The COVID Project
The record
- Jurisdiction
- United States (federal); Department of Health and Human Services, Office for Civil Rights
- Level
- Federal
- Authority
- HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. parts 160 and 164; enforcement discretion
- Issued
- 2020-04-09 Apr. 9, 2020
- Effective
- 2020-04-09, with retroactive effect to 2020-03-13 (read as 2020-04-09)
- End
- 2023-05-11
- In force
- Apr. 9, 2020 to May 11, 2023
- Quarters
- 2020 Q22020 Q32020 Q42021 Q12021 Q22021 Q3
2020 Q22020 Q32020 Q42021 Q12021 Q22021 Q3
- Limitation types
- Health care ordersOther
- Addressees
- covered health care providers including large pharmacy chains
- business associates operating mobile, drive-through and walk-up testing sites
- Functions reached
- DX diagnostics (specimen collection)
- SF sales floor / parking lots converted to testing
- CB patients
- HR staffing of testing sites
- Collection
- Other federal health agencies AGY-FED-HEALTH-OTHER
Operative words
The notification of enforcement discretion was effective on April 9, 2020, and had a retroactive effect to March 13, 2020, and will remain in effect until the Secretary of HHS declares that the public health emergency no longer exists... Although covered health care providers and business associates are encouraged to implement these reasonable safeguards at a CBTS, OCR will not impose penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in connection with the good faith operation of a CBTS.
Enforcement
HIPAA civil money penalties suspended for good-faith CBTS operation; penalties continue for non-CBTS activities
Notes
Defines a CBTS as mobile, drive-through or walk-up sites that only provide COVID-19 specimen collection or testing; reaches pharmacy chains, urgent-care operators, laboratories and their staffing contractors.