Full HIPAA Enforcement to Resume as the COVID-19 Public Health Emergency Ends

On April 11, 2023, U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced its plan for termination of the existing notifications of enforcement discretion related to the expiration of the COVID-19 public health emergency (PHE) on May 11, 2023. 

OCR previously issued four notifications of enforcement discretion throughout the PHE regarding:

1. Enforcement Discretion Regarding COVID-19 Community-Based Testing Sites During the COVID-19 Nationwide Public Health Emergency (March 13, 2020)
2. Enforcement Discretion for Telehealth Remote Communications During the COVID–19 Nationwide Public Health Emergency (March 17, 2020) (Telehealth Notification)
3. Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19 (April 7, 2020)
4. Enforcement Discretion Regarding Online or Web-Based Scheduling Applications for the Scheduling of Individual Appointments for COVID-19 Vaccination During the COVID-19 Nationwide Public Health Emergency (December 11, 2020)  

With the imminent expiration of the PHE looming, OCR announced that these four notifications of enforcement discretion will terminate on May 11, 2023. However, for the Telehealth Notification only OCR is affording a 90-day transition period through August 9, 2023. During this transition period, OCR will continue to exercise its enforcement discretion and will not impose penalties on health care providers for noncompliance with the HIPAA Rules that occurs in connection with the good faith provision of telehealth. 

Thus, enforcement of the HIPAA Rules will resume in full, related to the items in the notifications of enforcement discretion identified in 1, 3, and 4 above, as of May 12, 2023, and related to the Telehealth Notification, as of August 10, 2023. 

Covered entities and their business associates should take steps to review current policies, procedures and practices implicated by the termination of these notifications of enforcement discretion to identify, cease and replace any HIPAA non-compliant practices relying on PHE-related enforcement discretion. 

Epstein Becker Green will be closely following these developments. For additional information about the issues discussed above, or if you have any other questions or concerns regarding OCR enforcement, please contact the Epstein Becker Green attorney who regularly handles your legal matters, or one of the authors of this blog post. 

You can also learn more about how we can support your privacy and security compliance efforts here.