Hospitals without walls still had to say where the care happened
CMS’s March 30, 2020, waivers let care move to new sites, new staff and video. Every claim and record still had to state where, by whom and how, and the systems that captured those facts had assumed the old answers.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 30, 2020, the Centers for Medicare & Medicaid Services announced a broad set of temporary regulatory waivers and an interim final rule to help the health system respond to COVID-19. The package, which CMS described as enabling hospitals without walls, let hospitals provide services in other locations such as ambulatory surgery centers and temporary sites. It relaxed a range of staffing, supervision and paperwork requirements, and greatly expanded Medicare payment for telehealth, including services delivered to patients at home. It allowed more types of practitioners to furnish telehealth and permitted some direct supervision through real-time audio and video. Many of the flexibilities relied on the public health emergency and on Section 1135 waiver authority enabled by the national emergency declared earlier in March.
Earlier in this series, the January 2020 article argued that agencies needed a register of every emergency change and its legal basis. Hospitals needed one too, but the March 30 package exposed a harder, more granular problem. Each flexibility changed a fact that every claim and medical record must state: where the service happened, who furnished it and under whose supervision, and how it was delivered. EHR and billing systems had been built to assume the answers. A clinic visit happened in the clinic, by a credentialed practitioner on site, in person. Once those assumptions broke, the evidence for each encounter had to be captured deliberately, at the moment of care, or it would not exist when an auditor asked. Those three facts are the three parts of this article.
Where the care happened
The waivers let hospitals treat patients in surgery centers, converted spaces, tents and, for some services, patients’ homes, and count them as hospital patients for certain purposes. In the EHR, location is not a label. It drives the department, the place-of-service code, charge routing, the bed census and the cost report. Teams that stood up a new site in days often cloned an existing department. The clone carried the parent’s codes, so services delivered in a converted parking structure could leave the building on a claim as if they had happened in the emergency department.
The fix was simple and easy to skip. Create each temporary location as its own department with its own codes, and record the waiver it relied on and the date it opened. That makes it possible to report volumes by site, reconcile them with what was billed and switch the site off cleanly. The same record should carry the security exceptions the site needed, such as shared workstations, temporary network segments or relaxed device rules, because those live and die with the location.
Home was the hardest location. When a clinician saw a patient at home by video, the service had two locations, the patient’s and the practitioner’s, and the instructions on which to report changed during 2020. Registration workflows that captured only one address could not later show which rule had been applied.
Who furnished it, and under whose supervision
Other waivers relaxed which practitioners could perform which services, sped up credentialing and allowed some direct supervision through real-time audio and video. Medical staff offices granted emergency privileges quickly, and many states separately let out-of-state and recently retired clinicians practice, each on its own timetable. A clinician could be covered by a federal flexibility and not by a state one.
Each of those decisions has a system footprint. An emergency privilege needs a user account, a role, ordering rights and, for controlled substances, an electronic prescribing credential. A virtual supervisor needs to appear in the record as the supervisor, with a note of how supervision was provided. Documentation templates and cosignature rules that assumed an on-site supervisor needed a field for the remote one. Without it, the chart shows a service by a practitioner who could not bill independently and no evidence of the supervision that made it billable.
A practical control links each emergency credential to the flexibility it relied on, federal and state, with an expiry date the identity system enforces. Accounts created in a hurry for volunteers and temporary staff are the ones most often left active, and an access review that lists them separately is cheap insurance.
How it was delivered
The telehealth changes were the most visible. Medicare paid for many more services delivered by video to patients at home, by a wider range of practitioners, and soon for some audio-only services. Billing required specific modifiers and place-of-service codes, and CMS changed the instructions more than once during 2020. Commercial payers and Medicaid programs each set their own rules. The risk was drift: claims coded under one instruction after it had been replaced.
Two controls addressed it. The first is effective-dated billing rules, added rather than overwritten, so the organization can show which instruction applied on which date of service. The second is capturing modality as structured data in the visit note: video, audio-only or in person, the patient’s location and the patient’s consent where required. A free-text line such as “seen via telehealth” does not support an audit sample of thousands of claims.
Platform choice mattered too. Many visits ran on consumer video tools under the enforcement discretion the HHS Office for Civil Rights had announced in March. That discretion did not change what the record needed to show, and it was always temporary. Organizations that logged which platform each visit used knew where they would need business associate agreements and migrations when it ended.
Taken together, the three facts give one test for any emergency flexibility a hospital adopts. For a sample of encounters, can it produce the location, the practitioner and supervisor, the modality and the rule in force on that date, from data recorded at the time? If the answer depends on someone’s memory, the flexibility has created a liability alongside the care it enabled.
With hindsight
The audit question arrived. In September 2022, the HHS Office of Inspector General published an analysis of the first pandemic year of Medicare telehealth that flagged 1,714 providers whose billing posed a high risk to the program. OIG noted that this did not by itself establish fraud. Its measures rested on exactly the encounter-level fields discussed here.
The flexibilities ended on different clocks. Many hospital waivers ended with the public health emergency on May 11, 2023, and OCR’s enforcement discretion for video platforms ended after a transition period that August. CMS created the Acute Hospital Care at Home program in November 2020. Congress extended Medicare telehealth flexibilities in short increments, with lapses in late 2025 and early 2026, before extending them through 2027, and hospital at home through September 2030, in February 2026. Mental health services to patients at home were made permanent by statute at the end of 2020. Each change was easier to apply where encounter data already recorded location, practitioner and modality.