On April 2, 2020, the Department of Health and Human Services Office of Civil Rights (OCR) issued a notice stating that it would exercise its enforcement discretion and not impose penalties for violations of certain provisions of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule related to good faith uses and disclosures of protected health information (PHI) for public health and health oversight activities during the COVID-19 national emergency. Typically, the HIPAA Privacy Rule only allows a business associate to use and disclose PHI for public health and health oversight purposes if such uses and disclosures are specifically permitted in the business associate agreement with the covered entity.

OCR’s notice comes at the urging of public health authorities and oversight agencies, state and local health departments, and state emergency centers who have requested PHI from HIPAA business associates or have requested that business associates perform analytics on PHI for health and safety purposes during the COVID-19 national emergency. Due to the normal HIPAA rules, some business associates could not promptly participate in these efforts because such uses and disclosures were not specifically allowed in their applicable business associate agreements.

Penalties will not be imposed against a business associate or the covered entity with whom it has a relationship if the business associate makes a good faith use or disclosure of PHI for public health activities or health oversight activities consistent with the privacy rule’s requirements for such disclosures and the business associate informs the covered entity within 10 days after the use or disclosure occurs — or commences for disclosures that will repeat over time. Examples of such good faith uses and disclosures include those for or to the Centers for Disease Control and Prevention or state public health authority for the purpose of controlling the spread of COVID-19, or to the Centers for Medicare and Medicaid Services or state health oversight agencies for the purpose of assisting health care systems as it relates to COVID-19 response efforts.

Please visit our COVID-19 Toolkit for all of Taft’s updates on the coronavirus.