healthcare options. SHS and the Counseling Center are able to conduct secure telehealth sessions with their patients and clients, Zoom Healthcare was implemented before the discretion was lifted, making it a long-term, viable option for healthcare services.