Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19, 85 Fed. Reg. 19392 (Apr. 7, 2020)

The record

Jurisdiction

United States (federal); Department of Health and Human Services, Office for Civil Rights

Level

Federal

Authority

HIPAA Privacy Rule, 45 C.F.R. 164.502(a)(3), 164.502(e)(2), 164.504(e)(1) and (5); enforcement discretion

Issued

2020-04-02 Apr. 2, 2020

Effective

2020-04-02 (effective immediately; published Apr. 7, 2020) (read as 2020-04-02)

End

2023-05-11 (88 Fed. Reg. 22380) (read as 2023-05-11)

In force

Apr. 2, 2020 to May 11, 2023

Quarters

2020 Q22020 Q32020 Q42021 Q12021 Q22021 Q3

2020 Q22020 Q32020 Q42021 Q12021 Q22021 Q3

Limitation types

Health care ordersOther

Addressees

• business associates
• covered entities

Functions reached

• OF administration and data reporting
• DX diagnostics and laboratory reporting
• CB patients and payers

Collection

Other federal health agencies AGY-FED-HEALTH-OTHER

Operative words

To facilitate uses and disclosures for public health and health oversight activities during this nationwide public health emergency, effective immediately, OCR will exercise its enforcement discretion and will not impose penalties against a business associate or covered entity under the Privacy Rule provisions 45 CFR 164.502(a)(3), 45 CFR 164.502(e)(2), 45 CFR 164.504(e)(1) and (5), if, and only if, the business associate makes a good faith use or disclosure of the covered entity's PHI for public health activities consistent with 45 CFR 164.512(b), or health oversight activities consistent with 45 CFR 164.512(d).

Enforcement

Notes