Skip to main content
U.S. flag

An official website of the United States government

Return to Search

OCR Announces Notification of Enforcement Discretion to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities During The COVID-19 Nationwide Public Health Emergency

This is an HHS Press Release announcing that OCR will exercise its enforcement discretion and will not impose penalties for violations of certain provisions of the HIPAA Privacy Rule against health care providers or their business associates for the good faith uses and disclosures of protected health information (PHI) by business associates for public health and health oversight activities during the COVID-19 nationwide public health emergency.

Final

Issued by: Office for Civil Rights (OCR)

Issue Date: April 02, 2020

FOR IMMEDIATE RELEASE
April 2, 2020

Contact: HHS Press Office
202-690-6343
media@hhs.gov

OCR Announces Notification of Enforcement Discretion to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities During The COVID-19 Nationwide Public Health Emergency

Today, the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) announced, effective immediately, that it will exercise its enforcement discretion and will not impose penalties for violations of certain provisions of the HIPAA Privacy Rule against health care providers or their business associates for the good faith uses and disclosures of protected health information (PHI) by business associates for public health and health oversight activities during the COVID-19 nationwide public health emergency.

This Notification was issued to support Federal public health authorities and health oversight agencies, like the Centers for Disease Control and Prevention (CDC) and Centers for Medicare and Medicaid Services (CMS), state and local health departments, and state emergency operations centers who need access to COVID-19 related data, including PHI. The HIPAA Privacy Rule already permits covered entities to provide this data, and today's announcement now permits business associates to also share this data without risk of a HIPAA penalty.

"The CDC, CMS, and state and local health departments need quick access to COVID-19 related health data to fight this pandemic," said Roger Severino, OCR Director. "Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives," Severino added.

This Notification of Enforcement Discretion may be found at: https://www.hhs.gov/sites/default/files/notification-enforcement-discretion-hipaa.pdf - PDF

OCR has a new webpage with all COVID-19 related materials issued by OCR at: https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html.

HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.