On April 2, 2020, the U.S. Department of Health and Human Services (“HHS”) issued a Notification of Enforcement Discretion (the “Notification”) regarding the disclosure of protected health information (“PHI”) to public health authorities and use of PHI to perform analytics for such authorities.  Designed to “facilitate uses and disclosures for public health and health oversight activities during this nationwide public health emergency,” the Notification relaxes HHS’s enforcement of certain provisions of the Privacy Rule issued  under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).  More specifically, the Notification announces that, under certain circumstances, HHS will not impose penalties for violations of such provisions against covered health care providers and their business associates for the use and disclosure of PHI “by business associates for public health and health oversight activities” in connection with the COVID-19 nationwide public health emergency.

The Privacy Rule governs uses and disclosures of PHI by covered entities (e.g., healthcare providers and health plans) and their business associates (e.g., contractors whose functions involve PHI).  A covered entity may permit its business associates to use and disclose PHI to conduct certain activities and functions on behalf of, or for, the covered entity, but only as set forth in a business associate agreement (“BAA”).

The Notification explains that “[s]ome HIPAA business associates have been unable to timely participate in . . . efforts” to provide federal public health authorities and health oversight agencies with certain PHI “because their BAAs do not expressly permit them to make such uses and disclosures of PHI.”  HHS states that federal public health authorities and health oversight agencies, state and local health departments, and state emergency operations centers have specifically requested such PHI in their efforts to ensure “the health and safety of the public during the COVID-19 national emergency COVID-19.”

As a result, HHS will relax enforcement of certain provisions of the Privacy Rule, effective immediately until the end of the nationwide public health emergency. HHS will not bring an enforcement action based on violation of the following Privacy Rule requirements and restrictions:

  • a business associate may use or disclose PHI only as permitted or required by a BAA (see 45 CFR 164.502(a)(3));
  • a covered entity must obtain certain documented “satisfactory assurances” from a business associate before disclosing PHI to that business associate to process PHI on behalf of the covered entity (see 45 CFR 164.502(e)(2)); and
  • a BAA must establish permitted uses and disclosures of PHI by the business associate and may not authorize the business associate to use or further disclose PHI in a manner that would violate Privacy Rule requirements if done by the covered entity, subject to certain exceptions (g., for certain healthcare operations) (see 45 CFR 164.504(e)(1) and (5)).

The Notification makes clear, however, that HHS will exercise its enforcement discretion with respect to these provisions “if and only if”:

  • a business associate “makes a good faith use or disclosure of the covered entity’s PHI for public health activities” (see 45 CFR 164.512(b)), or “health oversight activities” (see 45 CFR 164.512(d)); and
  • the business associate informs the covered entity within 10 calendar days after the use or disclosure occurs (or begins, for repeated disclosures).

Examples of “good faith uses or disclosures” include uses and disclosures to: (1) “the Centers for Disease Control and Prevention (CDC), or a similar public health authority at the state level, for the purpose of preventing or controlling the spread of COVID-19”; and (2) “the Centers for Medicare and Medicaid Services (CMS), or a similar health oversight agency at the state level, for the purpose of overseeing and providing assistance for the health care system as it relates to the COVID-19 response.”

As HHS notes, the “Notification does not address other federal or state laws (including breach of contract claims) that might apply to uses and disclosures” of PHI by business associates.

HHS appears to be moving incrementally as it seeks to balance privacy concerns and the need to take unprecedented actions to stem the COVID-19 pandemic.  This most recent announcement follows an earlier notification of enforcement discretion (discussed in an earlier post) concerning health care providers communicating with patients and providing telehealth services through remote communications technologies during the COVID-19 national health emergency.

Tags: COVID-19, Health Privacy
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Read more about Anna D. KrausEmail
Show more Show less