HHS issued a limited waiver of HIPAA sanctions and penalties during Hurricane Harvey, which HHS Secretary Tom Price, MD, declared a public health emergency in Texas Aug. 26 and Louisiana Aug. 28.

The HIPAA Privacy Rule cannot be suspended during emergencies. However, the HHS secretary may waive certain provisions to allow covered entities to share patient information to assist in disaster relief efforts and patient care.

“Often questions arise about the ability of entities covered by the HIPAA regulations to share information, including with friends and family, public health officials and emergency personnel,” the HHS bulletin reads.

Here are five provisions for which Dr. Price waived HIPAA sanctions and penalties.

1. The requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care

2. The requirement to honor a request to opt out of the facility directory

3. The requirement to distribute a notice of privacy practices

4. The patient’s right to request privacy restrictions

5. The patient’s right to request confidential communications

The waiver applies to areas in Texas and Louisiana through the emergency period defined by Dr. Price. The waiver applies for up to 72 hours after a hospital implements its disaster protocol. Once the public health emergency declaration terminates, a hospital must immediately resume complying with HIPAA provisions for patients still under its care.

Click here to view the full bulletin.