The Department of Health and Human Services (“HHS”) recently released a notification of enforcement discretion regarding Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) requirements in connection with the operation of a COVID-19 Community-Based Testing Site (“CBTS”). The enforcement discretion became effective on April 9, 2020, with a retroactive effect to March 13, 2020, and will remain in effect until the Secretary of HHS declares that the public health emergency no longer exists.
Under the enforcement discretion, all HIPAA covered health care providers and their business associates will be exempt from regulatory requirements when they, in good faith, operate a CBTS. This waiver, along with the April 30 waiver removing the requirement that any COVID-19 test for a Medicare beneficiary must be ordered by the treating physician or other practitioner, will greatly help practitioners have a more efficient response to the ongoing pandemic. The federal government is taking significant actions to ensure that patients receive all necessary care in a timely manner without being slowed down by unnecessary regulatory hurdles.
An important aspect that practitioners and entities must keep in mind is that to claim a safe harbor under this waiver, the practitioner and business associates must continue to act in “good faith.” To demonstrate good faith, HHS recommends and encourages health care providers and business associates to implement reasonable safeguards at a CBTS. HHS has stated that the following actions should be taken at each CBTS to protect the privacy and security of individuals’ Protected Health Information (“PHI”):
- Use and disclose only the minimum PHI necessary except when disclosing PHI for treatment;
- Set up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples;
- Control foot and car traffic to create adequate distancing at the point of service to minimize the ability of persons to see or overhear screening interactions at a CBTS. (A six-foot distance would serve this purpose as well as supporting recommended social distancing measures to minimize the risk of spreading COVID-19);
- Establish a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS, and post signs prohibiting filming;
- Use secure technology at a CBTS to record and transmit electronic PHI;
- Post a Notice of Privacy Practices (NPP), or information about how to find the NPP online, if applicable, in a place that is readily viewable by individuals who approach a CBTS.
Practitioners, business associates, and other entities that may be involved in treating individuals with COVID-19 should be aware that this waiver is strictly limited to the operation of a CBTS. For example, the activities that occur inside a retail pharmacy that are unrelated to a CBTS that is set up in the pharmacy’s parking lot could be subject to HIPAA violations. Similarly, the activities inside a clinical laboratory could be subject to HIPAA violations despite some of the laboratory’s personnel assisting at a CBTS. These entities must fully comply with all HIPAA requirements, not subject to formal waiver, and will be subject to civil monetary penalties for any failure to do so.
Any questions regarding the operation of a CBTS or the application of the HHS waiver should Frost Brown Todd’s Insurance Regulation & Risk Management and Health Care Innovation Team. Please contact Matt R. Wagner, Bill Williams, or Chad Eckhardt for more information.