By Dannae Delano
U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) issued the following four pieces of guidance announcing enforcement discretion during the COVID-19 pandemic:
- March 13, 2020 – Enforcement Discretion Regarding COVID-19 Community-Based Testing Sites During the COVID-19 Nationwide Public Health Emergency
- March 17, 2020 – Enforcement Discretion for Telehealth Remote Communications During the COVID–19 Nationwide Public Health Emergency
- April 9, 2020 – Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19
- January 19, 2021 – Enforcement Discretion Regarding Online or Web-Based Scheduling Applications for the Scheduling of Individual Appointments for COVID-19 Vaccination During the COVID-19 Nationwide Public Health Emergency
On April 11, 2023, President Biden signed legislation ending the nationwide COVID-19 public health emergency (PHE) May 11, 2023. OCR has now announced its plan to end the HIPAA enforcement discretion described above, also on May 11, 2023. For the Telehealth Remote Communications guidance issued on March 17, 2020, however, OCR has established a 90-day transition period that will end on August 9, 2023. During this transition period, OCR will continue to exercise its enforcement discretion and will not impose penalties on healthcare providers for noncompliance with HIPAA that occurs in connection with the good faith provision of telehealth. The 90-day transition period ONLY applies to the Telehealth Remote Communications compliance.
Consequently, full enforcement of HIPAA will resume on May 12, 2023, and covered entities continuing to utilize Telehealth Remote Communications will have until August 10, 2023, to resume full HIPAA compliance. Covered entities, including group health plans, and their business associates should immediately review how their processes may have changed during the pandemic as a result of relying on OCR’s enforcement discretion, and should cease or replace any practices that fail to comply with HIPAA.