- Authorizations (30)
                              - Business Associates (41)
                              - Compliance Dates (2)
                              - Covered Entities (14)
                              - Decedents (9)
                              - Disclosures for Law Enforcement Purposes (5)
                              - Disclosures for Rule Enforcement (1)
                              - Disclosures in Emergency Situations (2)
                              - Disclosures Required by Law (6)
                              - Disclosures to Family and Friends (28)
                              - Disposal of Protected Health Information (6)
                              - Facility Directories (7)
                              - Family Medical History Information (3)
                              - FERPA and HIPAA (10)
                              - Group Health Plans (3)
                              - Incidental Uses and Disclosures (10)
                              - Judicial and Administrative Proceedings (8)
                              - Minimum Necessary (14)
                              - Notice of Privacy Practice (20)
                              - Preemption of State Law (10)
                              - Privacy Rule: General Topics (12)
                              - Protected Health Information (2)
                              - Public Health Uses and Disclosures (13)
                              - Research Uses and Disclosures (20)
                              - Right to an Accounting of Disclosures (8)
                              - Right to File a Complaint (1)
                              - Right to Request a Restriction (4)
                              - Safeguards (13)
                              - Security Rule (24)
                              - Smaller Providers and Businesses (145)
                              - Student Immunizations (8)
                              - Transition Provisions (3)
                              - Treatment, Payment, and Health Care Operations Disclosures (30)
                              - Workers Compensation Disclosures (5)
                              - Limited Data Set (6)
                              - Marketing (17)
                              - Marketing - Refill Reminders (16)
                              - Personal Representatives and Minors (12)
                              - Right to Access and Research (58)
                              - Mental Health (35)
                              - Health Information Technology (41)
                              - Telehealth (11)

                      -   
                      -   
                      -   
                      -   
                      -   

# Is the HIPAA Privacy Rule suspended during a national or public health emergency? 

## Answer:

No; however, the Secretary of HHS may waive certain provisions of the Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.

### What provisions may be waived

If the President declares an emergency or disaster *and* the Secretary declares a public health emergency, the Secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the HIPAA Privacy Rule:
                    - the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care (45 CFR 164.510(b))
                    - the requirement to honor a request to opt out of the facility directory (45 CFR 164.510(a))
                    - the requirement to distribute a notice of privacy practices (45 CFR 164.520)
                    - the patient's right to request privacy restrictions (45 CFR 164.522(a))
                    - the patient's right to request confidential communications (45 CFR 164.522(b))

**When and to what entities does the waiver apply**

If the Secretary issues such a waiver, it only applies:
                    - In the emergency area and for the emergency period identified in the public health emergency declaration.
                    - To hospitals that have instituted a disaster protocol.  The waiver would apply to all patients at such hospitals.
                    - For up to 72 hours from the time the hospital implements its disaster protocol.

When the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol.  

Regardless of the activation of an emergency waiver, the HIPAA Privacy Rule permits disclosures for treatment purposes and certain disclosures to disaster relief organizations. For instance, the Privacy Rule allows covered entities to share patient information with the American Red Cross so it can notify family members of the patient’s location.  See 45 CFR 164.510(b)(4). 

**Learn More:**
                    - See the  Hurricane Katrina Bulletin: HIPAA Privacy and Disclosures in Emergency Situations  for more about sharing information in emergency situations.

Content last reviewed December 28, 2022