How the HIPAA Privacy Rule applies in a public health emergency

Tad Kosanovich, O.D., of Florida, was hunkered down mid-afternoon Wednesday, waiting apprehensively for the worst from Category 4 Hurricane Ian to pass.

Dr. Kosanovich’s practice in Englewood saw its last patients at noon, and then they set about its storm-proofing protocols. Equipment was unplugged and bagged with plastic garbage bags. Computers were backed up and the server shut down. Staff had safe places to go. He intended to attend the annual meeting of the Illinois Optometric Association (IOA) this weekend but cancelled his plans. He appreciated that IOA had sent their well wishes.

“The weather is unbelievably ferocious,” Dr. Kosanovich says in an email. “We are hunkered down at the house. There are sustained winds of over 100 miles an hour. We are anticipating the eye wall within the next one to two hours. This will bring 150+ mph winds.

“Florida authorities have mandatory evacuation orders for low-lying areas,” he adds. “I am hopeful to make it to the office by Friday and have everything intact. Keep your fingers crossed and strongest prayers. I have been through over a dozen hurricanes, but this one by far is the most intense. I can hear the strongest winds in the distance, so I will send this while I still can. And I hope to speak with you soon and provide follow up and positive report.”

Federal waivers aimed at easing recovery

With Hurricane Ian bearing down on Florida with predictions of dire disaster, the federal government (Secretary of the Department of Health and Human Services Xavier Becerra) issued two waivers this week for the state.

One waiver, issued Sept. 26, relaxes some requirements under the Medicare, Medicaid and Children’s Health Insurance Program. These requirements were relaxed “to ensure that sufficient health care items and services are available to meet the needs of individuals enrolled in the Medicare, Medicaid and Children’s Health Insurance Program (CHIP) programs and to ensure that health care providers that furnish such items and services in good faith, but are unable to comply with one or more of these requirements as a result of the consequences of Hurricane Ian, may be reimbursed for such items and services and exempted from sanctions for such noncompliance, absent any determination of fraud or abuse.”

Among the waiver and modification of requirements are:

• Certain conditions for participation and certification of health care providers or types of health care providers who provide services.
• Requirements that physicians or other health care professionals hold licenses in the state in which they provide services, if they have an equivalent license in good standing from another state.
• Direction or relocation of individuals to another site to receive medical screening or for stabilizing their condition due to the public health emergency.
• Limitations on payments for health care items and services given to individuals enrolled in Medicare Advantage by health care providers not currently in the plan’s network.

A second waiver, a public health emergency declaration issued Sept. 27, temporarily waives requirements under the HIPAA Privacy Rule to allow for sharing of patient information during disaster relief efforts in the state.

During the emergency, the HIPAA Privacy Rule requirements are waived for:

• Seeking a patient’s agreement for the health care provider to speak with their family members and friends involving their care.
• Requiring patients to be a part of a hospital directory.
• Distributing a notice of privacy practices to patients.
• Requesting confidentiality in communications.

The waiver applies to a hospital’s emergency areas, which have implemented disaster protocols, and for a period of 72 hours once the protocols are set in motion. The waiver could potentially impact doctors of optometry with hospital privileges.

The privacy rule applies to “hospital employees, volunteers and other members of a covered entity’s or business associate’s workforce. Entities include health plans, health care clearinghouses, and those health care providers who conduct one or more covered health care transactions electronically, such as transmitting health care claims to a health plan.” Business associates include persons or entities (other than members of the workforce of a covered entity) who perform functions or activities on behalf of, or provide certain services to, a covered entity that involve creating, receiving, maintaining, or transmitting protected health information. Business associates also include subcontractors.

Helpful tools

For more information on how the HIPAA Privacy Rule applies in a public health emergency, doctors of optometry can consult the HIPAA Disclosures for Emergency Preparedness Decision Tool, an interactive question-and-answer resource to help health care providers navigate HIPAA requirements during a time of public emergency.

Read more about the CMS’ recent announcement on “resources and flexibilities” for the Commonwealth of Puerto Rico struck by Hurricane Fiona.

Supporting doctors impacted by disaster

Optometry’s Fund for Disaster Relief (OFDR) stands ready to help doctors restore critical patient care. A program of Optometry Cares®—The AOA Foundation, OFDR provides up to $4,000 in financial support to doctors of optometry affected by disasters with an eye toward helping cover necessary expenses and expediting doctors’ ability to restore care. Originally established in 2005 in the wake of Hurricane Katrina, the fund has distributed more than $1 million in aid to date. Optometry students who have experienced property damage due to a disaster also are eligible for assistance. Here's how you can support OFDR or find grant information:

Donate to Optometry Cares. Help make certain that OFDR funds are available for colleagues affected by disasters.

Submit an OFDR application. Recently affected by a disaster? Learn more about grant criteria and complete the OFDR application and Form W-9.