On April 2, 2020, the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) announced, effective immediately, that it will exercise its enforcement discretion and will not impose penalties for violations of certain provisions of the HIPAA Privacy Rule against health care providers or their business associates for the good faith uses and disclosures of protected health information (PHI) by business associates for public health and health oversight activities during the COVID-19 nationwide public health emergency. The guidance may be found here. The guidance will remain in effect until the coronavirus pandemic ends or HHS declares that the public health emergency no longer exists, whichever comes first.

“The CDC, CMS, and state and local health departments need quick access to COVID-19 related health data to fight this pandemic,” said Roger Severino, OCR director. “Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives,” Severino added.

Presently, the HIPAA Privacy Rule permits a business associate of a HIPAA covered entity to use and disclose PHI to conduct or provide certain activities or functions on behalf of or to the covered entity, but only pursuant to the terms of the business associate agreement between those two entities, or as required by law. However, during the COVID-19 pandemic, OCR will not impose a penalty against a business associate or covered entity if:

• the business associate makes a good faith use or disclosure of the covered entity’s PHI for public health activities or health oversight activities; and
• the business associate informs the covered entity within 10 calendar days after the use or disclosure.

Examples of such good faith uses or disclosures include disclosures to the Centers for Disease Control and Prevention (CDC), or a similar state public health authority, for the purpose of preventing or controlling the spread of COVID-19 and/or to the Centers for Medicare and Medicaid Services (CMS), or a similar state health oversight agency, for the purpose of overseeing and providing assistance for the health care system as it relates to COVID-19.