Coronavirus Regulatory and Legal-HIPAA

Coronavirus Regulatory and Legal-HIPAA

Home / Coronavirus Regulatory and Legal-HIPAA

LEGAL/REGULATORY—HIPAA 
March 26, 2020

Click here to download a PDF version of this page

Legal Helpline is available at (720) 858-6030—Monday–Friday 8am to 5pm
We are receiving a high call volume and want to assure you that if you leave a message, we will respond in a timely manner. If you have been working with a specific staff member you should continue to contact them on their direct line or via email.

HIPAA and Telemedicine
OCR will waive potential HIPAA penalties for good faith use of telehealth during the epidemic. HIPAA-covered health care providers may communicate with patients with any non-public facing remote communication product available to communicate with patients. The waiver only applies until the emergency declaration terminates. 

When considering providing telehealth services out-of-state in response to testing, treatment, and care of patients with COVID-19, providers should access state medical board sites for the latest information regarding guidance for health care professionals not currently licensed in the state.

For more information, please see: https://www.hhs.gov/about/news/2020/03/20/ocr-issues-guidance-on-telehealth-remote-communications-following-its-notification-of-enforcement-discretion.html 

Waiver of Certain HIPAA Requirements – Covered Hospitals
The Secretary of the Department of Health and Human Services (“Secretary”) has waived sanctions and penalties, beginning March 15, 2020, against a covered hospital that does not comply with the following requirements of the HIPAA Privacy Rule: 

• The requirement to obtain a patient’s agreement to speak with family members or friends;
• The requirement to honor a request to opt out of the facility directory;
• The requirements to distribute a notice of privacy practices;
• The patient’s right to request privacy restrictions; and, 
• The patient’s right to request confidential communications. 

This waiver only applies to the above provisions, and only in an emergency area identified in the public health emergency declaration (nationwide) to hospitals that have instituted a disaster protocol; and for up to 72 hours from the time the hospital implements said disaster protocol. Once the emergency declaration terminates, the hospital must comply with the Privacy Rules for any patient under its care, even if 72 hours have not elapsed since the implementation of the disaster protocol. The remainder of the HIPAA Privacy Rule remains intact.

The Bulletin also contains an informative discussion of how HIPAA applies in emergencies, including a description of when the sharing of patient information is permitted for treatment, public health activities, and to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, without patient authorization.

A link to the Secretary’s Declaration can be found below, which includes a link to the Privacy Rule.
https://www.hhs.gov/sites/default/files/hipaa-and-covid-19-limited-hipaa-waiver-bulletin-508.pdf

Disclosures to First Responders 
OCR issued guidance on how covered entities may disclose protected health information (PHI) about an individual who has been infected with or exposed to COVID-19 to law enforcement, paramedics, other first responders, and public health authorities in compliance the HIPAA Privacy Rule.

The guidance explains that a covered entity may disclose PHI about a patient, without a HIPAA authorization:

• When needed to provide treatment;
• When required by law
• When first responders may be at risk for an infection; and
• When disclosure is necessary to prevent or lessen a serious and imminent threat

OCR provides several illustrative examples applicable to a public health emergency of when disclosures of PHI to first responders and others is permitted so they can take extra precautions or use personal protective equipment. Except when required by law, or for treatment, only the “minimum necessary” should be disclosed. 

For further information, please see https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf