As Hurricane Florence inaugurates the U.S. hurricane season with fierce winds and torrential rains, health care providers are preparing to care for patients under demanding and dangerous conditions. Effective communication is always challenging and critically important when natural disasters like hurricanes strike.
The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule (the “Privacy Rule”) permits the use and disclosure of protected health information (“PHI”) during disasters such as Hurricane Florence to assist in emergency relief efforts and to ensure that patients receive the care that they need. On September 11, 2018, Health and Human Services (“HHS“) Secretary Alex Azar declared a Public Health Emergency that waives sanctions and penalties under certain provisions of HIPAA to facilitate health care-related communications in the areas affected by Hurricane Florence (“Emergency Waiver”).[1] In addition, on September 13, 2018, the HHS Office for Civil Rights (“OCR”) issued Guidance to assist Covered Entities and Business Associates to facilitate appropriate communications with at-risk populations and to promote equal access to emergency services.[2]
Privacy Rule Background
Even absent an emergency waiver, the Privacy Rule permits PHI to be shared:
- For treatment purposes;
- For public health purposes to:
- Centers for Disease Control and Prevention;
- State, local, territorial and tribal public health agencies;
- Foreign government agencies working with public health agencies, at the direction of a public health agency; and
- Individuals at risk of contracting or spreading a disease or condition, if contact notification is supported by law.
- With family, friends and others involved in the individual’s care;
- As necessary to identify, locate and notify family, guardians or others responsible for the patient’s care about the patient’s location, general condition and death;
- If necessary, notification can be extended to the police, the press and the public;
- With disaster relief organizations that are authorized by law or their charter to assist in disaster relief activities, for purposes of coordinating notification of family members and others involved in the patient’s care such as the American Red Cross;
- As necessary to prevent a serious and imminent threat to health or safety of a person or the public; and
- If a request is made by name, limited directory information about a specific patient may be released.
The Emergency Waiver
The Emergency Waiver supports covered hospitals providing care to patients and families in distress by temporarily removing the threat of penalties and sanctions under HIPAA.
The Emergency Waiver applies:
- To hospitals, associated physicians, other health care practitioners or professionals, health care facilities and/or suppliers of health care items or services located in the area covered by the public health emergency declaration;
- During the period of the public health declaration;
- To hospitals that have instituted their emergency response plan/disaster protocol; and
- For up to 72 hours after the time the emergency response plan/disaster protocol was first implemented.
Covered hospitals should document the time and date that the emergency response plan/disaster protocol is triggered to ensure that the 72-hour timeline can be ascertained.
The Emergency Waiver waives sanctions and penalties against a covered hospital if the hospital does not:
- Obtain the patient’s consent before speaking to family members and friends involved in the patient’s care;
- Comply with requirements related to a patient’s ability to “opt out” of the facility directory;
- Distribute a Notice of Privacy Practices;
- Comply with requests for privacy restrictions; or
- Comply with requests for confidential communications.
OCR Guidance
To facilitate effective care delivery during Hurricane Florence, OCR recommended that emergency response personnel and officials consider implementing the following practices:
- Employing qualified interpreter services to assist deaf or hearing-impaired individuals and those with limited English proficiency during evacuation, response and recovery activities;
- Making emergency messaging available in languages prevalent in the affected area(s) and in multiple formats, such as audio, large print and captioning and ensuring that websites providing disaster-related information are accessible;
- Making use of multiple outlets and resources for messaging to reach individuals with disabilities, individuals with limited English proficiency and members of diverse faith communities;
- Considering the needs of individuals with mobility impairments and individuals with assistive devices or durable medical equipment in providing transportation for evacuation;
- Identifying and publicizing shelters that have accessible features, such as bathing, toileting, eating facilities and bedding;
- Avoiding separation of individuals from sources of support, such as service animals, durable medical equipment, caregivers, medication and supplies; and
- Stocking shelters with items that will help people to maintain independence, such as hearing aid batteries, canes and walkers.
Conclusion
Both the HHS and OCR guidance aim to ensure that all persons benefit from emergency response efforts during Hurricane Florence and that such disaster management efforts are optimized.
This article is educational in nature and is not intended as legal advice. Always consult your legal counsel with specific legal matters. If you have any questions or would like additional information about this topic, please contact:
- Melissa Markey at (248) 740-7505 or mmarkey@wp.hallrender.com;
- Adele Merenstein at (317) 752-4427 or amerenstein@wp.hallrender.com;
- Amy Poe at (919) 228-2404 or apoe@wp.hallrender.com;
- Stephen Rose at (425) 278-9337 or srose@wp.hallrender.com; or
- Your regular Hall Render attorney.
Special thanks to Kerry Dutra, law clerk, for her assistance with this this article.
©Copyright 2018, American Health Law Association, Washington, DC. Reprint permission granted.
[1] Waiver or Modification of Requirements Under Section 1135 of the Social Security Act, available at: https://www.phe.gov/emergency/news/healthactions/section1135/Pages/florence-11Sept18.aspx. The Emergency Waiver also applies to other requirements of the Social Security Act and implementing regulations such as those provisions related to the Medicare Conditions of Participation, EMTALA, health care professional licensure and limitations on physician referral (i.e., Stark). Please refer to the Emergency Waiver for further detail.
[2] OCR Issues Guidance to Help Ensure Equal Access to Emergency Services and the Appropriate Sharing of Medical Information During Hurricane Florence, available at: https://www.hhs.gov/about/news/2018/09/13/ocr-issues-guidance-to-help-ensure-equal-access-to-emergency-services-medical-information-during-hurricane-florence.html.
