Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19, 19392-19393 [2020-07268]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 85, Number 67 (Tuesday, April 7, 2020)]
[Rules and Regulations]
[Pages 19392-19393]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-07268]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Parts 160 and 164


Enforcement Discretion Under HIPAA To Allow Uses and Disclosures 
of Protected Health Information by Business Associates for Public 
Health and Health Oversight Activities in Response to COVID-19

AGENCY: Office of the Secretary, HHS.

ACTION: Notification of enforcement discretion.

-----------------------------------------------------------------------

SUMMARY: This notification is to inform the public that the Department 
of Health and Human Services (HHS) is exercising its discretion in how 
it applies the Privacy Rule under the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA). Current regulations allow a HIPAA 
business associate to use and disclose protected health information for 
public health and health oversight purposes only if expressly permitted 
by its business associate agreement with a HIPAA covered entity. As a 
matter of enforcement discretion, effective immediately, the HHS Office 
for Civil Rights (OCR) will exercise its enforcement discretion and 
will not impose potential penalties for violations of certain 
provisions of the HIPAA Privacy Rule against covered health care 
providers or their business associates for uses and disclosures of 
protected health information by business associates for public health 
and health oversight activities during the COVID-19 nationwide public 
health emergency.

DATES: The Notification of Enforcement Discretion will remain in effect 
until the Secretary of HHS declares that the public health emergency no 
longer exists, or upon the expiration date of the declared public 
health emergency (as determined by 42 U.S.C. 247d), whichever occurs 
first.

FOR FURTHER INFORMATION CONTACT: Rachel Seeger at (202) 619-0403 or 
(800) 537-7697 (TDD).

SUPPLEMENTARY INFORMATION: HHS is informing the public that it is 
exercising its discretion in how it applies the Privacy Rule under the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA).\1\
---------------------------------------------------------------------------

    \1\ Due to the public health emergency posed by COVID-19, the 
HHS Office for Civil Rights (OCR) is exercising its enforcement 
discretion under the conditions outlined herein. We believe that 
this guidance is a statement of agency policy not subject to the 
notice and comment requirements of the Administrative Procedure Act 
(APA). 5 U.S.C. 553(b)(A). OCR additionally finds that, even if this 
guidance were subject to the public participation provisions of the 
APA, prior notice and comment for this guidance is impracticable, 
and there is good cause to issue this guidance without prior public 
comment and without a delayed effective date. 5 U.S.C. 553(b)(B) & 
(d)(3).

---------------------------------------------------------------------------

[[Page 19393]]

I. Background

    The Office for Civil Rights (OCR) at the Department of Health and 
Human Services (HHS) is responsible for enforcing certain regulations 
issued under the Health Insurance Portability and Accountability Act of 
1996 (HIPAA), and the Health Information Technology for Economic and 
Clinical Health (HITECH) Act, to protect the privacy and security of 
protected health information (PHI), namely, the HIPAA Privacy, 
Security, and Breach Notification Rules (the HIPAA Rules).
    The HIPAA Privacy Rule permits a business associate of a HIPAA 
covered entity to use and disclose PHI to conduct certain activities or 
functions on behalf of the covered entity, or provide certain services 
to or for the covered entity, but only pursuant to the explicit terms 
of a business associate contract or other written agreement or 
arrangement under 45 CFR 164.502(e)(2) (collectively, ``business 
associate agreement'' or BAA), or as required by law.
    Federal public health authorities and health oversight agencies, 
state and local health departments, and state emergency operations 
centers have requested PHI from HIPAA business associates (i.e., a 
disclosure of PHI), or requested that business associates perform 
public health data analytics on such PHI (i.e., a use of PHI by the 
business associate) for the purpose of ensuring the health and safety 
of the public during the COVID-19 national emergency, which also 
constitutes a nationwide public health emergency. Some HIPAA business 
associates have been unable to timely participate in these efforts 
because their BAAs do not expressly permit them to make such uses and 
disclosures of PHI.

II. Parameters and Conditions of Enforcement Discretion

    To facilitate uses and disclosures for public health and health 
oversight activities during this nationwide public health emergency, 
effective immediately, OCR will exercise its enforcement discretion and 
will not impose penalties against a business associate or covered 
entity under the Privacy Rule provisions 45 CFR 164.502(a)(3), 45 CFR 
164.502(e)(2), 45 CFR 164.504(e)(1) and (5) if, and only if:
     the business associate makes a good faith use or 
disclosure of the covered entity's PHI for public health activities 
consistent with 45 CFR 164.512(b), or health oversight activities 
consistent with 45 CFR 164.512(d); and
     The business associate informs the covered entity within 
ten (10) calendar days after the use or disclosure occurs (or 
commences, with respect to uses or disclosures that will repeat over 
time).
    Examples of such good faith uses or disclosures covered by this 
Notification include uses and disclosures for or to:
     the Centers for Disease Control and Prevention (CDC), or a 
similar public health authority at the state level, for the purpose of 
preventing or controlling the spread of COVID-19, consistent with 45 
CFR 164.512(b).
     The Centers for Medicare and Medicaid Services (CMS), or a 
similar health oversight agency at the state level, for the purpose of 
overseeing and providing assistance for the health care system as it 
relates to the COVID-19 response, consistent with 45 CFR 164.512(d).
    This enforcement discretion does not extend to other requirements 
or prohibitions under the Privacy Rule, nor to any obligations under 
the HIPAA Security and Breach Notification Rules applicable to business 
associates and covered entities. For example, business associates 
remain liable for complying with the Security Rule's requirements to 
implement safeguards to maintain the confidentiality, integrity, and 
availability of electronic PHI (ePHI), including by ensuring secure 
transmission of ePHI to the public health authority or health oversight 
agency. This Notification does not address other federal or state laws 
(including breach of contract claims) that might apply to the uses and 
disclosures of this information.

III. Collection of Information Requirements

    This notice of enforcement discretion creates no legal obligations 
and no legal rights. Because this notice imposes no information 
collection requirements, it need not be reviewed by the Office of 
Management and Budget under the Paperwork Reduction Act of 1995 (44 
U.S.C. 3501 et seq.).

Roger T. Severino,
Director, Office for Civil Rights, Department of Health and Human 
Services.
[FR Doc. 2020-07268 Filed 4-2-20; 4:15 pm]
BILLING CODE 4153-01-P