APhA coronavirus watch: HHS relaxes HIPAA enforcement for entities operating COVID-19 testing sites

On April 9, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced that it will exercise its HIPAA-enforcement discretion and will not impose violation penalties for entities or business associates that participate in COVID-19 testing in good faith. The exercise of enforcement discretion takes effect immediately and is retroactive to March 13, 2020.

OCR’s notification applies to covered health care providers, including some large pharmacy chains and their business associates, that operate or participate in operating community-based testing sites. This includes mobile, drive-through, or walk-up sites that only provide COVID-19 specimen collection or testing services to the public.

“Good faith” safeguards include disclosing the least possible protected health information, setting up barriers and controlling foot and car traffic to provide privacy at testing sites, and using secure technology. Covered entities and business associates that handle protected health information outside a community-based setting could still incur fines—for example, if they do so inside a pharmacy even if there is a testing site in the parking lot.

The notification is an additional HIPAA flexibility. OCR previously announced that it will exercise discretion around services delivered by Zoom, FaceTime, and other apps; and said it would empower first responders to share protected health information if doing so would protect themselves, other first responders, or the public. On April 7, HHS said it would not impose penalties on business associates of covered entities that share protected health information to carry out COVID-19 public health activities.