On April 9, the Office for Civil Rights of the Department of Health and Human Services (OCR) released a notice of enforcement discretion to covered health care providers and their business associates that, during the COVID-19 public health emergency, OCR will not impose penalties for noncompliance with the regulatory requirements under the HIPAA rules in connection with the good faith participation in the operation of a COVID-19 Community-Based Testing Site(s) (CBTS).

OCR defines CBTS as mobile, drive-through, or walk-up sites that only provide COVID-19 specimen collection or testing services to the public. OCR also clarifies that the relaxed standards only apply to the health care providers and their business associates engaged in the provision of such testing services and, to the extent an entity providing the COVID-19 testing is engaged in other non-testing related activities, all HIPAA requirements and standards remain in force. For example: a covered health care provider that experiences a breach of PHI in its existing electronic health record system, which includes PHI gathered from the operation of a CBTS, could be subject to a penalty for violations of the HIPAA Breach Notification Rule if it fails to notify all individuals affected by the breach (including individuals whose PHI was created or received from the operation of a CBTS).

This notice represents one of OCR’s most significant HIPAA enforcement relaxations since the start of the public health emergency declaration, applying enforcement discretion to all, not just selected, HIPAA regulatory requirements. While OCR is temporarily abstaining from penalizing covered entities and business associates providing these COVID-19 testing services, it still encourages covered health care providers to implement reasonable safeguards in order to minimize the risk of improper use or disclosure, including:

• Using secure technology at a CBTS to record and transmit electronic PHI.
• Establishing a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS and posting signs prohibiting filming.
• Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples

The full OCR announcement may be found here.