OCR will not enforce HIPAA rules at certain COVID-19 testing sites

The Department of Health and Human Services’ Office for Civil Rights yesterday said it generally will not impose penalties for HIPAA rule violations on health care provider covered entities and their business associates operating COVID-19 community-based testing sites in good faith for the duration of the current national public health emergency. Community-based sites include mobile, drive-through or walk-up sites that provide only COVID-19 specimen collection or testing services to the public. OCR still encourages participating providers to implement reasonable safeguards to protect the privacy and security of individuals’ protected health information at the testing sites. The decision is retroactive to March 13.