Understanding OCR's Recent Guidance On COVID-19

Following the outbreak of COVID-19 in late 2019, the U.S Department of Health and Human Services' ("HHS") Office for Civil Rights ("OCR") has offered guidance to covered entities and business associates regulated by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy, Security, and Breach Notification Rules (the "HIPAA Rules"). Such guidance has been offered to assist covered entities and business associates when dealing with patients' protected health information ("PHI") during the public health emergency. We provide an overview of the following three notices issued by OCR from February-March 2020: (1) the HIPAA Limited Waiver Under Section 1135, (2) the Notification of Enforcement Discretion for Telehealth Remote Communications, and (3) the General OCR Bulletin on HIPAA.