Waiver of HIPAA Penalties for Good Faith Operation of COVID-19 Community-Based Testing Sites

The HHS has issued an additional Notice of Enforcement Discretion covering healthcare providers and business associates that manage some aspect of COVID-19 community-based testing sites. Under the terms of the Notice of Enforcement discretion, the HHS will not issue sanctions and penalties in relation to good faith participation in the operation of COVID-19 community-based testing sites. The Notice of Enforcement discretion is retroactive to March 13, 2020 and will be in place for the duration of the COVID-19 public health emergency or until the Secretary of the HHS declares the public health emergency has ended.The aim of the notification is to help pharmacies, other healthcare providers, and their business associates provide COVID-19 testing services and specimen collection at purpose-built walk-up or drive through facilities, without risking a financial penalty for noncompliance with HIPAA Rules.

While the Notice of Enforcement Discretion has been published, the HHS’ Office for Civil Rights is encouraging covered entities and their business associates to ensure reasonable security measures are implemented to protect the privacy of users of the service and prevent the accidental exposure or disclosure of PHI to unauthorized people.

Privacy controls such as canopies and barriers should be used to separate the testing area to protect the privacy of users of the service and there should be a buffer zone to stop members of the public from observing people being tested.

Social distancing measures need to be put in place to reduce the risk of transmission of SARS-CoV-2. A distance of at least 6 feet should be maintained between patients at all times. These social distancing measures will help to ensure conversations between a patient and CBTS staff cannot be overheard. OCR also recommends posting signs forbidding filming at testing facilities.

A Notice of Privacy Practices should also be published in a place where it can be easily read by visitors. The NPP should also be published on the Internet, with information included in the printed notice outlining how the NPP can be viewed online.

Uses and sharing of PHI should be limited to the minimum necessary amount to achieve the purpose for which the information is shared, other than when disclosing PHI for treatment reasons.

You can view the Notice of Enforcement Discretion on this link.

Author: Maria Perez