Healthcare Law Alert: OCR Reminds Providers of Non-Discrimination During COVID-19 Emergency and Temporary HIPAA Flexibility

The Department of Health & Human Services, Office for Civil Rights (OCR) is the federal agency charged with enforcing HIPAA as well as various discrimination laws, including the Americans with Disabilities Act, Section 504 of the Rehabilitation Act, the Age Discrimination Act, and Section 1557 of the Affordable Care Act which prohibits discrimination in HHS-funded health programs or activities.

Healthcare Provider Non-Discrimination Obligations

On March 28, 2020, the OCR issued a Bulletin on Civil Rights Laws and HIPAA Flexibility That Apply During the COVID-19 Emergency, which references a new OCR bulletin addressing non-discrimination in the provision of healthcare as well as recent bulletins addressing various HIPAA obligations. The OCR stated the Non-Discrimination Bulletin was issued “to ensure that entities covered by civil rights authorities keep in mind their obligations under laws and regulations that prohibit discrimination on the basis of race, color, national origin, disability, age, sex, and exercise of conscience and religion in HHS-funded programs, including in the provision of health care services during COVID-19.” This includes not unlawfully discriminating against people with disabilities when making decisions about their treatment during the COVID-19 global health emergency.

The OCR reminds healthcare providers:

Persons with disabilities should not be denied medical care on the basis of stereotypes, assessments of quality of life, or judgments about a person’s relative “worth” based on the presence or absence of disabilities or age. Decisions by covered entities concerning whether an individual is a candidate for treatment should be based on an individualized assessment of the patient and his or her circumstances, based on the best available objective medical evidence.

HIPAA Permitted Disclosures and Temporary HIPAA Flexibility

OCR recently published several bulletins to assist HIPAA-covered healthcare providers to understand their obligations under HIPAA and to inform such providers of the exercise of the OCR’s enforcement discretion relating to telehealth remote communications, as follows:

• February 2020 Bulletin: HIPAA Privacy and Novel Coronavirus – This bulletin provides healthcare providers with information concerning HIPAA’s requirements for sharing patient information for various purposes, including:
  • Treatment
  • Public health activities
  • Disclosures to prevent a serious and imminent threat
  • Disclosures to the media or others not involved in the care of the patient
  • HIPAA’s minimum necessary standard
  • Safeguarding patient information

We previously reported on this bulletin in our February Healthcare Law Update.

• Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency – In this bulletin, OCR advised HIPAA-covered healthcare providers that OCR will exercise its enforcement discretion and will not impose penalties for noncompliance with HIPAA in connection with the “good faith provision of telehealth” during the COVID-19 public health emergency. OCR provided further Q&A guidance in its follow-up bulletin, FAQs on Telehealth and HIPAA During the COVID-19 Nationwide Public Health Emergency. We reported on these bulletins in our recent healthcare law alerts which can be found in the Brach Eichler COVID-19 Resource Center.
• COVID-19 and HIPAA: Disclosures to Law Enforcement, Paramedics, Other First Responders and Public Health Authorities – This bulletin provides information to healthcare providers in disclosing information concerning COVID-19, including to public health authorities in order to prevent or control the spread of disease and in order to prevent or lessen a serious and imminent threat to the health and safety of a person or the public.

For additional information or assistance with your HIPAA compliance program, contact Lani M. Dornfeld at 973-403-3136 or ldornfeld@pagconcepts.com.