The four Notifications of Enforcement Discretion that will expire originally went into effect in 2020 and 2021 regarding the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules. This enforcement discretion allowed HIPAA covered entities flexibility in setting up COVID-19 testing sites, disclosing testing data to health authorities, conducting telehealth appointments, and using web-based scheduling applications for COVID-19 vaccinations.

While this enforcement discretion was in effect, providers were permitted to use standard consumer versions of telecommunication modalities such as Zoom and Skype to provide telehealth, which became a popular alternative to in-person care during the early days of the PHE. in addition, no penalties were imposed during the PHE for the lack of Business Associate Agreements with video communication vendors. Given the dramatic increase in telehealth during the pandemic, providers will need to be wary as normal HIPAA requirements, and potential penalties for violations, are reintroduced.

OCR will provide a transition period of 90 calendar days after the termination of the PHE for covered healthcare providers to come into compliance with HIPAA rules regarding the provision of telehealth. During this transition period, OCR will not impose penalties for noncompliance with these rules.