HHS Issues Limited HIPAA Waivers in Hurricane Areas

As it had done for previous hurricanes, the U.S. Department of Health and Human Services (HHS) recently issued a HIPAA Bulletin providing for a limited waiver of HIPAA sanctions and penalties for covered entities in Puerto Rico, Florida, Georgia, South Carolina and North Carolina in the aftermath of Hurricane Dorian.

Such waivers are primarily intended to relax some of the administrative requirements under the HIPAA Privacy Rule for up to 72 hours, to lessen the administrative burdens on hospitals immediately after a disaster protocol was instituted. The waivers thereby give hospitals in the emergency areas a chance to catch up with a potential sudden influx of patients. After the waiver period expires, all provisions of the Privacy Rule again apply.

However, the majority of HHS’s four-page hurricane bulletin template is devoted to reminding people of HIPAA provisions that already existed. For example, in an emergency, a hospital may share a patient’s information for legitimate public health reasons without his or her authorization, or inform third parties or the general public in certain situations that someone is a patient at the facility. Facilities already had broad flexibility to communicate as necessary or appropriate with patients’ relatives and friends, other care providers, disaster relief organizations, and the general public.

In issuing hurricane bulletins, HHS has taken the opportunity to remind providers that even in emergency situations, the HIPAA rules are already more flexible than many realize.