HHS issues HIPAA waiver in response to Hurricane Dorian

As Hurricane Dorian bears down on Florida and the Mid-Atlantic states, the Department of Health and Human Services has waived sanctions and penalties under certain provisions of the HIPAA Privacy Rule.

The waiver, announced by HHS Secretary Alex Azar on Tuesday, is part of his earlier declarations of a Public Health Emergency (PHE) for the states of Florida, Georgia and South Carolina in preparation for Hurricane Dorian. The provisions otherwise apply to covered hospitals.

“This waiver applies only to the emergency area and for the emergency period identified in the PHE declaration and only to hospitals that have instituted a disaster protocol,” according to the HHS announcement. “Qualifying hospitals can take advantage of the waiver for up to 72 hours from the time the hospital implements its disaster protocol unless the PHE declaration terminates first.”

The waiver applies to provisions that generally require covered hospitals to give patients the opportunity to agree or object to sharing information with family members or friends involved in their care.


Although the HIPAA Privacy Rule is not suspended during a public health or other emergency, the HHS Secretary may waive certain provisions of the rule under the Project Bioshield Act of 2004 of the Social Security Act.

At the same time, the agency points out that even without a waiver the HIPAA Privacy Rule “allows patient information to be shared to assist in disaster relief efforts and to assist patients in receiving the care they need.”

In addition, HHS notes that the Privacy Rule “permits covered entities to share information for treatment purposes, public health activities and to prevent or lessen a serious and imminent threat to health or safety” as well as “allows the sharing of information with individuals’ family, friends and others involved in their care in emergency situations to ensure proper care and treatment.”