The Department of Health and Human Services (HHS) has issued a limited set of waivers from HIPAA requirements for those affected in Texas and Louisiana by Hurricane/Tropical Storm Harvey.
Though the agency cannot waive the HIPAA Privacy Rule, it can take more limited, focused actions.
Here, then, are the five provisions for which Secretary Tom Price, M.D., waived HIPAA sanctions and penalties:
The requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care
The requirement to honor a request to opt out of the facility directory
The requirement to distribute a notice of privacy practices
The patient’s right to request privacy restrictions
The patient’s right to request confidential communications
The waivers apply for up to 72 hours after a hospital implements its disaster protocol.