Hurricane Florence has caused the Department of Health and Human Services (“HHS”) to declare a public health emergency ahead of the storm.  Accordingly, HHS’ Office for Civil Rights (“OCR”) released guidance ahead of the hurricane.  The focus of the guidance is that HIPAA should not impede patient care in a disaster situation.

In the guidance, Alex Azar, the Secretary of HHS, stated that during the public health emergency HHS will waive sanctions and penalties for certain provisions under HIPAA.  For example, covered entities will not be responsible for: (1) the requirement to honor a request to opt out of a facility directory; (2) the requirement to distribute a notice of privacy practices; (3) the patient’s right to request privacy restrictions; (4) the patient’s right to request confidential communications; and (5) giving patients the opportunity to agree or object to sharing information with family members or friends involved in the patient’s care.  This waiver only applies in the area identified by the public health emergency declaration and lasts for 72 hours only to those hospitals that instituted disaster protocol.  Additionally, the guidance makes clear that when hospitals deal with disaster relief organizations such as the Red Cross, it is unnecessary to obtain a patient’s permission before sharing health information with such organization, if doing so would interfere with such organization’s capability to respond to the disaster.

OCR further reminded everyone that even without this emergency waiver, HIPAA contains several provisions to allow covered entities to share patient information in the event of a disaster. OCR has issued similar guidance following mass shooting events, like the Pulse tragedy in Orlando.  Despite this waiver, covered entities should continue to safeguard patient information and employ the use of administrative, physical and technical safeguards.