Dive Brief:
The HHS Office of Civil Rights said Thursday it is partially suspending its enforcement of HIPAA in a move to free up the information flow and coordinate the public and private sectors’ response to the novel coronavirus outbreak.
OCR said it would use its discretion to not enforce the law against what it described as “the good faith uses and disclosures of protected health information.” The change mostly applies to business associates and federal agencies such as CMS and the Centers for Disease Control and Prevention.
HIPAA rules had been previously relaxed last month to accompany a huge increase in the use of telehealth services to reduce face-to-face encounters during the pandemic and also to help first responders avoid infection.
Dive Insight:
The landmark privacy law has been on the books since the mid-1990s. Both providers and payers have paid millions of dollars in fines due to breaches of protected health information — and been posted to HHS’ “Wall of Shame.” The monetary penalties — and the chagrin of having a publicly disclosed HIPAA violation — were severe enough that many providers actually went above and beyond the requirements to protect patient confidentiality.

But in straining to respond to the COVID-19 outbreak, the federal government has felt the need to roll back HIPAA protections until the virus is tamed.

The order issued by HHS was not particularly specific about what it considered to be a good faith disclosure and seemed to be limited primarily to government agencies. It described two examples. One involved the CDC or an equivalent state agency making a disclosure “for the purpose of preventing or controlling the spread of COVID-19.” The other example included CMS or an equivalent state agency making a disclosure “for the purpose of overseeing and providing assistance for the health care system as it relates to the COVID-19 response.” It did not discuss any scenarios specific to the examples.

The change should allow public health information aggregators such as health information exchanges to share data directly with public health agencies, according to Claudia Williams, former White House senior adviser for health innovation and technology.

CMS has already been working with hospitals in other areas, such as expediting Medicare payments, and asking them to provide more data related to the outbreak, such as bed capacity and supplies on hand.

“The CDC, CMS, and state and local health departments need quick access to COVID-19 related health data to fight this pandemic,” OCR Director Roger Severino said in a statement. “Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives.”

Recommended Reading:
HEALTHCARE DIVE
Dorm rooms as hospitals, ER telehealth: CMS creates ‘unprecedented’ flexibility as COVID-19 rages onoffsite link