Under which type of disaster can HIPAA privacy rule be waived?

In the wake of the Las Vegas Massacre, you may expect that the department of Health and Human Service (HHS) would waive Health Insurance Portability and Accountability Act (HIPAA) privacy rule requirements like they did during the hurricanes. Not so much this time.

Primarily because this is a “man-made” disaster. Why the distinction? Because the HIPAA privacy rule already allows information disclosure in certain cases, such as when public safety is threatened; because there has been no declaration of a public health emergency, HIPAA waivers have not been necessary in this case.

What about law enforcement? Do keep in mind that disclosures to law enforcement during ongoing investigations are permitted but only under some narrowly defined circumstances. Be sure to be hyper vigilant when disclosing protected patient information (PHI), because HIPAA privacy notices are still required, as is the due care in responding to requests for patient information from family, friends, and media, etc.

For more information on HIPAA privacy waivers, contact Linda at 781-272-8001.