COVID-19 Update: HHS issues limited 72-hour HIPAA waiver for hospitals


HIPAA megaphone

On March 13, 2020, following President Trump’s declaration of a national emergency due to the COVID-19 (coronavirus) pandemic, the Secretary of Health and Human Services (HHS) issued, among others, the following HIPAA waiver under his 1135 waiver authority.

Waiver of sanctions and penalties arising from noncompliance with the following provisions of the HIPAA privacy regulations:

  • the requirement to obtain a patient’s agreement to speak with family members or friends (as set forth in 45 C.F.R. § 164.510(b));
  • the requirement to honor a request to opt out of the facility directory (as set forth in 45 C.F.R. § 164.510(a));
  • the requirement to distribute a notice of privacy practices (as set forth in 45 C.F.R. § 164.520); and
  • the patient’s right to request privacy restrictions or confidential communications (as set forth in 45 C.F.R. § 164.522).

However, note this is a limited waiver and that it applies to hospitals only when the hospital has instituted disaster protocols and only for a period of time not to exceed 72 hours from implementation of the hospital disaster protocols. OCR has issued a bulletin on the limited waiver, as well as reminders on how HIPAA rules apply in emergency situations. The additional reminder information repeats previously issued guidance.

This HIPAA waiver is effective retroactively to March 1, 2020.

Industries & Practices

Media Contact

Subscribe to Receive Updates
Jump to Page

Necessary Cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytical Cookies

Analytical cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.