End of the Public Health Emergency Marks End of HIPAA Enforcement Discretion for Telehealth Practices

The COVID-19 public health emergency (PHE) in the United States came to an end on May 11, 2023. Simultaneously, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced that its enforcement discretion regarding violations of the Health Insurance Portability and Accountability Act (HIPAA), applicable during the PHE, also would be coming to an end.[i] Covered entities and business associates now have a 90-day transition period, ending on Aug. 9, 2023, in which to bring their telehealth practices into compliance with the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (HIPAA Rules). Among other things, this will require entities that may be using telehealth technologies provided by companies that will not agree to sign business associate agreements (BAAs) to switch to platforms offered by companies that do.

In 2020 and 2021, OCR published four Notifications of Enforcement Discretion (Notifications) regarding how the HIPAA Rules would be applied to certain violations occurring during the PHE. Three of the Notifications involved COVID-19-specific activities. In each Notification, OCR determined it would not impose penalties against covered entities or their business associates for noncompliance with the requirements under the HIPAA Rules when participating in good faith in specific activities.

Read more at National Law Review >>