Hospitals will have a limited waiver of HIPAA sanctions and penalties during the COVID-19 outbreak as a result of a bulletin issued on March 16, 2020 by the U.S. Department of Health and Human Services. The Office of Civil Rights also issued a reminder that even during a medical emergency like the COVID-19 pandemic, all health care providers must comply with applicable civil rights laws.
On March 16, 2020, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) issued two bulletins regarding the COVID-19 outbreak – one addresses the limited waiver of HIPAA sanctions and penalties for hospitals and the other addresses compliance with nondiscrimination laws and regulations. The HIPAA waiver is one of the Section 1135 waivers that HHS Secretary Alex M. Azar issued that became effective March 15, 2020.
Limited Waiver of HIPAA Sanctions and Penalties
Although compliance with the HIPAA Privacy Rule is not suspended during a public health or other emergency, under federal law, the Secretary of HHS may waive certain sanction provisions of the Privacy Rule. In the COVID-19 & HIPAA Bulletin: Limited Waiver of HIPAA Sanctions and Penalties During a Nationwide Public Health Emergency (“HIPAA Bulletin”), OCR announced that Secretary Azar exercised his authority to waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the HIPAA Privacy Rule:
- the requirement to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care;
- the requirement to distribute a notice of privacy practices;
- the requirement to honor a request to opt out of a hospital’s directory; and
- the patient’s right to request privacy restrictions or confidential communications.
As noted above, the waiver was effective on March 15, 2020 and is limited in scope and duration. Specifically, the waiver only applies: (1) in the emergency area identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol.
Once the Presidential or Secretarial declaration ends, a covered hospital must comply with all Privacy Rule requirements for any patient under its care, even if the hospital’s disaster protocol has been in place less than 72 hours. The limited waiver does not apply to any other type of HIPAA covered entity and does not apply to business associates.
Nondiscrimination Guidance
In its Bulletin: Civil Rights and the Coronavirus Disease 2019 (COVID) (“Civil Rights Bulletin”), OCR reminds all entities subject to civil rights authorities, including health care providers, that civil rights laws and their implementing regulations still apply during a declared emergency. These laws and regulations prohibit discrimination based on race, color, national origin, disability, age, sex, and exercise of conscience and religion in HHS funded programs.
In issuing the Civil Rights Bulletin, OCR Director Roger Severino said that HHS is “committed to leaving no one behind during an emergency” and “[p]roviders should not place persons using wheelchairs or needing accommodations at the end of the line for health services during emergencies.”
To help address the needs of at-risk populations, OCR suggests that government officials, health care providers, and covered entities consider adopting the following practices to help ensure that all segments of the community are served during the COVID-19 emergency:
- Use qualified interpreter services to help individuals with limited English proficiency or those who are deaf or hard of hearing;
- Make emergency messaging available in languages prevalent in the affected community(ies) and in multiple formats, e.g., audio, large print, and captioning. Websites providing emergency-related information should also be accessible.
- Use a variety of outlets and resources for messaging to reach persons with disabilities, those with limited English proficiency, and members of diverse religious communities.
- Consider and plan for the needs of individuals with limited mobility and individuals with assistive devices or durable medical equipment.
- Stock facilities with items to help individuals maintain independence, such as hearing aid batteries, canes, and walkers.
According to OCR, making “reasonable efforts” to accommodate persons with disabilities will help ensure that all segments of the community benefit from emergency response efforts.
Take-aways
Although this is a challenging time for all health care providers, they must remain mindful of their obligations to protect patients’ rights under HIPAA and nondiscrimination laws. Providers should continue to consult OCR guidance on these evolving issues.
