Limited Waiver of HIPAA Sanctions and Penalties as a Result of Hurricane Ida

The Secretary of the Department of Health and Human Services (HHS) Xavier Becerra has declared a public health emergency as a result of the consequences of Hurricane Ida in Louisiana and Mississippi. Under these circumstances, the Secretary has also exercised the authority to waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: 

• the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b). 

• the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a). 

• the requirement to distribute a notice of privacy practices. See 45 CFR 164.520. 

• the patient's right to request privacy restrictions. See 45 CFR 164.522(a). 

• the patient's right to request confidential communications. See 45 CFR 164.522(b). 

When the Secretary issues such a waiver, it only applies: (1) in the emergency area and for the emergency period identified in the public health emergency declaration (the states of Louisiana and Mississippi); (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol. When the Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol. 

These waivers will become effective at 6:00 P.M. Eastern Daylight Time on August 31, 2021, but will have retroactive effect to August 26, 2021, in the state of Louisiana, and to August 28, 2021, in the state of Mississippi.

Declaration of Public Health Emergency (HHS, August 30, 2021)