On April 9, 2020 the Department of Health & Human Services Office for Civil Rights (OCR) issued another Notification that it will exercise its enforcement discretion and not impose penalties for HIPAA violations in connection with good faith participation in the operation of COVID-19 testing sites during the COVID-19 emergency.

The Notification is intended to help covered entities (such as pharmacies) and their business associates who participate in a Community-Based Testing Site (CBTS) providing only COVID-19 testing services or specimen collection (e.g., via a mobile, walk-up or drive-through setup). In the Notification, OCR encourages covered health care providers and business associates to implement reasonable privacy and security safeguards related to CBTS, including by adhering to HIPAA’s minimum necessary requirements, setting up canopies or similar barriers to provide privacy during testing, controlling car and foot traffic to establish adequate distancing and prevent incidental disclosures, and posting a Notice of Privacy Practices (NPP) or information on how to find the NPP online, in a readily accessible location for individuals at the CBTS.

A complete list of Notifications and other guidance issued by OCR related to COVID-19 response efforts is available here.