Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Rutkowski joins panel discussion about AI use in marketing

Reid says Congress should broaden (not curtail) nonprofit free speech rules

Antitrust Advocate

State Attorneys General Take a Strong Pro-Enforcement Stance in Comments to Draft Merger Guidelines

Examining the context, impact of Ohio high court tax statute decision

On April 9, 2020, the Office for Civil Rights (OCR) issued a <a href="https://www.hhs.gov/sites/default/files/notification-enforcement-discretion-community-based-testing-sites.pdf">Notification of Enforcement Discretion</a>, which announced that, retroactive to March 13, OCR will not impose penalties against covered entities or business associates for violations of the HIPAA Rules in connection with their good faith participation in the operation of a COVID-19 community-based testing site (CBTS) during this nationwide public health emergency. According to OCR Director Roger Severino, OCR is “taking extraordinary action to help the growth of mobile testing sites so more people can get tested quickly and safely.”  The OCR notification applies to a CBTS that provides only COVID-19 specimen collection or testing services to the public, including mobile, drive-through or walk-up sites. While the notification only applies to a COVID-19 CBTS, it is noteworthy for all providers in that it elucidates OCR’s continued expectations for HIPAA compliance during this ongoing period of national emergency. The notification encourages providers participating in the operation of a CBTS to implement reasonable safeguards to protect the patient privacy and security of individuals, including the following:  <ul> 	<li>Using and disclosing only the minimum protected health information (PHI) necessary, except when disclosing PHI for treatment.</li> 	<li>Setting up canopies or similar opaque barriers at a CBTS to provide some privacy to individuals during the collection of samples.</li> 	<li>Controlling foot and car traffic to create adequate distancing at the point of service to minimize the ability of persons to see or overhear screening interactions at a CBTS.</li> 	<li>Establishing a “buffer zone” to prevent members of the media or public from observing or filming individuals who approach a CBTS, and posting signs prohibiting filming.</li> 	<li>Using secure technology at a CBTS to record and transmit electronic health information.</li> 	<li>Posting a Notice of Privacy Practices (NPP) in a place that is readily viewable by individuals who approach a CBTS, or information about how to find the NPP online.</li> </ul>  While the notification provides that OCR will not impose penalties for violations of the HIPAA Privacy, Security and Breach Notification Rules that occur in connection with the good faith operation of a COVID-19 CBTS, the notification highlights the types of safeguards that OCR deems reasonable and expects all providers to have in place as they navigate this unprecedented national crisis. OCR makes clear that the notification is limited in nature to the operation of a CBTS and does not apply when providers are performing non-CBTS-related activities. Thus, a provider that experiences a breach in its electronic medical record system, which also includes PHI from the operation of a CBTS, is not immune from HIPAA enforcement and would be subject to penalties for violating the HIPAA Breach Notification Rule if it failed to notify all individuals affected by the breach (including individuals whose PHI was obtained during the operation of a CBTS) according to the notification.  The Notification of Enforcement Discretion on CBTS may be found <a href="https://www.hhs.gov/sites/default/files/notification-enforcement-discretion-community-based-testing-sites.pdf">here</a>.  Authorship Credit: Vimala Devassy

core/freeform

Atlanta

Partner

Vimala Devassy

Industries

Healthcare

COVID-19 Compliance

Community-Based Mobile Testing Sites Will Not Be Penalized for  HIPAA Violations During COVID-19 National Emergency

Related Services

Featured Insights