{"id":"AGY-FED-HEALTH-OTHER-002","kind":"order","level":"federal","jurisdiction":"United States (federal); Department of Health and Human Services, Office for Civil Rights","state":"","metro":"","industry":"","agency":"FED-HEALTH-OTHER","eco":"","issuer":"Roger T. Severino, Director, Office for Civil Rights, HHS","authority":"HIPAA Privacy Rule, 45 C.F.R. 164.502(a)(3), 164.502(e)(2), 164.504(e)(1) and (5); enforcement discretion","instrument":"Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19, 85 Fed. Reg. 19392 (Apr. 7, 2020)","title":"Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19","dateIssued":"2020-04-02","effective":"2020-04-02 (effective immediately; published Apr. 7, 2020)","end":"2023-05-11 (88 Fed. Reg. 22380)","startDate":"2020-04-02","endDate":"2023-05-11","quarters":["2020Q2","2020Q3","2020Q4","2021Q1","2021Q2","2021Q3"],"types":["HC","OTHER"],"addressees":["business associates","covered entities"],"clause":"To facilitate uses and disclosures for public health and health oversight activities during this nationwide public health emergency, effective immediately, OCR will exercise its enforcement discretion and will not impose penalties against a business associate or covered entity under the Privacy Rule provisions 45 CFR 164.502(a)(3), 45 CFR 164.502(e)(2), 45 CFR 164.504(e)(1) and (5), if, and only if, the business associate makes a good faith use or disclosure of the covered entity\u0027s PHI for public health activities consistent with 45 CFR 164.512(b), or health oversight activities consistent with 45 CFR 164.512(d).","enforcement":"HIPAA civil money penalties suspended for the described conduct","functions":["OF administration and data reporting","DX diagnostics and laboratory reporting","CB patients and payers"],"notes":"Reached every billing company, EHR vendor, laboratory and analytics contractor that reported COVID-19 data to CDC, CMS and State health departments.","sourceUrl":"https://www.govinfo.gov/content/pkg/FR-2020-04-07/pdf/2020-07268.pdf","snapshot":"","fileExists":true,"fileBytes":225111,"grade":"primary","character":"","description":"","collection":"AGY-FED-HEALTH-OTHER","url":"/library/AGY-FED-HEALTH-OTHER-002","exhibitUrl":"/exhibit/AGY-FED-HEALTH-OTHER-002","citation":"Roger T. Severino, Director, Office for Civil Rights, HHS, Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19, 85 Fed. Reg. 19392 (Apr. 7, 2020) (Apr. 2, 2020) (Ex. AGY-FED-HEALTH-OTHER-002)","stateName":"","related":["AGY-FED-HEALTH-OTHER-003","AGY-FED-HEALTH-OTHER-001"]}