HHS Issues Partial Renunciation of Sanctions and Fines for Privacy Law Violations in Storm Harvey Disaster Zone

During emergencies like natural disasters, complying with all HIPAA Privacy Law provisions can be a task for hospitals and can possibly have a negative effect on patient care and calamity relief efforts.

In emergency conditions, HIPAA Rules still relate. The HIPAA Privacy Law allows patient info to be shared to assist with disaster relief attempts and make certain patients get the attention they need.

The Privacy Law allows protected entities to communicate patient information for cure purposes, for public health interests, to disclose patient info to friends, family and others engaged in a patient’s care, to lessen or prevent a serious and impending threat to the health and security of an individual or the public and, under specific circumstances, lets covered units to disclose limited information with the mass media and other individuals not engaged in a patient’s care (45 CFR 164.510(a)).

In such circumstances any disclosures should be limited to the minimum required information to accomplish the objective for which the information is being leaked.

However, calamities often call for an easing of HIPAA Rules and the Administrator of the Department of Health and Human might pick to waive specific provisions of the HIPAA Secrecy Rule according to Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Law.

Throughout the Ebola crisis in November 2014, OCR released a waiver for specific requirements of HIPAA Laws, as was the case in the direct aftermath of Storm Katrina when a renunciation was released for certain Secrecy Rule conditions.

Yesterday, HHS Secretary Tom Price declared that OCR will waive consents and financial penalties for specific Secrecy Rule breaches for hospices in Texas and Louisiana in the Hurricane Harvey calamity area.

The waiver just applies to the requirements of the HIPAA Privacy Law as detailed below:

  • The prerequisites to get a patient’s approval to speak with family members or friends interested in the patient’s treatment. See 45 CFR 164.510(b).
  • The necessity to fulfill a request to withdraw from the service See 45 CFR 164.510(a).
  • The necessity to distribute a notification of secrecy practices. See 45 CFR 164.520.
  • The patient’s privilege to request privacy limitations. See 45 CFR 164.522(a).
  • The patient’s entitlement to request confidential contacts. See 45 CFR 164.522(b)

These renunciations only apply to hospices in the emergency regions that have been identified in the public health disaster declaration.

The renunciation only applies if hospitals have introduced disaster rules and the renunciation applies for 72 hours following the disaster protocol has been applied. The renunciation will also only be valid until the Presidential or Secretarial declaration ends, even if the 72 hours have not elapsed.

Additional information on the partial renunciation of HIPAA restrictions as well as fines as a consequence of Hurricane Harvey can be seen in this HIPAA announcement from HHS.