Earlier today, the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) published a Notice of Enforcement Discretion (Notice) for HIPAA COVID-19 Community-Based Testing Sites (CBTSs).  Specifically, OCR stated in the Notice that it will not impose penalties for non-compliance with the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules) against HIPAA covered health care providers and their business associate in the good faith operation of a CBTS (in other words, mobile, drive-through, or walk-up sites that provide only COVID-19 specimen collection or testing services to the public) during the national public health emergency. 

Importantly, the Notice does not apply to non-CBTS related activities of a HIPAA covered health care provider or business associate that may be providing the CBTS (like indoor retail pharmacy operations), and the Notice does not apply at all to health plans or health care clearinghouses.  However, this Notice should provide at least a bit of HIPAA-related compliance relief to HIPAA covered entities and business associate that operate CBTSs.

Nonetheless, the Notice still encourages compliance with the HIPAA Rules, including the implementation of reasonable safeguards to protect the privacy and security of individuals' protected health information (PHI), and, to the extent feasible, HIPAA covered health care providers should consider implementing such safeguards to avoid potential consumer complaints and as a reflection of the  "good faith operation" of the CBTSs. 

Such safeguards would include administrative, physical, and technical safeguards, as required by the HIPAA Rules, and the Notice enumerates the following as examples of what would be "reasonable safeguards" for CBTSs:

  • Using and disclosing only the minimum PHI necessary except when disclosing PHI for treatment.
  • Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples.
  • Controlling foot and car traffic to create adequate distancing at the point of service to minimize the ability of persons to see or overhear screening interactions at a CBTS. (A six foot distance would serve this purpose as well as supporting recommended social distancing measures to minimize the risk of spreading COVID-19.)
  • Establishing a "buffer zone" to prevent members of the media or public from observing or filming individuals who approach a CBTS, and posting signs prohibiting filming.
  • Using secure technology at a CBTS to record and transmit electronic PHI.
  • Posting a Notice of Privacy Practices (NPP), or information about how to find the NPP online, if applicable, in a place that is readily viewable by individuals who approach a CBTS.

The Notice has a retroactive date of March 13, 2020, and it will remain in effect until the earlier of the Secretary of HHS declaring that the public health emergency no longer exists or upon expiration of the declared public health emergency (including any extensions).   

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.