HHS Releases Partial Waiver of HIPAA Penalties and Sanctions in California

The Administrator of the U.S. Division of Health and Human Services has released a partial renunciation of HIPAA penalties and sanctions in California. The renunciation was declared after the presidential announcement of a public health crisis in northern California because of the wildfires.

The same as was the situation with the renunciations released after Tornados Maria and Irma, the partial renunciation of HIPAA penalties and sanctions only concerns when healthcare suppliers have applied their disaster procedure, and then just for a duration of up to 72 hours after the application of that procedure. In the incident of the public health crisis announcement ending, healthcare companies should then abide by all terms of the HIPAA Secrecy Law for all sick persons still under their treatment, even when the 72-hour period hasn’t yet finished.

When the HHS released a partial renunciation of HIPAA penalties and sanctions, healthcare companies should still abide by the conditions of the HIPAA Safety Law and the Secrecy Law isn’t postponed.  The HHS just exercises its power according to the Project Bioshield Law of 2004 (PL 108-276) as well as section 1135(b) (7) of the Social Security Act, and won’t impose penalties or sanctions against healthcare companies for the following requirements of the HIPAA Secrecy Law:

  • 45 CFR 164.510(b) – The necessities to get a patient’s approval to speak with friends or family members engaged in the patient’s treatment.
  • 45 CFR 164.510(a) – The condition to implement an appeal to leave the service directory.
  • 45 CFR 164.520 – The condition to issue a notification of secrecy practices.
  • 45 CFR 164.522(a) – The patient’s entitlement to request secrecy limitations.
  • 45 CFR 164.522(b) – The patient’s entitlement to request secret communications.

Even in crisis conditions, the HIPAA Secrecy Law allows HIPAA-protected units to disclose patients’ PHI to help in disaster relief attempts and to help make sure patients get the treatment they require.

PHI might also be revealed with the aim of providing cure to patients, to coordinate patient treatment, or when bringing up patients to other healthcare suppliers.  PHI can be revealed for public health actions to let companies perform their public health duties. Revelations can be made to friends, family members, and other people engaged in a patients’ treatment, as required, to locate, identify, or inform loved ones of the patient’s whereabouts, illness, or loss of life. Revelations can be made to anybody, as needed, to avoid or reduce a severe injury and revelations can be made to the mass media concerning a patient’s overall health position and partial service directory information can also be revealed for a named patient if the patient hasn’t opposed to such revelations.

In all instances, the ‘least necessary’ requirement applies. Information must be confined to the minimum required information to accomplish the precise purpose for which it’s revealed.

More information on the renunciation can be obtained in the HHS bulletin on this link.