HHS waives some provisions of HIPAA after Harvey
Secretary Tom Price action enables providers to more easily share patient information for treatment.
The Department of Health and Human Services is waiving HIPAA sanctions and penalties in the wake of the disruption caused in Texas by Hurricane Harvey.
Tom Price, head of HHS, had previously declared a public health emergency in Texas and Louisiana, and the agency has released guidance that the HHS secretary also is waiving sanctions and penalties against providers that do not comply with certain provisions of the HIPAA Privacy Rule.
Also See: Telemedicine fills the gap for care in the wake of Harvey
The Privacy Rule allows patient information to be shared to assist in disaster relief efforts and to assist patients who need care. However, not all provisions are explicitly waived during disasters, except when the HHS Secretary acts to waive provisions.
In the aftermath of Hurricane Harvey, Price acted to waive the following provisions:
• The requirement to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care.
• The requirement to honor a request to opt out of the facility directory.
• The requirement to distribute a notice of privacy practices.
• The patient’s right to request privacy restrictions.
• The patient’s right to request confidential communications.
The waiver only applies in the emergency area and for the time identified in the public health emergency declaration; to hospitals that have instituted a disaster protocol; and for as long as 72 hours from the time the hospital implements its disaster protocol.
The HHS notice also outlines reasons why HIPAA allows patient information to be shared during emergency situations, including:
• Treatment
• Public health activities
• Disclosure to family and friends
• Imminent Danger (the threat to the health and safety of a patient)
• Disclosures to the media or others not involved in the care of the patient
Tom Price, head of HHS, had previously declared a public health emergency in Texas and Louisiana, and the agency has released guidance that the HHS secretary also is waiving sanctions and penalties against providers that do not comply with certain provisions of the HIPAA Privacy Rule.
Also See: Telemedicine fills the gap for care in the wake of Harvey
The Privacy Rule allows patient information to be shared to assist in disaster relief efforts and to assist patients who need care. However, not all provisions are explicitly waived during disasters, except when the HHS Secretary acts to waive provisions.
In the aftermath of Hurricane Harvey, Price acted to waive the following provisions:• The requirement to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care.
• The requirement to honor a request to opt out of the facility directory.
• The requirement to distribute a notice of privacy practices.
• The patient’s right to request privacy restrictions.
• The patient’s right to request confidential communications.
The waiver only applies in the emergency area and for the time identified in the public health emergency declaration; to hospitals that have instituted a disaster protocol; and for as long as 72 hours from the time the hospital implements its disaster protocol.
The HHS notice also outlines reasons why HIPAA allows patient information to be shared during emergency situations, including:
• Treatment
• Public health activities
• Disclosure to family and friends
• Imminent Danger (the threat to the health and safety of a patient)
• Disclosures to the media or others not involved in the care of the patient
More for you
Loading data for hdm_tax_topic #better-outcomes...