Insights

HHS Issues Bulletin Concerning HIPAA Enforcement and COVID-19


Effective March 15, 2020, HHS Secretary Azar issued a waiver of sanctions and penalties against certain entities that do not comply with the following provisions of the HIPAA Privacy Rule:

  1. The requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care
  2. The requirement to honor a request to opt out of the facility directory
  3. The requirement to distribute a notice of privacy practices
  4. The patient's right to request privacy restrictions
  5. The patient's right to request confidential communications

The waiver only applies: 1) in the emergency area identified in the recent presidential public health emergency declaration regarding the COVID-19 outbreak; 2) to hospitals that have instituted a disaster protocol as a result of that declaration; and 3) for up to 72 hours from the time the hospital implements its disaster protocol.

The bulletin also reminds providers that even without a waiver, the HIPAA Privacy Rule already allows patient information to be shared for several reasons, including: when necessary for the treatment of the patient or another patient; when necessary for public health authorities to carry out their public health mission; to the extent necessary to prevent or lessen a serious and imminent threat; and to a patient’s family, friends, and others as identified by the patient as being involved in the patient’s care. However, the bulletin warns that affirmative reporting to the media or the public about an identifiable patient, or about specific information about the treatment of an identifiable patient, may not be done without the written authorization of the patient or the patient’s personal representative.

The HIPAA Privacy Rule applies to disclosures made by employees, volunteers and other members of a covered entity’s or business associate’s workforce. However, employers should consider this guidance as they provide coverage to participants who may be diagnosed with and treated for COVID-19.

Bulletin Concerning HIPAA Enforcement and COVID-19 »