The Office for Civil Rights (OCR) has relaxed HIPAA privacy rules for health care providers engaging in telehealth activities during the COVID-19 public health emergency. To provide greater clarity to the Notification of Enforcement Discretion regarding COVID-19 released on March 17, 2020, the OCR has released FAQs available here.

As OCR Director Roger Severino recently stated, “We are empowering medical providers to serve patients wherever they are during this national public health emergency. We are especially concerned about reaching those most at risk, including older persons and persons with disabilities.”

Among other helpful information, the FAQ document:

  • defines telehealth
  • outlines which entities are covered by the notification and which are not
  • clarifies that the notification applies only to HIPAA rules
  • states that the notification does not have a set expiration date but will expire when OCR makes a public announcement of its expiration
  • lists actions that may constitute “bad faith” in the provision of telehealth by a covered entity provider
  • describes what is meant by a “non-public facing” remote communication product
  • states that OCR will not impose a penalty for breaches that result from the good faith provision of telehealth services during the COVID-19 emergency.

If you have questions, please contact one of the attorneys in our Health Care industry group.

Link to COVID-19 Resources page