Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to improve portability and continuity of health insurance coverage. The HIPAA Privacy Rule, issued by HHS to implement section 264 of HIPAA (42 U.S.C. § 1320d-2), regulates the use and disclosure of protected health information. On September 4, 2005, Health and Human Services Secretary Leavitt declared a federal public health emergency for Louisiana, Alabama, Mississippi, Florida, and Texas. To allow health care providers in affected areas to care for patients without violating requirements of HIPAA, Medicare, Medicaid, and the State Children's Health Insurance Program, the HHS Secretary waived certain provisions. Specifically with respect to the HIPAA Privacy Rule, the Secretary waived the imposition of sanctions and penalties arising from noncompliance with the following provisions: (1) requirements to obtain a patient's agreement to speak with family members or friends or to honor a patient's request to opt out of a facility directory (45 C.F.R.164.510); (2) the requirement to distribute a notice of privacy practices (45 C.F.R.164.520); and (3) the patient's right to request privacy restrictions or confidential communications (45 C.F.R.164.522). In the first Hurricane Katrina bulletin issued by HHS (HIPAA Privacy and Disclosures in Emergency Situations), the Department emphasized that the HIPAA Privacy Rule "allows patient information to be shared to assist in disaster relief efforts, and to assist patients in receiving the care they need." The bulletin states that under the rule, health care providers can share patient information to provide treatment and seek payment for health care services; to identify, locate, and notify family members, guardians, or anyone responsible for the individual's care of the individual's location, general condition, or death; with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, consistent with applicable law and the provider's standards of ethical conduct. In addition, health care facilities maintaining a patient directory can tell people who call or ask about individuals whether the individual is at the facility, their location in the facility, and general condition. On September 9, HHS issued Hurricane Katrina Bulletin #2. Because the medical and prescription records of many evacuees were lost or inaccessible, and because health plans and health care providers were working with other industry segments to gather and provide this information, Bulletin #2 provides guidance on how the HIPAA Privacy Rule applies to these activities and describes the HHS Office for Civil Rights' enforcement approach in light of these emergency circumstances. Bulletin #2 discusses the use and disclosure of prescription and medical information by entities managing information on behalf of covered entities ("business associates"). In general, business associates are permitted to make disclosures "to the extent permitted by their business associate agreements with the covered entities, as provided in the Privacy Rule." The bulletin provides that covered entities or their business associates may provide health information on evacuees to another party for that party to manage the health information and share it as needed for providing health care to the evacuees. Where a covered entity provides protected health information to another for this purpose, the Privacy Rule requires the covered entity to enter into a business associate agreement with this party. If the business associate, rather than the covered entity itself, is providing this information to another party that is acting as its agent, the covered entity's business associate must enter into an agreement to protect health information with this party. Sample business associate agreement provisions are attached to the bulletin. On the subject of enforcement, HHS noted that Section 1176(b) of the Social Security Act provides the agency may not impose a civil money penalty where the failure to comply is based on reasonable cause and is not due to willful neglect, and the failure to comply is cured within a 30-day period. HHS noted its authority to extend the period within which a covered entity may cure the noncompliance "based on the nature and extent of the failure to comply." HHS, in determining whether reasonable cause exists for a covered entity's failure to meet requirements and in determining the period within which noncompliance must be cured, announced that it "will consider the emergency circumstances arising from Hurricane Katrina, along with good faith efforts by covered entities, its business associates and their agents, both to protect the privacy of health information and to appropriately execute the agreements required by the Privacy Rule as soon as practicable." Shortly after Hurricane Katrina, the federal government began a pilot test of KatrinaHealth.org , an electronic health record (EHR) online system, sharing prescription drug information for most of the hurricane evacuees with health care professionals. The launch of KatrinaHealth.org was possible in part because of plans already made and actions taken by the Administration, the Congress, foundations, and the private sector to implement electronic health records (EHRs) as part of the national health information infrastructure. President Bush and the Departments of Health and Human Services, Defense, and Veterans Affairs (HHS) have focused on the importance of transforming health care delivery through the improved use of health information technology (HIT). Philanthropies such as California Health Care Foundation, Robert Wood Johnson, the Markle Foundation, and others have provided funding, leadership, and expertise to this effort. In the private sector, the medical and nursing informatics, and the medical and nursing professional societies, have also been involved. Electronic health records are controversial among many privacy advocates and citizens who are concerned about information security and the potential for the exploitation of personal medical information by hackers, companies, or the government, and the sharing of health information without the patients' knowledge. Privacy advocates, in general, support the development of an interoperable national health information network built on the concepts of patient control, privacy, and participation. The Department of Health and Human Services has formed agreements with two organizations to plan and promote the widespread use of electronic health records in the Gulf Coast region as it rebuilds. The agreements supplement recently announced contracts to certify electronic health records, develop interoperability standards, evaluate variations among privacy and security requirements across the country, and create prototypes for a nationwide health information network. The Southern Governors Association will form the Gulf Coast Health Information Task Force, which will bring together local and national resources to help area health-care providers convert to electronic medical records. The Louisiana Department of Health and Hospitals will develop a prototype of health information sharing and electronic health record support that can be replicated in the region. The effort will not be connected with http://katrinahealth.org/ , which is not expected to be a long-term undertaking. On September 22, 2005, KatrinaHealth.org [ http://www.katrinahealth.org ], a secure online service, was launched to enable authorized healthcare providers to electronically access medication and dosage information for evacuees from Hurricane Katrina to renew prescriptions, prescribe new medications, and coordinate care. The website KatrinaHealth.org was available for a 90-day period. KatrinaHealth.org was a completely new, secure online service created in three weeks to help deliver quality care and avoid medical errors. The data contain records from 150 zip codes in areas hit by Katrina. At its launch, prescription drug records on over 800,000 people from the region could be searched by health care professionals. The information was compiled and made accessible by private companies, public agencies, and national organizations, including medical software companies; pharmacy benefit managers; chain pharmacies; local, state, and federal agencies; and a national foundation. The effort to create KatrinaHealth.org was facilitated by the Office of the National Coordinator for Health Information, Department of Health and Human Services. With the assistance of federal, state, and local governments, KatrinaHealth.org was operated by private organizations, such as the Markle Foundation. Under ordinary circumstances, HIPAA privacy rules would require formal, written "business associate agreements" among KatrinaHealth.org participants before they could exchange medical information. Reportedly, many of the participants had such agreements or were able to obtain them rapidly. In addition, HHS's second bulletin clarified that considering the emergency circumstances, organizations that did not comply with the business associate requirements would not be penalized as long as they showed good faith efforts to protect the privacy of health information and to appropriately execute the agreements required by the Privacy Rule as soon as practicable. The data or prescription information for KatrinaHealth.org was obtained from a variety of government and commercial sources. Sources include more than 150 private and public organizations' electronic databases from commercial pharmacies, government health insurance programs such as Medicaid, and private insurers such as Blue Cross and Blue Shield Association of America, and pharmacy benefits managers in the states affected by the storm. Key data and resources were contributed by the American Medical Association (AMA), Gold Standard, the Markle Foundation, RxHub and SureScripts. Data contributors also include the Medicaid programs of Louisiana and Mississippi; chain pharmacies (Albertsons, CVS, Kmart, Rite Aid, Target, Walgreens, Wal-Mart, Winn Dixie); and Pharmacy Benefit Managers (RxHub, Caremark, Express Scripts, Medco Health Solutions)). Federal agencies involved include the U.S. Departments of Commerce, Defense, Health and Human Services, Homeland Security, and Veterans Affairs. The information in KatrinaHealth.org did not exist in a central database, rather access was provided to a mix of data sets. Some of the information from chain pharmacies was aggregated while other available information was not. Licensed doctors and pharmacists, anywhere in the United States, treating evacuees from Louisiana, Mississippi, and Alabama, were eligible to use KatrinaHealth. Patients were not permitted access to the prescription information at the online site.