The HIPAA Waivers only apply to hospitals when the hospital is operating under hospital disaster protocols (an “ Affected Hospital”) for a period of up to 72 hours (the “ Waiver Period”).  The Waiver Period begins when the Affected Hospital first implements its disaster protocols.  If the national emergency ends prior to the expiration of the 72 hours, then the Waiver Period also expires and the Affected Hospital must immediately comply again with all provisions of the HIPAA privacy rule. Each of the HIPAA Waivers are retroactively effective to March 1, 2020.

During the Waiver Period, HHS has waived an Affected Hospital’s compliance with the following HIPAA privacy requirements:

1. Obtaining Patient’s Agreement to Speak with Family Members or Friends (45 C.F.R. § 164.510).

An Affected Hospital does not have to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care during the Waiver Period.

However, HHS has not expanded the scope of information that can be disclosed to a family member or friend involved in the individual’s care. Therefore, the information disclosed by an Affected Hospital to the family member or friend must still be limited to only information directly relevant to the family member’s or friend’s involvement with the patient’s care.

2. Honor a Request to Opt out of the Facility Directory (45 C.F.R. § 164.510).

An Affected Hospital’s does not have to honor a patient’s request to opt out of being listed in the facility directory during the Waiver Period.

However, HHS did not broaden the scope of the information that can be included in the facility directory.  For example, the facility directory still cannot contain any specific medical information regarding a patient. Therefore, the facility directory cannot identify whether a patient is positive for coronavirus.

3. Notice of Privacy Practices (45 C.F.R. § 164.520)

An  Affected Hospital’s does not have to provide a patient a copy of its notice of privacy practices during the Waiver Period. 

4. Right to Request Privacy Restrictions (45 C.F.R. § 164.522)

An Affected Hospital does not have to allow patient to make a request for privacy restrictions under 45 C.F.R. § 164.522 during the Waiver Period. Absent the waiver, 45 C.F.R. § 164.22 requires a covered health care provider to allow a patient to request restrictions on the following uses and disclosures: (a) Uses or Disclosure of Protected Health Information to Carry Out Treatment, Payment or Health Care Operations; or (b) Disclosures to Family Members or Friends Involved in the Patient’s Care.

5. Right to Request Confidential Communications (45 C.F.R. § 164.522).

An Affected Hospital does not have to allow patient to make a request for confidential communications during the Waiver Period. Generally, a covered health care provider must permit patients to request to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.

STATE CONSIDERATIONS

State privacy laws may also restrict an Affected Hospital’s ability to rely on a HIPAA Waiver to use or disclose protected health information.  Please contact a members of the Benesch COVID-19 Task Force for clarification of any particular state privacy laws that may also need to be addressed.

Further general guidance from the Office of Civil Rights on HIPAA compliance and the Novel Coronavirus Disease can be found here and more information regarding the waivers for HIPAA and Telehealth can be found at here.

Also, consult the Benesch COVID-19 Resource Center for sources and additional information regarding COVID-19.

***

Please note that this information is current as of the date of this Client Alert, based on the available data. However, because COVID-19’s status and updates related to the same are ongoing, we recommend real-time review of guidance distributed by the CDC and local officials.