The U.S. Department of Health and Human Services (HHS) Secretary has declared a partial waiver of HIPAA sanctions and penalties in Louisiana because of the damage that Tropical Storm Barry likely caused when it hit the area on July 13 as a hurricane. The HHS declared on July 12, 2019 a public health emergency in Louisiana.
The waiver is applicable only to healthcare organizations located in the emergency region and only during the time specified in the announcement. The waiver only covers particular HIPAA Privacy Rule provisions and only up to 72 hours after the implementation of the hospital’s emergency protocol.
As soon as the period of time for the waiver comes to an end, healthcare organizations are required once more to follow all facets of the HIPAA Privacy Rule, including for under their care when the declaration ends, regardless if the 72-hour time period is not yet up.
Although a waiver has been passed, the Privacy Rule doesn’t forbid the sharing of protected health information (PHI) at the time of disasters to aid patients and ensure they receive the needed care. Some health information can be shared with family members, friends and other persons who are involved in the care of a patient.
The HIPAA Privacy Rule permits PHI to be shared for public health activities and to avert or minimize a serious and impending threat to patient health or safety. HIPAA-covered entities can also share data with disaster relief groups that are authorized to help with disaster relief projects without first getting patient consent.
The HIPAA Privacy and Security Rules continue to be in force during natural disasters, though adhering to the secretarial announcement of waivering sanctions and penalties against HIPAA covered entities for these HIPAA Privacy Rule provisions:
- The need to get a patient’s consent to talk to family members or friends engaged in the care of a patient – 45 CFR 164.510(b).
- The need to honor a request to be taken out of the directory of the facility – 45 CFR164.510(a).
- The need to send a notice of privacy practices – 45 CFR 164.520.
- The right of a patient to privacy restrictions – 45 CFR 164.522(a).
- The right of a patient to private communications – 45 CFR 164.522(b).
The HHS Secretary Azar said that the department is working closely with state health and emergency management authorities to prepare to meet the healthcare needs of communities. Read about the HHS emergency declaration and limited HIPAA waiver here.