Today's HIPAA blog comes from guest blogger Maggie Hales. Maggie Hales is a lawyer and CEO of ET&C Group LLC which helps untangle the laws of HIPAA for the healthcare industry. She graduated from Webster University with Honors, and St. Louis University School of Law.
Is HIPAA Suspended During a Hurricane?
The short answer is “no.” But the full answer is more mixed.
The U.S. Department of Health and Human Services (HHS) learned lessons during Hurricane Katrina (2005), Hurricane Sandy (2012) and the Ebola crisis (2014-16) that have guided its policies around exceptions to the Privacy Rule during disasters.
HHS BULLETINS PROVIDE GUIDANCE
Hurricane Harvey's destruction may surpass that of Katrina and Sandy, and HHS has just today issued a Bulletin outlining its policy on waivers for hospitals in Texas and Louisiana. HHS issued Bulletins during other emergencies, including two in 2005 resulting from Hurricane Katrina, one in 2013 related to law enforcement, and one in 2014 related to privacy in emergency situations. All of these Bulletins and additional guidance may be found here HHS Bulletins and Guidance
During a public health emergency or disaster, there are exceptions to HIPAA that permit covered entities like hospitals to share protected health information with other providers, public health authorities and certain other designated parties. On the other hand, even during a disaster, the majority of HIPAA requirements will remain in effect so covered entities must remember they are responsible for fulfilling HIPAA obligations even in the midst of a disaster.
NO EXCUSE FOR SOCIAL MEDIA PHOTOS POSTED BY COVERED ENTITIES
In the last several days, pictures of nursing home residents and patients in Texas have been posted on Facebook and other social media by health care providers. Whether an appeal for help, or for publicity, even if well intentioned, these are blatant violations of patient privacy and are unjustified by the emergency.