HHS Secretary Tom Price announced that OCRis issuing a partial waiver of sanctions and financial penalties for specific Privacy Rule breaches for hospitals in Texas and Louisiana in the Hurricane Harvey emergency zone.
This partial waiver is only applicable to the provisions of the HIPAA Privacy Rule as outlined below:
- The obligations to recieve a patient’s agreement to talk with family members or friends involved in the patient’s treatment. See 45 CFR 164.510(b).
- The obligation to honor an opt out request in relation to the facility directory. See 45 CFR 164.510(a).
- The requirement to issue a public notice of privacy practices. See 45 CFR 164.520.
- The patient’s expressed right to request privacy restrictions. See 45 CFR 164.522(a).
- The patient’s right to request confidential communications. See 45 CFR 164.522(b)
These partial waivers of HIPAA only apply to hospitals in the emergency zones that have been referred to the public health emergency declaration.
The waiver only applies if hospitals have adopted disaster procedures and the waiver applies for 72 hours after the disaster protocol has been begun. The waiver will also only apply until the Presidential or Secretarial declaration comes to an end, even if the 72 hours has not elapsed.
Further information on the partial waiver of HIPAA sanctions and fines as a result of Hurricane Harvey can be viewed in more detail on this HIPAA HHS release.