HHS Secretary Alex Azar issued a limited waiver of HIPAA sanctions and penalties for hospitals and health systems in Florida, Georgia and South Carolina due to Hurricane Dorian, according to the HIPAA Journal.
The HIPAA waiver announcement followed Mr. Azar's public health emergency warning.
Hospitals and health systems must have implemented their disaster protocol to qualify for the HIPAA waiver. Additionally, the waiver only applies for up to 72 hours from when the disaster protocol was implemented, unless the emergency declaration terminations before the 72-hour period, reports the HIPAA Journal.
HHS agrees to waiver HIPAA sanctions and penalties for the following provisions of the privacy rule:
- The requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).
- The requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).
- The requirement to distribute a notice of privacy practices. See 45 CFR 164.520.
- The patient’s right to request privacy restrictions. See 45 CFR 164.522(a).
- The patient’s right to request confidential communications. See 45 CFR 164.522(b).