HIPAA Penalties Waived for Good Faith Operation of COVID-19 Community-Based Testing Sites
The HHS has issued a Notice of Enforcement Discretion covering healthcare providers and business associates that participate in the operation of COVID-19 community-based testing sites.
Under the terms of the Notice of Enforcement discretion, the HHS will not impose sanctions and penalties in connection with good faith participation in the operation of COVID-19 community-based testing sites. The Notice of Enforcement discretion is retroactive to March 13, 2020, and will continue for the duration of the COVID-19 public health emergency or until the Secretary of the HHS declares the public health emergency is over.
The purpose of the notification is to help pharmacies, other healthcare providers, and their business associates to provide COVID-19 testing services and specimen collection at dedicated walk-up or drive-through facilities, without risking a financial penalty for noncompliance with HIPAA Rules.
While the Notice of Enforcement Discretion has been issued, the HHS’ Office for Civil Rights is encouraging covered entities and their business associates to ensure reasonable safeguards are implemented to protect the privacy of users of the service and prevent the accidental exposure or disclosure of PHI to unauthorized individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Privacy controls such as canopies and barriers should be used to separate the testing area to protect the privacy of users of the service and there should be a buffer zone to prevent members of the public from observing individuals being tested.
Social distancing measures need to be implemented to reduce the risk of transmission of SARS-CoV-2. A distance of at least 6 feet should be maintained between patients. Social distancing will help to ensure conversations between a patient and CBTS staff cannot be overheard. OCR also recommends posting signs prohibiting filming at testing facilities.
A Notice of Privacy Practices should also be posted in a place where it can be easily read by visitors. The NPP should also be published online, with information included in the printed notice explaining how the NPP can be viewed online.
Uses and disclosures of PHI should be limited to the minimum necessary amount to achieve the purpose for which the information is disclosed, other than when disclosing PHI for treatment purposes.
You can view the Notice of Enforcement Discretion on this link.
The COVID-19 Public Health Emergency has been extended on multiple occasions, however, no further extensions will be announced. The Notice of Enforcement Discretion will end on May 11, 2023, at 11:59 pm.
