Support Centre

USA: OCR announces enforcement discretion for business associates during Coronavirus emergency

The U.S. Department of Health & Human Services' Office for Civil Rights ('OCR') announced, on 2 April 2020, in a bulletin ('the Bulletin') that, effective immediately, it would exercise enforcement discretion and waive potential penalties for violations of the Health Insurance Portability and Accountability Act of 1996 ('HIPAA') against health care providers or their business associates for good faith use and disclosures of protected health information ('PHI') by business associates for public health and health oversight activities during the COVID-19 ('Coronavirus') public health emergency. In particular, the Bulletin highlights that the business associate making the disclosure must inform the covered entity within ten calendar days after the user or disclosure. Lastly, the Bulletin reminds all HIPAA covered entities that the enforcement discretion does not extend to other requirements or prohibitions under HIPAA. 

You can read the press release here and the Bulletin here.