Partial HIPAA Waiver Allowed to Hospices in Irma Tragedy Region

A public health crisis has been announced in regions of Florida, Puerto Rico, and the U.S. Virgin Islands, affected by Storm Irma.

As was the case in Louisiana and Texas after Storm Harvey, the U.S. Division of Health and Human Services’ OCR has declared a partial renunciation of HIPAA Secrecy Law sanctions and fines for hospices impacted by Irma.

OCR has emphasized that the HIPAA Secrecy and Safety Laws haven’t been suspended and protected units should carry on to abide by HIPAA Laws; nevertheless, specific conditions of the Secrecy Law have been waived according to the Project Bioshield Law of 2014 as well as Section 1135(b) of the Social Safety Law.

In case a hospice in the calamity zone doesn’t abide by the following parts of the HIPAA Secrecy Law, sanctions and penalties will be ignored:

  • 45 CFR 164.510(b) – Get a patient’s consent to speak with relatives or buddies participating in the patient’s treatment.
  • 45 CFR 164.510(a) – Honor appeals to leave the service directory.
  • 45 CFR 164.520 – Issue a notification of secrecy practices.
  • 45 CFR 164.522(a) – The patient’s entitlement to request secrecy limitations.
  • 45 CFR 164.522(b) – The patient’s entitlement to request private communications.


The disclaimer only pertains to sanctions and penalties with respect to the above conditions of the HIPAA Secrecy Law, only to hospices in the disaster area that have applied their disaster procedure, and just for the time period mentioned in the public health crisis announcement.

The disclaimer relates for a maximum of 72 hours following a hospice has applied its disaster procedure. If either the HHS Secretary’s or President’s announcement ends within that 72-hour time period, the hospice should instantly abide by all parts of the HIPAA Secrecy Law for all patients under its treatment.

In crisis conditions, the HIPAA Secrecy Law does allow the distributing of PHI for cure reasons and with public health experts that need access to PHI to perform their public health assignment. HIPAA-protected units are also allowed to distribute information with friends, family, and others participating in a person’s treatment, even if a disclaimer hasn’t been issued. Additional particulars of the permissible revelations in crisis locations are detailed in the HHS HIPAA bulletin.

In all circumstances, protected units should restrict revelations to the minimum required information to accomplish the objective for which PHI is revealed.

Even during natural calamities, healthcare companies and their BAs should carry on to abide by the HIPAA Safety Law and should make sure proper physical, administrative, and technical protections are maintained to make sure the integrity, confidentiality, and availability of electronic safeguarded health information to avoid illegal access and revelations.