HHS Issues Limited Waivers of HIPAA Sanctions and Penalties for Hospitals in Response to COVID-19

Following the recent Presidential declaration of a national emergency and HHS's declaration of a nationwide public health emergency in response to the COVID-19 pandemic, HHS issued a bulletin, on March 16, 2020, entitled "COVID-19 & HIPAA Bulletin" ("Bulletin") that temporarily lessens the burden on hospitals to comply with certain obligations under HIPAA to facilitate the hospitals' response to potential COVID-19 exposures. The Bulletin waives sanctions and penalties under HIPAA against a covered hospital that does not comply with certain provisions of HIPAA's Privacy Rule.

Specifically, while the HIPAA Privacy and Security Rules generally remain in effect during this public health emergency, effective as of March 15, 2020, HHS is waiving sanctions and penalties against a hospital associated with the following provisions of the Privacy Rule:

1. The requirements to obtain a patient's agreement to speak with family members or friends involved in the patient's care. See 45 CFR 164.510(b)
2. The requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a)
3. The requirement to distribute a notice of privacy practices. See 45 CFR 164.520
4. The patient's right to request privacy restrictions. See 45 CFR 164.522(a)
5. The patient's right to request confidential communications. See 45 CFR 164.522(b).

These waivers will apply only: (i) in the emergency area identified in the public health emergency declaration; (ii) to hospitals that have instituted a disaster protocol; and (iii) for up to 72 hours from the time the hospital implements its disaster protocol. However, when the emergency declaration terminates, a hospital will again be subject to all requirements of the Privacy Rule for any patient still under its care (even if the 72 hours have not elapsed since implementation of its disaster protocol).

The Bulletin also outlines multiple ways that the HIPAA Privacy Rule allows disclosures of patient information in emergency situations even without a waiver.

Despite the flexibility under HIPAA provided by these limited waivers for covered hospitals responding to the COVID-19 pandemic, covered hospitals and their business associates otherwise remain subject to both the Privacy Rule and the administrative, physical, and technical safeguards of the HIPAA Security Rule. The Bulletin is limited to hospitals that have instituted a disaster protocol and not all covered entities under HIPAA (e.g., skilled nursing facilities, ambulatory surgery centers, and medical practices).

As the federal response to the COVID-19 outbreak continues, HHS may issue additional guidance providing flexibility with respect to other HIPAA requirements (see, for example, the notice issued on March 17, 2020, with respect to the provision of good-faith telehealth services).