[{"innerBlocks":[],"name":"core\/freeform","postId":2995,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"In response to a declared public health emergency, the Department of Health and Human Services\u2019 Office for Civil Rights has granted a limited waiver of HIPAA sanctions and penalties for hospitals in portions of Florida, Puerto Rico and the U.S. Virgin Islands affected by Hurricane Irma.

According to OCR, the HIPAA Privacy Rule allows patient information to be shared to assist in disaster relief efforts to ensure patients receive needed medical care.

\u201cWhile the HIPAA Privacy Rule is not suspended during a public health or other emergency, the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act,\u201d the OCR\u2019s bulletin notes<\/a>.

Also See:<\/b> HHS makes Medicare data available to areas that could be hit by Irma<\/a>

As a result, the HHS Secretary has \u201cexercised the authority to waive sanctions and penalties against a covered hospital that does not comply\u201d with several provisions of the HIPAA Privacy Rule, including requirements to:

\u2022\tObtain a patient\u2019s agreement to speak with family members or friends involved in the patient\u2019s care

\u2022\tHonor a request to opt out of the facility directory

\u2022\tDistribute a notice of privacy practices

\u2022\tPatient\u2019s right to request privacy restrictions and to request confidential communications

At the same time, OCR notes in its bulletin that the limited waiver only applies to the following scenario: the emergency area and for the emergency period identified in the public health emergency declaration; hospitals that have instituted a disaster protocol; and for as much as 72 hours from the time the hospital implements its disaster protocol.

\u201cWhen the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol,\u201d states the bulletin.

OCR also points out that in such emergency situations \u201ccovered entities must continue to implement reasonable safeguards to protect patient information against intentional or unintentional impermissible uses and disclosures.\u201d In addition, the agency reminds covered entities and their business associates that they \u201cmust apply the administrative, physical, and technical safeguards of the HIPAA Security Rule to electronic protected health information.\u201d

Two weeks ago, HHS issued similar HIPAA waivers for providers affected by Hurricane Harvey.
","saveContent":"In response to a declared public health emergency, the Department of Health and Human Services\u2019 Office for Civil Rights has granted a limited waiver of HIPAA sanctions and penalties for hospitals in portions of Florida, Puerto Rico and the U.S. Virgin Islands affected by Hurricane Irma.

According to OCR, the HIPAA Privacy Rule allows patient information to be shared to assist in disaster relief efforts to ensure patients receive needed medical care.

\u201cWhile the HIPAA Privacy Rule is not suspended during a public health or other emergency, the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act,\u201d the OCR\u2019s bulletin notes<\/a>.

Also See:<\/b> HHS makes Medicare data available to areas that could be hit by Irma<\/a>

As a result, the HHS Secretary has \u201cexercised the authority to waive sanctions and penalties against a covered hospital that does not comply\u201d with several provisions of the HIPAA Privacy Rule, including requirements to:

\u2022\tObtain a patient\u2019s agreement to speak with family members or friends involved in the patient\u2019s care

\u2022\tHonor a request to opt out of the facility directory

\u2022\tDistribute a notice of privacy practices

\u2022\tPatient\u2019s right to request privacy restrictions and to request confidential communications

At the same time, OCR notes in its bulletin that the limited waiver only applies to the following scenario: the emergency area and for the emergency period identified in the public health emergency declaration; hospitals that have instituted a disaster protocol; and for as much as 72 hours from the time the hospital implements its disaster protocol.

\u201cWhen the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol,\u201d states the bulletin.

OCR also points out that in such emergency situations \u201ccovered entities must continue to implement reasonable safeguards to protect patient information against intentional or unintentional impermissible uses and disclosures.\u201d In addition, the agency reminds covered entities and their business associates that they \u201cmust apply the administrative, physical, and technical safeguards of the HIPAA Security Rule to electronic protected health information.\u201d

Two weeks ago, HHS issued similar HIPAA waivers for providers affected by Hurricane Harvey.
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

OCR grants limited HIPAA waiver to hospitals affected by Irma

More for you