On April 9, 2020, U.S. Department of Health and Human Services (“HHS”) issued a Notification of Enforcement Discretion (the “Notification”) regarding certain covered entities and business associates who choose to participate in the operation of a Community-Based Testing Site (“CBTS”) during the COVID-19 nationwide public health emergency. The Notification relaxes HHS’s enforcement of certain provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). More specifically, HHS will not impose penalties against covered health care providers and their business associates for violations of the HIPAA Privacy, Security, and Breach Notification Rules related to the “good faith participation” in a CBTS. The Notification is effective immediately but applies retroactively to March 13, 2020.

For the purpose of the Notification, a CBTS includes “mobile, drive-through, or walk-up testing sites that only provide COVID-19 specimen collection or testing services to the public.” Operation of a CBTS encompasses “all activities that support the collection of specimens from individuals for COVID-19 testing.”

Under the Notification, HHS’s enforcement discretion will apply only to covered health care providers and their business associates regarding activities connected to the operation of a CBTS. The Notification does not apply to non-CBTS activities performed by covered health care providers or their business associates. As such, there is still potential HIPAA liability for all other HIPAA-covered actions, unless otherwise determined by HHS. In addition, the Notification does not apply to health plans and health care clearinghouses when they are conducting health plan and clearinghouse operations. If a covered entity acts as both a health plan and health care provider, the Notification will apply only when the entity is acting in its role as a health care provider, and then only to the extent that it is participating in a CBTS.

Although covered health care providers and their business associates will not face penalties for HIPAA violations connected to the good faith operation of a CBTS, HHS still encourages them to implement reasonable safeguards for the privacy and security of individuals’ protected health information (“PHI”). According to the Notification, reasonable safeguards include:

  • Using and disclosing only the minimum PHI necessary except when disclosing PHI for treatment;
  • Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples;
  • Controlling foot and car traffic to create adequate distancing at the point of services to minimize the ability of persons to see or overhear screening interactions at a CBTS — a six foot distance would service this purpose as well as supporting recommended social distancing measures to minimize the risk of spreading COVID-19;
  • Establishing a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS, and posting signs prohibiting filming;
  • Using secure technology at a CBTS to record and transmit electronic PHI;
  • Posting a Notice of Privacy Practices (“NPP”) or information about how to find the NPP online, if applicable, in a place that is readily viewable by individuals who approach a CBTS.
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience…

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and health information privacy. Ms. Kraus regularly advises clients on Medicare reimbursement matters, the Medicaid Drug Rebate program, health information privacy issues (including under HIPAA and the HITECH Act), and the challenges and opportunities presented by the Affordable Care Act.

Photo of Tara Carrier Tara Carrier

Tara Carrier advises clients on a variety of health care compliance matters, including fraud and abuse, health information privacy and compliance with HIPAA, promotion and advertising, market access, pricing and reimbursement activities, and other related areas. She routinely advises on regulatory compliance and…

Tara Carrier advises clients on a variety of health care compliance matters, including fraud and abuse, health information privacy and compliance with HIPAA, promotion and advertising, market access, pricing and reimbursement activities, and other related areas. She routinely advises on regulatory compliance and enforcement risk, commercial transactions, and administrative and legislative policy opportunities. Tara also has experience counseling clients on investigations and compliance matters, including implementing and operating under HHS OIG Corporate Integrity Agreements.