Hospitals without walls still had to say where the care happened

The week

The Centers for Medicare & Medicaid Services runs Medicare and oversees Medicaid, and its rules shape how most American hospitals operate and get paid. On March 30, 2020, it announced a broad set of temporary regulatory waivers and an interim final rule to help the health system respond to COVID-19. An interim final rule is a regulation that takes effect immediately, before the usual period of public comment, because waiting would cause harm.

The package built on steps taken earlier that month. In early March, Congress had given the Secretary authority to waive Medicare’s telehealth restrictions during the emergency, through a supplemental appropriations law. On March 17, CMS used that authority to let beneficiaries receive a range of visits by video from home, and OCR announced its enforcement discretion for video platforms the same day. The CARES Act, signed on March 27, widened the telehealth authority further. The March 30 rule appeared in the Federal Register on April 6, and many of its provisions applied back to March 1, 2020.

By then, hospital leaders in the hardest-hit regions were looking at their buildings and doing grim math. There were not enough beds, not enough rooms and, in some places, not enough of the right staff in the right place. Rules written for normal times stood between them and the obvious workarounds.

CMS described the package as enabling “hospitals without walls.” It let hospitals provide services in other locations such as ambulatory surgery centers, the outpatient facilities where people normally go for same-day procedures, and temporary sites. It relaxed a range of staffing, supervision and paperwork requirements. And it greatly expanded Medicare payment for telehealth, care delivered remotely by video or other technology, including services delivered to patients at home. Before the pandemic, Medicare telehealth had been narrowly limited; a patient at home generally could not be the point of care for a paid visit.

The detail in CMS’s announcement shows how wide the changes were. Medicare would pay for more than 80 additional services by telehealth, including emergency department visits, initial nursing facility and discharge visits, and home visits. Clinicians could evaluate beneficiaries who had only an audio phone. Remote patient monitoring was allowed for acute and chronic conditions, even for a patient with a single condition, with pulse oximetry given as the example. Telehealth could satisfy many face-to-face requirements in inpatient rehabilitation, hospice and home health.

On the hospital side, ambulatory surgery centers that had cancelled elective procedures could contract with local health systems to provide hospital services, or enroll and bill as hospitals. Non-hospital buildings could be used for patient care and quarantine where the state approved the location. Hotels and dormitories were named among community sites for triage. Physician-owned hospitals could temporarily add beds, operating rooms and procedure rooms. Hospitals could bill for services furnished outside their four walls, and could screen patients at alternate sites not subject to EMTALA, the federal law requiring emergency departments to screen and stabilize everyone who arrives.

Staffing and paperwork rules moved too. Hospitals could bring in local clinicians and clinicians licensed in other states without breaching Medicare rules, though state licensing law still applied separately. The requirement that a physician supervise certified registered nurse anesthetists was waived. Nurse practitioners and physician assistants could work to the fullest extent their state’s emergency plan allowed. Clinicians and suppliers could enroll in Medicare temporarily. Hospitals got more time to give patients copies of their records, reporting deadlines were extended and certain documentation requests from Medicare were suspended.

The package also allowed more types of practitioners to furnish telehealth and permitted some direct supervision through real-time audio and video. Direct supervision is a billing concept: certain services by nurses, therapists and other staff can be paid only if a qualified physician or practitioner is immediately available to step in. Normally that meant physically present in the building. Now, in some cases, a supervising clinician on a video link could count.

Many of the flexibilities relied on the public health emergency and on Section 1135 waiver authority enabled by the national emergency declared earlier in March. Section 1135 of the Social Security Act lets the Secretary of Health and Human Services temporarily set aside certain Medicare, Medicaid and related requirements when both a public health emergency and a national or presidential emergency are in place. It is, in effect, an emergency release valve built into the law.

The same day, CMS issued blanket waivers of sanctions under the physician self-referral law, often called the Stark law, which restricts financial arrangements between hospitals and the physicians who refer patients to them. The waivers were retroactive to March 1, applied nationwide and covered eighteen listed types of payment and referral, provided they were made in good faith for a COVID-19 purpose. They came with a modest-sounding but real condition. Anyone relying on them had to be able to produce records of their use if the Secretary asked.

For clinicians, the waivers meant freedom to treat patients where and how the crisis demanded. For the people who run hospital records, billing and compliance, they meant something less visible but just as important: every one of those new arrangements still had to be written down, correctly, in systems built for the old ones.

Consider a converted parking structure outside a large city hospital in April 2020. Under bright lights and temporary partitions, nurses are assessing patients with fevers and shortness of breath. A physician who has come out of retirement is reviewing scans on a borrowed laptop. Upstairs, a clinic nurse is running a video visit with a patient at home, while the supervising doctor watches from her own kitchen across town. Everyone is doing the right thing for patients. And every one of those encounters will, eventually, become a medical record and a claim for payment that has to say exactly what happened.

Hospitals needed a register of every emergency change and its legal basis, but the March 30 package exposed a harder, more granular problem. Each flexibility changed a fact that every claim and medical record must state: where the service happened, who furnished it and under whose supervision, and how it was delivered. EHR and billing systems had been built to assume the answers. A clinic visit happened in the clinic, by a credentialed practitioner on site, in person. Once those assumptions broke, the evidence for each encounter had to be captured deliberately, at the moment of care, or it would not exist when an auditor asked.

What follows takes those three facts in turn: where the care happened, who furnished it and under whose supervision, and how it was delivered. A short primer on how a visit becomes a record comes first, because the failures only make sense once the wiring is visible. The later sections cover what the gaps cost and the single test that ties the three facts together.

The record behind every visit, explained

Most hospital executives know the outlines of their technology. Fewer have seen how tightly a single visit is wired into it. A few terms will help.

• EHR (electronic health record). The hospital’s central clinical system: notes, orders, results, medications, and the record of who did what to whom, where and when.
• Revenue cycle. Everything that turns care into payment: registering the patient, capturing charges, coding diagnoses and procedures, submitting claims to insurers and chasing what is unpaid.
• Claim. The bill sent to Medicare, Medicaid or a commercial insurer. It is a structured form, full of codes, that describes the service in a language the payer’s computers can check automatically.
• Place-of-service code. A short code on the claim saying where care happened: office, inpatient hospital, emergency department, patient’s home and so on. Payment rates and rules often depend on it.
• Modifier. A two-character add-on to a billing code that changes its meaning, for example to say that a service was delivered by telehealth.
• Department. In an EHR, a department is more than a name on a door: it is a configuration that carries default codes, charge routing, staffing and reporting rules.
• Cost report. An annual filing hospitals submit to Medicare, describing costs and activity by area. It relies on the same location data.
• Charge master. The hospital’s master price list of billable items. Each item carries codes that decide how a charge appears on the claim.
• Claim scrubber. Software that checks each claim against payer rules before it is sent, and holds back claims that fail.
• Provider-based department. A Medicare status for a hospital outpatient location that is treated as part of the hospital for payment, with its own rules about where it may be and how it bills.

Much of what ends up on a claim is inherited from configuration rather than typed in by anyone. Book a visit in the cardiology clinic, and the system fills in the location, place of service and charge routing for the cardiology clinic. That automation is what lets a hospital process enormous volumes of care accurately in normal times. It is also why a sudden change in where, by whom or how care is delivered can produce thousands of wrong claims before anyone notices.

One visit, followed through the chain

Follow a single visit and the dependency becomes concrete. Registration creates the encounter and attaches it to a department. The department selects the clinician’s documentation template. Orders and documentation drop charges into the charge master, which assigns revenue codes. Coders add diagnosis and procedure codes. The claim scrubber applies its edits, and the payer’s systems apply their own on receipt.

Each of the three facts enters at a different step. Location enters at registration, almost always by default. The practitioner’s identity enters when someone signs the note, through the user account they signed with. Modality, the way the care was delivered, usually enters nowhere at all unless someone built a field for it. Under normal rules that gap did not matter, because nearly every visit was in person.

Hospitals also send two kinds of bill. An institutional claim covers the facility’s costs, and a professional claim covers the practitioner’s work. The same visit can produce both, each with its own place-of-service logic and its own payer edits. A change in where care happened therefore had to be reflected twice, by two teams that often reported to different leaders.

Where the care happened

The waivers let hospitals treat patients in surgery centers, converted spaces, tents and, for some services, patients’ homes, and count them as hospital patients for certain purposes. In the EHR, location is not a label. It drives the department, the place-of-service code, charge routing, the bed census and the cost report. Teams that stood up a new site in days often cloned an existing department. The clone carried the parent’s codes, so services delivered in a converted parking structure could leave the building on a claim as if they had happened in the emergency department.

Cloning was a reasonable shortcut under pressure. It is the digital equivalent of photocopying a form from another office and crossing out the name at the top, while every pre-printed box below still describes the original office.

The fix was simple and easy to skip. Create each temporary location as its own department with its own codes, and record the waiver it relied on and the date it opened. That makes it possible to report volumes by site, reconcile them with what was billed and switch the site off cleanly. The same record should carry the security exceptions the site needed, such as shared workstations, temporary network segments or relaxed device rules, because those live and die with the location.

That last point is often missed. A tent clinic may need computers that several staff log into with a shared account, or a quickly built network connection. Each is a sensible exception for a temporary site. If it is not tied to the site’s record, it tends to outlive the site.

When the home became a hospital department

A second interim final rule, issued at the end of April 2020, pushed the location question further. During the emergency, temporary expansion locations, including a patient’s home, could become provider-based departments of a hospital. The patient had to be registered as a hospital outpatient while the care was delivered. A hospital that relocated an existing department under the expanded relocation policy had to tell its CMS regional office.

The billing consequence turned on a modifier. A relocated department that kept its prior status billed with one modifier and received the full outpatient payment rate. A home treated as a brand-new off-campus department billed with another and received a much lower rate tied to the physician fee schedule. Which modifier was right depended on a notice to CMS and the department’s history, facts that lived in a compliance file rather than in the EHR.

That made the patient’s home a location with a legal status, a registration requirement and a notification trail. Hospitals that wired the relocation notice and the outpatient registration into the home department’s build could show why each claim carried its modifier. Hospitals that let schedulers choose a department by habit could not.

How the location problem differed by type of organization

• Large health systems opened several temporary sites at once, often across facilities with separate Medicare provider numbers. The risk was a site built under one hospital’s number while staff and supplies came from another.
• Critical access hospitals, the small rural hospitals paid on a cost basis, had bed and length-of-stay limits that CMS also relaxed. Their cost-based payment makes accurate location and cost data matter even more, because the cost report sets the payment.
• Ambulatory networks and physician groups did not run hospital departments. Their location question was mostly the professional claim: office, home or elsewhere, and which payer’s instruction applied.
• Federally qualified health centers and rural health clinics were allowed by the CARES Act to act as distant sites for telehealth, under a special payment method. That created another set of codes that their systems had never needed.

Switching a site off

Opening a temporary site gets the attention. Closing one is where records most often go wrong. A clean closure follows a short sequence. Scheduling stops first, so no new encounters land in the department. The department is then given an end date rather than deleted, so its history stays reportable. Outstanding charges are reconciled before the billing team moves on.

The security side follows the same order. Shared accounts and temporary network segments built for the site are disabled, and devices are wiped or returned to inventory. The records the site produced fall under the hospital’s normal retention schedule, which for medical records commonly runs for years under state law. The closure itself, with its date and the name of the person who approved it, goes into the waiver register. Without that last step, the register shows a site that apparently never closed.

Home: one visit, two addresses

Home was the hardest location. When a clinician saw a patient at home by video, the service had two locations, the patient’s and the practitioner’s, and the instructions on which to report changed during 2020. Registration workflows that captured only one address could not later show which rule had been applied.

Suppose a health system reviews a sample of its 2020 video visits a few years later. For each visit, it needs to show where the patient was, where the clinician was and which billing instruction applied on that date. If registration recorded only the clinic’s address, the answer to the first question is a guess, and an uncomfortable one to offer an auditor.

Who furnished it, and under whose supervision

Other waivers relaxed which practitioners could perform which services, sped up credentialing and allowed some direct supervision through real-time audio and video. Credentialing is the process of verifying that a clinician is licensed, trained and fit to practice at a particular hospital, and granting privileges to do specific things there. Medical staff offices granted emergency privileges quickly, and many states separately let out-of-state and recently retired clinicians practice, each on its own timetable. A clinician could be covered by a federal flexibility and not by a state one.

That split matters more than it might seem. Federal waivers govern Medicare payment and participation rules. State law governs who is licensed to practice medicine in the state. A retired physician brought back under a state order, or an out-of-state nurse working under a federal flexibility, might be on solid ground under one authority and not the other, and the two sets of permissions could expire on different dates.

Four authorities, four clocks

For any one clinician working in an unfamiliar role in April 2020, at least four separate permissions could be in play:

1. Medicare enrollment. CMS opened temporary enrollment so clinicians could bill Medicare quickly. Temporary enrollment was tied to the emergency.
2. State licensure. Governors’ orders let out-of-state and recently retired clinicians practice, each order with its own scope and end date.
3. Hospital privileges. Medical staff bylaws typically allow disaster privileges when the hospital’s emergency plan is activated, granted by a named leader and reviewed on a schedule.
4. Controlled substance prescribing. In March 2020 the Drug Enforcement Administration let practitioners prescribe controlled substances by telemedicine without first seeing the patient in person, again tied to the emergency.

Each permission has a different owner: the enrollment team, the medical staff office, the pharmacy and the clinician. A record that captures only “emergency privileges granted” cannot show which of the four applied to a given order or note. When one lapses and the others remain, the hospital needs to know exactly which actions that clinician may still take.

Every permission has a footprint

Each of those decisions has a system footprint. An emergency privilege needs a user account, a role, ordering rights and, for controlled substances, an electronic prescribing credential. A virtual supervisor needs to appear in the record as the supervisor, with a note of how supervision was provided. Documentation templates and cosignature rules that assumed an on-site supervisor needed a field for the remote one. Without it, the chart shows a service by a practitioner who could not bill independently and no evidence of the supervision that made it billable.

The care may have been excellent and properly supervised, but if the record cannot show the supervision, the claim looks as though it should never have been paid.

A practical control links each emergency credential to the flexibility it relied on, federal and state, with an expiry date the identity system enforces. The identity system is the software that creates user accounts and controls what each person can open and do. Accounts created in a hurry for volunteers and temporary staff are the ones most often left active, and an access review that lists them separately is cheap insurance. A dormant account belonging to someone who left months ago is exactly the kind of door attackers look for.

The trade-off in identity controls

Fast onboarding and strong identity controls pull against each other. Electronic prescribing of controlled substances, under DEA rules, requires identity proofing and two-factor authentication before a credential is issued. That cannot be done in five minutes for a clinician who arrived this morning. Hospitals had to choose between waiting, routing those orders through a credentialed colleague, or limiting what new arrivals could order. Each choice is defensible if it is written down and applied consistently.

The same logic applies to access reviews. HIPAA’s Security Rule requires covered entities to record and examine activity in systems holding health information. Emergency accounts deserve a tighter review cycle than permanent staff accounts, because they were created with less vetting. A useful pattern is a named sponsor for every temporary account, who must reconfirm it at a set interval or see it disabled.

Teaching hospitals and the virtual teaching physician

Academic medical centers had a further layer. Medicare pays teaching physicians for services involving residents only when the teaching physician is present for the key portion, with documentation to prove it. During the emergency, CMS allowed that presence through real-time audio and video. Teaching hospitals needed their attestation templates to say how presence was provided. A standard attestation reading “I was present” became inaccurate on any day the teaching physician joined by video.

How it was delivered

The telehealth changes were the most visible. Medicare paid for many more services delivered by video to patients at home, by a wider range of practitioners, and soon for some audio-only services. Billing required specific modifiers and place-of-service codes, and CMS changed the instructions more than once during 2020. Commercial payers and Medicaid programs each set their own rules. The risk was drift: claims coded under one instruction after it had been replaced.

Drift happens easily. A billing team updates its cheat sheet in April. The instructions change in the summer. Some coders hear about it, some do not, and the billing system’s rules are edited in place, so the old instruction simply disappears. A year later, nobody can say which rule was meant to apply to a visit on a given date.

How the coding instructions moved

The instructions changed more than most staff realized. The March 30 rule told practitioners to report the place-of-service code they would have used for an in-person visit, so payment reflected the office rate. They added modifier 95 to mark the service as telehealth. Practitioners who kept using the general telehealth place-of-service code could still do so, but at the lower facility rate.

A second interim final rule at the end of April raised Medicare payment for audio-only telephone visits to match comparable office visits, retroactive to March 1. Later, a new place-of-service code for telehealth delivered to a patient at home took effect on January 1, 2022. Traditional Medicare kept its emergency instructions for a time, while some commercial payers and Medicare Advantage plans switched to the new code at once.

Each of those changes is a separate row in a well-kept rule table: payer, service, effective date, instruction and source. A health system with dozens of payers maintained dozens of such histories at once. The revenue integrity team usually owned them, with compliance signing off on interpretation. Test claims run through the scrubber after each change confirmed that the rule had actually taken.

Two controls addressed it. The first is effective-dated billing rules, added rather than overwritten, so the organization can show which instruction applied on which date of service. The second is capturing modality as structured data in the visit note: video, audio-only or in person, the patient’s location and the patient’s consent where required. A free-text line such as “seen via telehealth” does not support an audit sample of thousands of claims.

Structured data means information captured in defined fields with fixed choices, like a drop-down list, rather than typed sentences. Computers can count, sort and check structured fields. They cannot reliably read a note that says “video, then switched to phone halfway.”

Audio-only and the evidence of choice

Audio-only care raised a sharper documentation question. Later Medicare rules for audio-only mental health care at home required the practitioner to be able to offer video, and the patient to be unable or unwilling to use it. A modifier on the claim had to say so. A practice that had recorded only “phone visit” could not show the condition behind the choice. A structured field for “video offered, patient declined” costs a single click and answers that question permanently.

The video platform question

Platform choice mattered too. Many visits ran on consumer video tools under the enforcement discretion the HHS Office for Civil Rights had announced in March. The Office for Civil Rights, known as OCR, enforces HIPAA, the federal law protecting the privacy and security of health information. Enforcement discretion meant OCR would not penalize providers for good-faith use of everyday video apps that did not meet the usual requirements. That discretion did not change what the record needed to show, and it was always temporary. Organizations that logged which platform each visit used knew where they would need business associate agreements and migrations when it ended.

A business associate agreement is the contract HIPAA requires between a health care organization and any vendor that handles patient information on its behalf, setting out how that vendor must protect it. Consumer apps used in a hurry often had none in place.

From discretion to contracts

Moving off consumer tools was a project in its own right. It meant choosing between video built into the EHR and a standalone platform under a business associate agreement. Embedded video kept the visit, the note and the audit trail in one system, but depended on the EHR vendor’s roadmap and licensing. Standalone platforms were often easier for patients, but every visit then lived in two places, and someone had to reconcile them.

Either route needed configuration choices that compliance teams cared about: whether sessions were recorded, how long any recordings were kept, how waiting rooms worked and who could join a call. Ambulatory networks with many small practices often had a mix of platforms by the summer of 2020. The log of which platform each visit used was what let them plan the migration practice by practice, instead of guessing.

The bill that comes due later

Wrong place-of-service codes turn into denied claims, recoveries and audits, and the bill arrives long after the emergency has ended.

• Money. Claims that cannot be supported can be denied or recovered later, sometimes across large samples extrapolated to a whole population of claims.
• Regulatory and legal risk. Billing for services without evidence of the conditions that made them billable invites audits and, at worst, allegations of improper billing, even when the care was good.
• Security. Emergency accounts, shared workstations and consumer video apps are all exceptions to normal controls. Each needs an end date.
• Clinical quality. Accurate records of who supervised what, and how a visit was conducted, matter for patient safety and follow-up as well as payment.
• Staff. Clinicians who acted in good faith deserve records that protect them when questions come later.

Who comes asking, and how

The questions do not come from one place. Medicare Administrative Contractors, the companies that process Medicare claims regionally, review samples of claims and educate providers on errors. Recovery audit contractors look for improper payments after the fact. Unified program integrity contractors investigate suspected fraud. The HHS Office of Inspector General audits and evaluates. State Medicaid programs and their fraud control units, and the special investigations units of commercial insurers, run their own reviews.

Several of these reviewers can extrapolate. A contractor that finds a high error rate in a statistically valid sample may apply that rate across the whole population of similar claims. A handful of unsupported temporary-site claims can therefore become a large repayment demand. The sample is drawn from records the hospital created in 2020, under pressure, by staff who may have left.

The self-audit clock

There is a further twist. Providers that identify a Medicare or Medicaid overpayment must report and return it within 60 days, under a provision of the Affordable Care Act, with a six-year look-back. A hospital that audits its own emergency-period claims and finds unsupported ones has started that process. Good records shorten the audit and narrow what it finds. Poor records make the honest choice to look more expensive, which is a bad incentive for any compliance program.

Federal relief money added its own trail. Hospitals that received Provider Relief Fund payments had to report how they used them, including pandemic-related expenses and lost revenue. Temporary sites drove many of those expenses, and the same location data supported both the claims and the relief reporting.

One test for every flexibility

Taken together, the three facts give one test for any emergency flexibility a hospital adopts. For a sample of encounters, can it produce the location, the practitioner and supervisor, the modality and the rule in force on that date, from data recorded at the time? If the answer depends on someone’s memory, the flexibility has created a liability alongside the care it enabled.

Passing it comes down to a handful of habits:

• Every temporary site is its own department, with its own codes, the waiver it relied on, and open and close dates.
• Every emergency privilege and account is tied to its federal and state authority and expires automatically.
• Virtual supervision, modality and patient location are captured in structured fields at the time of care.
• Billing rule changes are added with effective dates rather than overwritten.
• The video platform used for each visit is logged.

Beyond traditional Medicare

The March 30 package governed traditional Medicare. Medicare Advantage plans, state Medicaid programs and commercial insurers each decided their own telehealth and site-of-care rules, on their own timetables. A hospital serving all of them faced several parallel rulebooks for the same video visit. That multiplies the value of effective-dated, payer-specific rules. It also means the encounter record has to hold the facts, so that each payer’s rule can be applied to them, rather than holding one payer’s answer.

Who owns each habit

Each habit needs a named owner, or it becomes everyone’s and nobody’s job:

• The chief compliance officer keeps a register of every waiver and flexibility relied on, with its source document, effective date and end date.
• The EHR team builds departments and templates, and refuses to clone a department without a compliance sign-off.
• The medical staff office records each emergency privilege with its federal and state authority.
• The identity team enforces expiry on temporary accounts, and the CISO owns the list of security exceptions tied to each site.
• The revenue integrity team maintains effective-dated billing rules for each payer.

Sequencing matters as much as ownership. In the first 72 hours of an emergency, the register and the department build come first, because every encounter after that inherits them. Structured fields for modality and supervision come next. The rule history and access reviews can follow within the first weeks, provided nothing is overwritten in the meantime.

Metrics an auditor would recognize

A short set of measures shows whether the habits are working. One is the share of encounters at temporary sites that carry a site-specific department. Another is the number of emergency accounts still active after the authority behind them expired. A third is the share of remote visits with structured modality, patient location and supervision fields completed. The last is the count of billing rule changes made by overwriting rather than by adding a dated row. Each can be produced from system data, which is the kind of evidence an examiner trusts.

The case against all this documentation

A fair objection runs as follows. Clinicians in 2020 were exhausted, CMS was signaling flexibility, and OIG itself said its high-risk flags did not prove fraud. Adding fields and builds in the middle of a surge diverted scarce EHR and compliance staff from urgent work. Most audits, on this view, would target outliers rather than ordinary hospitals acting in good faith.

Parts of that objection are right. The worst exposure fell on billing outliers, and regulators generally did not pursue providers for good-faith errors in a moving emergency. But the controls described here sit almost entirely in configuration, not in clinicians’ workload. A department build takes hours, a dropdown takes seconds. And good faith has to be shown with evidence, years later, to reviewers who were not there.

Two hospitals, one audit letter

Suppose two community hospitals each receive the same letter two years after the emergency, asking them to support a sample of telehealth and temporary-site claims.

The first had treated each flexibility as a small project. When it opened an overflow unit in a surgery center, the EHR team built a new department with its own codes and wrote the waiver and opening date into its record. When it began video visits, it added three required fields to the visit note: modality, patient location and consent. Its billing team kept a dated log of every instruction change. Responding to the letter took a few weeks of routine work, mostly pulling reports.

The second had done equally good clinical work under equal pressure. But its overflow unit was a clone of the emergency department, its video visits were documented in free text, and its billing rules had been edited in place several times. Responding meant pulling individual charts, interviewing staff who had since moved on and trying to rebuild a timeline of instructions from old emails. Some claims simply could not be supported, not because the care was wrong, but because the evidence had never been captured.

The difference between the two came down to a handful of decisions, each taking hours rather than weeks, made in the first days of the emergency. Budget and talent had little to do with it.

The second hospital’s shortcuts all felt harmless at the time: cloning departments, granting access without an end date, relying on free-text notes, editing billing rules in place, and assuming someone will remember.

Where the evidence gaps open up

1. If we opened a temporary care site tomorrow, would it get its own department and codes, or would we copy an existing one?
2. Can we list every account created for emergency or temporary staff, and does each one expire on its own?
3. When a supervisor oversees care by video, where in the record does that show up?
4. When billing instructions change, do we keep the old rule with its dates, or overwrite it?
5. Which of our emergency security exceptions are still in place, and who decided to keep them?

With hindsight

The audit question arrived. The HHS Office of Inspector General is the watchdog that investigates fraud, waste and abuse in federal health programs. In September 2022, it published an analysis of the first pandemic year of Medicare telehealth that flagged 1,714 providers whose billing posed a high risk to the program. OIG noted that this did not by itself establish fraud. Its measures rested on exactly the encounter-level fields discussed here: who billed, for what, how and for whom. Organizations with clean, structured records were in the best position to answer questions quickly.

The flexibilities ended on different clocks, which is the part leaders most often underestimate. Many hospital waivers ended with the public health emergency on May 11, 2023, and OCR’s enforcement discretion for video platforms ended after a transition period that August. CMS created the Acute Hospital Care at Home program in November 2020, giving “hospital at home,” in which some patients who would otherwise be admitted receive hospital-level care in their own homes, its own path. Congress extended Medicare telehealth flexibilities a few months at a time, with lapses in late 2025 and early 2026, before extending them through 2027, and hospital at home through September 2030, in February 2026. Mental health services to patients at home were made permanent by statute at the end of 2020.

Some flexibilities did not end at all, which created a different problem. In its physician fee schedule rule for 2026, finalized on October 31, 2025, CMS permanently allowed direct supervision through real-time audio and video for most services, excluding audio-only links and certain surgical services. Teaching physicians could be present virtually on a permanent basis, but only when the service itself was furnished virtually. The virtual supervisor field that hospitals added in a hurry in 2020 turned into permanent infrastructure.

Other clocks kept moving. The Stark blanket waivers ended on May 11, 2023, along with the emergency. The DEA and HHS extended the telemedicine prescribing flexibilities several times while they worked on permanent rules, most recently through December 31, 2026. Hospitals that tied each prescribing credential to the authority behind it could follow those extensions. Those that recorded only “emergency privileges” could not easily tell which permissions still stood.

The place-of-service story also moved on. The new code for telehealth to a patient at home arrived in 2022, and Medicare and commercial payers adopted it on different schedules. Health systems with effective-dated rule tables absorbed that as another row. Those that edited rules in place had to reconstruct history once more.

What held up is the core argument. The audits, the extensions and the permanent changes all turned on the same encounter-level facts: where, by whom, how and under which rule. What did not hold up was the hope that emergency flexibilities would switch off cleanly on one date. They ended in pieces, and some became permanent, so the records built for a temporary emergency had to serve for years.

For a CIO or compliance officer in 2026, the practical residue is a set of fields, departments and rule histories that now carry permanent policy. They deserve the same ownership and review as any other part of the revenue cycle, rather than the informal status they had as emergency builds.

Count the separate timelines in that paragraph. Each one required hospitals to switch something on or off, and each applied to a different slice of their activity. A hospital trying to manage that from memory, emails and edited cheat sheets would struggle. A hospital whose records already captured location, practitioner, supervision, modality and the rule in force on each date could apply each change as a configuration update.

Emergencies will keep producing temporary rules with their own expiry dates. The organizations that handle them well treat every flexibility they use as something to be recorded, dated and eventually retired.