HIPAA Waiver issued for Good Faith Operation of COVID-19 Community-Based Testing Centers

The HHS has released a Notice of Enforcement Discretion covering healthcare suppliers and business associates that participate in the operation of COVID-19 community-based testing centers.

Under the terms of the Notice of Enforcement discretion, the HHS will not apply penalties in connection with good faith participation in the operation of COVID-19 community-based testing centers. The Notice of Enforcement discretion is retroactive to March 13, 2020 and will remain in place for the duration of the COVID-19 public health emergency or until the Secretary of the HHS declares the public health emergency ended.

The aim of the notification is to help pharmacies, other healthcare suppliers, and their business associates to provide COVID-19 testing services and specimen collection at dedicated walk-up or drive through sites, without risking picking up a financial penalty for noncompliance with HIPAA Rules.

While the Notice of Enforcement Discretion has been released, the HHS’ Office for Civil Rights is encouraging covered groups and their business associates to ensure reasonable safeguards are implemented to safeguard the privacy of users of the service and stop the accidental exposure or disclosure of PHI to unauthorized individuals.

Privacy controls including canopies and barriers should be used to separate the testing area to protect the privacy of users of the service and there should be a buffer zone to stop members of the public from observing individuals being tested.

Social distancing processes need to be implemented to reduce the danger of transmission of SARS-CoV-2. A distance of at least 6 feet should be maintained between patients. These social distancing will help to ensure conversations between a patient and CBTS staff cannot be listened to. OCR also recommends posting signs prohibiting filming at testing centers.

A Notice of Privacy Practices should also be placed in a place where it can be easily read by visitors. The NPP should also be made available online, with information included in the printed notice outlining how the NPP can be viewed online.

Uses and sharing of PHI should be kept to the minimum necessary amount to achieve the aim for which the information is disclosed, other than when disclosing PHI for treatment reasons.

The Notice of Enforcement Discretion on this link is available here.