OCR announces enforcement discretion for community-based testing during COVID-19 pandemic

The Office for Civil Rights (OCR) announced on April 9 that it will not impose penalties for violations of HIPAA rules in connection with the operation of novel coronavirus (COVID-19) testing sites during the public health emergency.

The enforcement discretion applies to covered entities and business associates, so long as the parties exhibit “good faith participation” in the operation of COVID-19 testing sites. The exercise of the enforcement discretion is retroactively effective beginning March 13.

OCR issued the notification to allow certain covered health care providers, including some large pharmacy chains, and their business associates to participate in the operation of a community-based-testing site (CBTS). These sites include mobile, drive-through, or walk-up sites that only provide COVID-19 testing services to the public.

While HIPAA violations will be waived provided the covered entities and/or business associates are participating in a good faith operation of a CBTS, OCR still encourages healthcare providers to implement reasonable safeguards, including the following:

• Using and disclosing only the minimum PHI necessary except when disclosing PHI for treatment.
• Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples.
• Controlling foot and car traffic to create adequate distancing at the point of service to minimize the ability of persons to see or overhear screening interactions at a CBTS. OCR recommends a six-foot distance, which would also serve the purpose of minimizing the risk of spreading COVID-19.
• Establishing a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS, and posting signs prohibiting filming.
• Using secure technology at a CBTS to record and transmit electronic PHI.
• Posting a Notice of Privacy Practices (NPP), or information about how to find the NPP online, if applicable, in a place that is readily viewable by individuals who approach a CBTS.

This is the fourth notification of enforcement discretion issued by OCR during the COVID-19 pandemic. OCR previously issued notifications of enforcement discretion for business associates, first responders, and telehealth.