In the aftermath of the shooting in a gay nightclub in Orlando, Fla., that left 49 dead and 53 wounded Saturday night, area hospitals were filled with victims. Given the influx of patients, Orlando Mayor Buddy Dyer asked the White House to waive HIPAA regulations to allow hospitals to communicate with families of the victims. While HIPAA can be suspended during national emergencies, what Orlando officials sought in a HIPAA waiver — communicating with families — is already permitted under the privacy law, according to Politico.
Mayor Dyer said he contacted the White House after a hospital CEO said they had run into privacy concerns with releasing information to patients' families. "The CEO of [a] hospital came to me and said they had an issue related to the families who came to the emergency room. Because of HIPAA regulations, they could not give them any information," Mayor Dyer said, according to a NewsChannel 10 report. "So I reached out to the White House to see if we could get the HIPAA regulations waived. The White House went through the appropriate channels to waive those so the hospital could communicate with the families who were there."
Certain provisions of the HIPAA Privacy Rule may be waived when both the president declares a national emergency and the HHS secretary declares a public health emergency. If such an emergency is declared, sanctions and penalties for noncompliance with certain provisions are waived for HIPAA-covered hospitals, including the requirements to obtain patients' agreement to speak with family members or friends and the requirement to distribute a notice of privacy practices, among others.
Such a waiver is applicable in the emergency area for the time period identified in the public health emergency declaration for hospitals that have instituted a disaster protocol and for up to 72 hours after the hospital implements the disaster protocol.
However, the HIPAA Privacy Rule does permit disclosing patient information in certain instances, regardless of whether an emergency waiver is activated. According to a bulletin from the Office for Civil Rights outlining HIPAA privacy in emergency situations, covered entities are permitted to disclose protected health information to family members, relatives, friends or others identified by the patient involved in the patient's care. This includes information on the patient's location, general condition or death. "If the individual is incapacitated or not available, covered entities may share information for these purposes if, in their professional judgment, doing so is in the patient's best interest," according to the bulletin.
Though disclosure of certain types of information is permitted during emergencies, broader protections of the privacy rule are still in place.
This appears to be the case for the Orlando shooting, Kirk Nahra, a health privacy attorney in Washington, D.C., told Politico, adding covered entities should still take some precaution when sharing information.
"There is always reasonable professional discretion," Mr. Nahra said. "At the same time you would obviously need to be careful, since you have to have some real idea that it's family."
Editor's note: This headline was updated June 15 at 9:35 a.m. CST after the HHS indicated no such wavier was granted. Read our update on the HIPAA waiver status here.