COVID-19 Update: HHS issues limited 72-hour HIPAA waiver for hospitals

On March 13, 2020, following President Trump’s declaration of a national emergency due to the COVID-19 (coronavirus) pandemic, the Secretary of Health and Human Services (HHS) issued, among others, the following HIPAA waiver under his 1135 waiver authority.

Waiver of sanctions and penalties arising from noncompliance with the following provisions of the HIPAA privacy regulations:

• the requirement to obtain a patient’s agreement to speak with family members or friends (as set forth in 45 C.F.R. § 164.510(b));
• the requirement to honor a request to opt out of the facility directory (as set forth in 45 C.F.R. § 164.510(a));
• the requirement to distribute a notice of privacy practices (as set forth in 45 C.F.R. § 164.520); and
• the patient’s right to request privacy restrictions or confidential communications (as set forth in 45 C.F.R. § 164.522).

However, note this is a limited waiver and that it applies to hospitals only when the hospital has instituted disaster protocols and only for a period of time not to exceed 72 hours from implementation of the hospital disaster protocols. OCR has issued a bulletin on the limited waiver, as well as reminders on how HIPAA rules apply in emergency situations. The additional reminder information repeats previously issued guidance.

This HIPAA waiver is effective retroactively to March 1, 2020.