HHS issues HIPAA waiver for covered hospitals in wake of Hurricane Florence

With Hurricane Florence making landfall, Health and Human Services Secretary Alex Azar has waived sanctions and penalties under certain provisions of the HIPAA Privacy Rule.

While the HIPAA Privacy Rule is not suspended during a public health or other emergency, the HHS Secretary may waive certain provisions of the rule under the Project Bioshield Act of 2004 of the Social Security Act.

Azar’s waiver, part of his declaration of a public health emergency in North Carolina, South Carolina and Virginia, applies to provisions that generally require covered hospitals to give patients the opportunity to agree or object to sharing information with family members or friends involved in their care.

“This waiver applies only to the emergency area and for the emergency period identified in the (public health emergency) declaration and only to hospitals that have instituted a disaster protocol,” states the HHS announcement. “Qualifying hospitals can take advantage of the waiver for up to 72 hours from the time the hospital implements its disaster protocol unless the PHE declaration terminates first.”

At the same time, the agency points out that even without a waiver the HIPAA Privacy Rule “allows patient information to be shared to assist in disaster relief efforts and to assist patients in receiving the care they need.”

Also See: HHS offers hurricane guidance to healthcare facilities

“HHS is committed to leaving no one behind during disasters, and this guidance is designed to help emergency responders and health and human service providers meet that goal,” says Roger Severino, director of the HHS Office for Civil Rights. “OCR also provides technical assistance on HIPAA and civil rights to emergency responders and hospitals so they feel empowered to help people and families in crisis.”