OCR Announces Expiration of COVID-19 Public Health Emergency HIPAA Notifications of Enforcement Discretion

On April 11, 2023, OCR announced that the Notifications of Enforcement Discretion issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act during the COVID-19 Public Health Emergency (PHE) will expire with the end of PHE on May 11, 2023 (Notice).

Throughout the PHE, OCR supported the use of telehealth by exercising its HIPAA enforcement discretion. Specifically, OCR published four Notifications of Enforcement Discretion regarding how it would apply the Privacy, Security, and Breach Notification Rules (HIPAA Rules) to certain violations during the pandemic:

• Enforcement Discretion Regarding COVID-19 Community-Based Testing Sites During the COVID-19 Nationwide Public Health Emergency. This Notification announced that OCR would exercise its enforcement discretion to not impose penalties for noncompliance with the HIPAA Rules in connection with the good faith participation in the operation of COVID-19 specimen collection and testing sites.
• Enforcement Discretion for Telehealth Remote Communications During the COVID–19 Nationwide Public Health Emergency. This Notification announced that OCR would exercise its enforcement discretion to not impose penalties for noncompliance with the HIPAA Rules in connection with the good faith provision of telehealth using a non-public facing remote communication technology. This exercise of discretion applied to telehealth provided for any reason, regardless of whether the telehealth service was related to the diagnosis and treatment of health conditions related to COVID-19.
• Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19. This Notification announced that OCR would exercise its enforcement discretion to not impose penalties for violations of certain provisions of the HIPAA Privacy Rule for uses and disclosures of protected health information by business associates for public health and health oversight activities.
• Enforcement Discretion Regarding Online or Web-Based Scheduling Applications for the Scheduling of Individual Appointments for COVID-19 Vaccination During the COVID-19 Nationwide Public Health Emergency. This Notification announced that OCR would exercise its enforcement discretion to not impose penalties for noncompliance with the HIPAA Rules in connection with the good faith use of online or web-based scheduling applications for the limited purpose of scheduling individual appointments for COVID-19 vaccinations.

Each of these Notifications will now expire at 11:59 pm on May 11, 2023.

​According to the Notice, OCR is providing a 90-day transition period (from May 12, 2023 until August 9, 2023) for covered health care providers to come into compliance with the HIPAA Rules with respect to the provision of telehealth services. During this 90-day period, health care providers will not face penalties if they engage in the good faith provision of telehealth. The Notice was published in the Federal Register on April 13, 2023.