OCR has made several announcements in the past week, including allowing additional waivers to the HIPAA Privacy Rule, providing Covered Entities with guidance on notifications to first responders and reminding Covered Entities of their obligations under the Civil Rights laws of Section 1557 of the Affordable Care Act.

On April 2, 2020, OCR announced, effective immediately, it will not impose penalties for violations of certain provisions of the HIPAA Privacy Rule against Covered Entities or their Business Associates for uses and disclosures of protected health information (“PHI”) by Business Associates for public health and health oversight activities.  Specifically, this waiver will allow Business Associates to make “good faith” use or disclosures to public health authorities even if not expressly permitted in their Business Associate Agreements (“BAA”) with Covered Entities.  For example, a Business Associate could disclose Covered Entity’s PHI to the CDC or local public health authority to assist in the prevention or controlling of the spread of COVID-19, a use and disclosure not typically found in BAAs.  Note, however, Business Associates are required to inform the Covered Entity within 10 calendar days after its use or disclosure of PHI for such purposes.  A copy of this waiver is available at: https://www.hhs.gov/sites/default/files/notification-enforcement-discretion-hipaa.pdf

On March 28, 2020, OCR issued guidance to remind Covered Entities that their obligations under laws and regulations that prohibit discrimination on the basis of race, color, national origin, disability, age, sex, and exercise of conscience and religion, remain in effect.  OCR specifically highlighted that individuals “with disabilities should not be denied medical care on the basis of stereotypes, assessments of quality of life, or judgments about a person’s relative ‘worth’ based on the presence or absence of disabilities.”  Decisions for treatment should be based on an individualized assessment of each patient using the best available objective medical evidence. More information on this guidance is available at: https://www.hhs.gov/sites/default/files/ocr-bulletin-3-28-20.pdf

On March 24, 2020, OCR issued guidance on when a Covered Entity may share the name or other identifying information of individuals who have been infected with or exposed to COVID-19 with law enforcement, paramedics and other first responders without such individual’s authorization.  OCR provided the following circumstances when such disclosures are permitted:

• When the disclosure is needed to provide treatment;
• To notify public health authorities in order to prevent the control or spread of disease; and
• When first responders may be at risk of infection.

OCR’s complete list of circumstances and examples is available at: https://www.hhs.gov/about/news/2020/03/24/ocr-issues-guidance-to-help-ensure-first-responders-and-others-receive-protected-health-information-about-individuals-exposed-to-covid-19.html

Please contact one of our Firm’ s health law attorneys if you would like more information.  

______________