In emergency situations like the Ebola crisis that reached American soil this fall, do covered entities need to comply with the HIPAA Privacy Rule? New guidance put out by the Department of Health and Human Services sheds light on how exactly organizations are expected to adhere. 

 

Be sure of one thing: The privacy rule still applies, but HHS has outlined several exceptions related to public health emergencies that allow in some cases a little more flexibility around information sharing.  

 

[See also: Ready or not: HIPAA gets tougher today.]

 

The Office for Civil Rights, the HHS division responsible for enforcing HIPAA, offered its guidance Monday for covered entities and business associates who may find themselves in public health emergency situations. 

 

Calling the privacy rule "balanced," OCR officials pointed out that "the protections of the privacy rule are not set aside during an emergency," but that its purpose was also to "ensure that appropriate uses and disclosures of the information still may be made when necessary to treat a patient, to protect the nation's public health and for other critical purposes."

 

Among the big takeaways? Public health safety and personal safety trumps medical privacy when it comes to cases of immediate danger, OCR guidance said. "Healthcare providers may share patient information with anyone as necessary to prevent or lessen a serious and imminent threat."

 

[See also: OCR director talks HIPAA survival.]

 

OCR also pointed out that HHS may waive certain HIPAA privacy rule provisions, both sanctions and penalties, for the covered hospital. These waivers would take effect if first the President were to declare an emergency and HHS Secretary Sylvia Mathews Burwell subsequently declared a public health emergency. 

 

The following waivers include: 

 

Under the privacy rule, covered entities and business associates may share protected health information without a patient's consent in certain instances, including to public health authorities, such like the Centers for Disease Control and Prevention; to a foreign government agency at the request of a public health authority; and to people considered at risk of contracting the related health condition or disease. 

 

Covered entities may also share a patient's protected health information without prior consent "as necessary to treat the patient or to treat a different patient," OCR said.