HIPAA and Public Health Emergencies - Rules and Special Allowances During the COVID Pandemic

Why Should You Attend:

The COVID-19 Public Health Emergency has resulted in a number of shifts in technology and work practices that have necessitated the issuance of guidance and enforcement relaxations to make it possible to best serve public health needs while maintaining HIPAA compliance. In addition, HIPAA contains several provisions in its regulations for the consideration of events like public health emergencies and disasters. Between the guidance on the regulations and issuance of enforcement relaxation guidance, the allowances during a public health emergency for reasonable communications of patient information are robust but limited, and protecting patient privacy and information security to the extent reasonably possible is still a priority for HIPAA compliance, even during an emergency.

In order to facilitate the delivery of services and necessary communications during the emergency, the US Department of Health and Human Services has issued guidance relaxing some HIPAA requirements pertaining to teleconferencing tools and reiterating HIPAA allowances such as for communication with family and friends of patients, to protect emergency workers, and share information as necessary with authorities. But it is still necessary to observe the requirements for Privacy and Security of patient information. And any implementation of new technology, from telemedicine to working via remote access, must be accompanied by an evaluation of the risks and mitigation of security issues.

When it comes to public health emergencies, HIPAA includes several provisions that can help enable the necessary communication to best serve individuals and the public at large, through individual communications with family and friends, and through provision of necessary information for public health authorities to make necessary decisions to protect the populace. Despite these allowances, the COVID-19 emergency has highlighted several areas of compliance that needed reiteration or expansion to best serve the needs at hand.

HIPAA has always had allowances for reasonable communication with family and friends of patients, and that has been reiterated in guidance, to ensure that the appropriate communications with the families of patients in distress can be made. Sharing information with public health authorities has always been allowed, but business associates of HIPAA entities are limited by the Business Associate Agreements in what they can share, such that HHS issued an enforcement relation to allow HIPAA business associates to share information as appropriate with public health authorities even if not specified in the Business Associate Agreement.

Enforcement relaxation has also been allowed for services being provided in community-based testing sites, so that HIPAA does not prevent testing activity form taking place, so long as compliance is addressed to the extent reasonably possible under the circumstances. HHS has, however, reiterated requirements to not allow news organizations access to areas where patients are being treated unless Authorizations for all patients are gathered prior to providing access. Blurring out faces is not an acceptable way to avoid the Authorization requirements.

HHS has announced the relaxation of enforcement pertaining to the use of teleconferencing technologies to provide remote medical services, allowing the use of such services to expand quickly, but limits on "public-facing" conferencing technologies remain. Providers need to adopt the necessary technologies without fear of HIPAA violation enforcement actions during the COVID-19 Emergency and must understand the limits of what is permitted in order to best serve patients and their families.

During the COVID-19 health emergency, business-grade teleconferencing technologies have stepped in to fill the gap in Telemedicine services. HHS has recognized that such services, even while not necessarily meeting the letter of HIPAA regulations, can be used in a secure and reasonable way during the emergency, and has provided guidance to that effect. Commonly-used applications like FaceTime, Skype, and Zoom, that are not public-facing in their operation, may be used, but public-facing apps such as FaceTime Live or a chat room in Slack are not appropriate. This session will explain the difference between public- and non-public-facing services, what should be done in using the permitted services, and what must be done once the emergency is over and the relaxation of enforcement ends.

This session will discuss the issues surrounding the use of various communication technologies under HIPAA controls, and the recent guidance and declarations from HHS about HIPAA and the response to COVID-19.

Areas Covered in the Webinar:

• HIPAA and Communications with Family and Friends
• HIPAA and Sharing Information with Public Health Authorities
• HIPAA and Emergencies
• HHS Guidance on HIPAA Compliance During the Public Health Emergency
• Relaxation of HIPAA Enforcement During the Public Health Emergency
• Using Teleconferencing in the Medical Practice
• Business Associate Requirements and Risk Analysis
• Making Remote Work and Telemedicine Routine and Secure

Who Will Benefit:

This webinar will provide valuable assistance to all personnel in:

Social Service Agencies, Medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, billing services, etc). The titles are

• Compliance director
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/lawyer
• Office Manager
• Contracts Manager

Jim Sheldon-Dean
Principal and Director of Compliance Services, Lewis Creek Systems, LLC

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities. He is a frequent speaker regarding HIPAA, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference. Sheldon-Dean has more than 19 years of experience specializing in HIPAA compliance, more than 37 years of experience in policy analysis and implementation, business process analysis, information systems and software development, and eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.

Follow us :