HIPAA enforcement discretion to end with COVID-19 public health emergency

HIPAA enforcement discretion implemented for the COVID-19 public health emergency will expire with the end of the PHE on May 11, but covered health care providers will have until Aug. 9 to comply with the HIPAA rules with respect to telehealth, the Department of Health and Human Services’ Office for Civil Rights announced today. 

“OCR is continuing to support the use of telehealth after the public health emergency by providing a transition period for health care providers to make any changes to their operations that are needed to provide telehealth in a private and secure manner in compliance with the HIPAA Rules,” explained OCR Director Melanie Fontes Rainer.

OCR in 2020 implemented enforcement discretion policies under HIPAA and the Health Information Technology for Economic and Clinical Health Act for community-based testing sites; telehealth remote communications; use and disclosure of protected health information by business associates; and online scheduling for COVID-19 vaccination.