In light of the COVID-19 national emergency, which also constitutes a nationwide public health emergency, you may have heard that the Office of Civil Rights (OCR) is exercising enforcement discretion and that it may waive potential HIPAA violation penalties in certain situations. We have partnered with Blue Orange Compliance to provide guidance on what this “waiver” really means.

First and foremost, the HIPAA regulations and its protections to protected health information are still in effect. In other words, any “waiver” does NOT mean that you can lift all of your HIPAA safeguards, policies, and procedures.

WHAT HAS TEMPORARILY CHANGED:

Enforcement Discretion related to Telehealth Remote Communications

For now, covered entity health care providers may use audio or video technology to provide telehealth using any “non-public facing remote communication product” to communicate with patients, regardless of whether the telehealth service is related to the diagnosis and treatment of health conditions related to COVID-19. OCR Director, Roger Severino, explained that OCR is “empowering medical providers to serve patients wherever they are during this national public health emergency.” Under normal circumstances, OCR may find that some of the telehealth communication methods do not fully comply with the requirements of the HIPAA rules, which could result in enforcement. Additionally, OCR will not impose penalties for the lack of a Business Associate Agreement with the video communication vendors. Providers are encouraged, however, to use all available encryption and privacy modes available during the provision of telehealth services, and to notify their patients that third-party applications may have privacy risks.

Other Changes

Under the waiver, with respect to hospitals in the designated geographic area that have hospital disaster protocols in operation, hospitals will not be penalized for failing to comply with the following HIPAA requirements:

To obtain a patient’s agreement to speak with family members or friends involved in the patient’s care
The requirement to honor a request to opt out of the facility directory
The requirement to distribute a Notice of Privacy Practices
The patient’s right to request privacy restrictions
The patient’s right to request confidential communications

Application timeframe of the waiver:

The waiver went into effect at 6:00PM ET on March 15, 2020, but has retroactive effect to March 1, 2020.
The hospital-specific waiver items bulleted above shall be limited to a 72-hour period beginning upon implementation of a hospital disaster protocol. After which, the waiver is withdrawn and the hospital must comply with the requirements for any patient still under the care of the provider.

OTHER IMPORTANT CONSIDERATIONS

In addition to the waiver, remember that HIPAA already allows you to share patient information:

for treatment purposes – the minimum necessary rule does NOT apply to treatment;
for public health activities (including to public health authorities such as the CDC and local health department); and
to prevent or lessen serious and imminent threats to the patient or community.

You must still make reasonable efforts to limit the PHI disclosed to the ‘minimum necessary’ to accomplish the purpose for everything other than treatment purposes.
You should still use your role-based access policies to limit access to PHI to only those workforce members who need it to carry out their duties.
You may NOT share PHI with the media (without a patient’s consent)
You may NOT disclose PHI to others not involved with the patient’s care (without a patient’s consent).
Other impermissible uses and disclosures (such as marketing, sale of PHI, research, or other restrictions in the HIPAA rule).

We applaud our clients and other healthcare providers for their dedication and continued services that they are providing during this pandemic. For more information, or assistance with HIPAA compliance, please do not hesitate to contact a member of our Post-Acute Care practice, John Paul Hessburg at john.hessburg@kitch.com or Kally Goodwin-Ratzloff at kally.goodwin-ratzloff@kitch.com, or John DiMaggio, CEO, Blue Orange Compliance at john.dimaggio@blueorangecompliance.com, www.blueorangecompliance.com.

Any information included here or through our web site is presented solely for general informational purposes and is not in any way intended as legal advice, is not a substitute for getting actual legal advice from an attorney, and should not be acted upon as legal advice without first seeking qualified professional counsel specific to your needs and situation. Additionally, by providing this general information and the information on our web site, no attorney client relationship is created.

HIPAA During the Pandemic: Guidance on the Waiver or Modification of HIPAA Requirements under §1135 of the Social Security Act

Key Contacts

Related Services