I'm Mary Ann Coba-Sakmagi, executive editor and information security media group. Today I'm speaking with privacy attorney Kirk Nara of the law firm Wilmer Hale about recent HIPAA waivers issued by the Department of Health and Human Services related to the COVID-19 crisis and also related privacy and security issues involving the coronavirus situation. Kirk, for starters, HHS's Office for Civil Rights says it has waived sanctions and penalties against hospitals that do not comply with a number of HIPAA privacy requirements such as obtaining a patient's agreement to speak with family members and also distributing notices of privacy practices. Any privacy problems that you foresee potentially emerging from these or any of the other waivers that HHS has issued and why?
They've really done two different things. The ones that you mentioned which were sort of privacy related and then there's a much more security related one on telehealth. I'm not quite sure why they did the waivers you mentioned. They basically said they're going to waive compliance obligations.
They never penalize anybody for those particular issues. I mean, I'm not aware of their being, I'm forgetting something, but I'm not aware of their being HIPAA enforcement actions for failure to give out a privacy notice, for example. It's kind of a funny thing to do. I mean, they've said you don't have to give a privacy notice.
I'm not sure why you don't have to give a privacy notice. They've said that they're waiving the provisions in terms of dealing with communications to family and friends. Those provisions give covered entities lots of discretion. So I'm not sure why you would say, oh, go talk to anybody who you think is a family or friend anytime you want to, but that's fine.
Which again, I don't think providers act that way, but that's sort of what you read when you see a waiver like that. The other ones are also tricky. There's another provision about waiving requests for restrictions. That's a very particular provision of the HIPAA rules where you can ask covered entities not to do things that they're otherwise allowed to do.
The covered entity doesn't have to say, yes, I'm not sure why you waive the obligation to let somebody ask you. So that's kind of funny. And then the last one which actually is potentially the most concerning is the provision dealing with confidential communications, which is basically a situation where a either a patient or an insured member on the health insurance side would say, please don't communicate information about my claim, for example, to my regular mailing address. Because if you do, that will cause me harm, where that come up a lot is in things like domestic violence situations where a wife is on the husband's insurance plan and there's a medical treatment that if the husband finds out about it will cause potential harm to the wife and she says send it to my office instead of sending it to my home.
They've now said you don't have to comply with that. I'm not sure why they're doing that. So that set of waivers was confusing to me and I'm not really sure of the point of it. So Kirk, what about HHS's telehealth waivers, which include allowing healthcare providers to use applications that allow for video chats, including Apple FaceTime and Google Hangout and Skype, but not public facing platforms such as Facebook Live, Twitch, TikTok, and some other video communication applications.
What's your privacy and security advice to healthcare entities in terms of expanding their telehealth services with these waivers in mind? So I think the telehealth one is somewhat more important and I don't know that I really see a particular negative to this. I would put the telehealth waiver in the context of some ongoing issues that HHS has had where basically there are technologies that are convenient to patients where the healthcare provider community hasn't been sure that they're allowed to use those technologies under the HIPAA security rule. A simple one is email.
If a patient wants a doctor to respond to the patient by email, doctors aren't sure if they're allowed to do that because email isn't inherently secure in a variety of issues like that. So that's been something they've been dealing with for a number of years. It came up recently in the interoperability rules and information blocking rules dealing with patient access to data where the government was balancing the need to get patients access to their own records with the possibility that some of the places those records would be sent would be secure enough. So this is part of a trend.
Here I think what they're saying is look we have a societal need to try to take advantage of these technologies like telehealth. There are ways to do healthcare visits that don't involve somebody physically going to a hospital or doctor's office. We want to encourage that. So we're going to be clear to the healthcare provider community that they can do that, that they don't have to go through the full HIPAA risk assessment and that they don't have to be worried about enforcement of a security problem if you do telehealth visits in those settings.
Now again, it's a funny document because it talks about using enforcement discretion. They don't need a formal document to use enforcement discretion. They use enforcement discretion every day in all kinds of cases. I think this was served a slightly different purpose.
This was basically a sending a message to the provider community that is okay to do this, that we want you to do this. And I think for the healthcare providers it's first of all a good opportunity. It gives you clarity if you were concerned about it before. What I've been telling people is basically look be still be smart about this.
Set up your visits, do them from your office, do them from your home. Don't go to the local Starbucks and sit at a table and do a telehealth visit. So I mean you can even do that today but be smart about what you're doing. The fact that they've said we're not going to take enforcement action doesn't mean you should go out and be reckless.
But I think this was a very useful statement to basically encourage telehealth both because it's often convenient for patients. And now particularly since we want to minimize that in person contact on some of these left significant visits, you want to encourage that it's a win-win further for the system. Now HHS OCR also recently issued guidance that the agency says clarifies how carbon entities may disclose information about individuals who have been infected with or exposed to COVID-19 to law enforcement paramedics and other first responders as well as public health authorities. Has anything changed with these kinds of disclosures or is this just sort of another reminder for the industry do you think?
I think that that document was really guidance from HHS and what and they've done this before. What they're doing is basically collecting in one place the information about these kinds of disclosures because they come up in a number of different provisions of the HIPAA privacy rule. They're collecting that material so that people are aware of the various opportunities that they have to use and disclose information in connection with these kinds of reporting situations. So I think that was all useful.
Again it's like giving you a summary rather than saying here's a law book or read what's in it. We're saying here's the highlights that are the important points on this. There wasn't anything new in there. I mean this wasn't changing the rules at all.
It was basically collecting the information. And again trying to make people understand in situations where there's a reason to make this disclosure to basically make sure people are aware that they can make them and to give you an understanding of whatever the boundary lines are, whether they are boundaries. I mean we are finding for the most part that the HIPAA rules actually work pretty well in these settings. There are the ability to make disclosures for treatment purposes.
There are the ability to make disclosures for public health purposes etc. So while they obviously weren't thinking about this specific situation in writing the rules they were thinking about situations like this or enough like this that they anticipated a lot of the needs here. Now Kirk even before the COVID-19 situation exploded, HHS OCR was working on possible HIPAA modifications. Do you think any of these latest waivers will potentially somehow get worked into the bigger picture changes to HIPAA and what other sorts of modifications do you think we're most likely to see and when?
I'm not sure there's anything in these current waivers that are going to be addressed in that modification. I mean for example you're not going to drop the obligation to have a privacy notice generally which they temporarily waived for whatever reason. Again I'm not sure why those provisions were in there. I'm not sure why they need to be waived in the time being but I don't think there's any sense that they're going to remove those permanently.
The telehealth situation is a little different because I don't really think it's a question of the rules. It's a question of how companies are going to meet their compliance obligations under the security rule. HHS could clearly say that we view these kinds of telehealth services as consistent with the HIPAA security rule. They don't need to revise the rule to do that and so I wouldn't expect that to be in these rules either.
The things that are relevant to me potentially connected to what's going on with COVID rather than the waivers is there are some concerns that were raised in the at least the RFI which is the first step in the HIPAA modifications in this HIPAA modification process about how coordinated care is being done and whether there are restrictions on health care providers disclosing information in certain context. I do think that there's some room to improve the rules there although I think the rules are not as bad as HHS seems to think they are in this setting. One of the things that HHS has been interested in was that there's a perception among some in government that the opioid crisis for example was exacerbated by limitations on how providers shared information about people with potential opioid problems. Again I don't know that HIPAA was a problem there.
I don't know that that was the reason information wasn't getting shared. There are other statutes in play for example the part two substance abuse rules. I will tell you and it does look like in the legislative package that is being written in Congress as we're speaking that they're actually going to make some legislative changes to the part two rules that might actually be more important than changes to HIPAA because the part two substance abuse rules are actually more restrictive than HIPAA is. I'm not sure what else we're going to see coming out of those rules.
I think there will and again the next step is a proposed rule. I guess one other area that they seem to be giving a lot of attention to which I do think is worth some attention is how health care companies can interact with social service organizations. If a doctor realizes that their patient is not in good health not really because they're sick because they don't have enough food and they want to get information about that patient to a food bank how do they disclose that the rules are not great on dealing with that and so I think they're looking for opportunities to sort of enhance sharing of information with non-traditional health entities some of these social service organizations. So that's something that I would certainly expect to have some developments on.
In terms of the part two changes in the COVID-19 legislation what sort of changes are they looking at? The issue with part two is that it is much narrower in terms of what people that have part two data can do with the information and so those rules were written in the 70s originally well before there even was HIPAA and they create today a sort of whole parallel set of much narrower rules in connection with a very particular kind of health care information and so there's lots of situations where HIPAA would permit something for every other kind of health information but part two doesn't and the regulations have been changed a couple of times in the past several years to move closer and closer to HIPAA but there's a statute and so they can't get entirely close to HIPAA. The legislative provisions seem to be moving towards basically saying if you do one step getting a certain kind of consent from the patient then you can do whatever HIPAA permits you to do that's my read of the language it's pre-complicated legislative language so I think that's what they're trying to do but again the idea is we should treat part two information basically the same as we treat all other health care information HIPAA doesn't distinguish among categories of information and let's make sure that we can do what we need to do with this information the same way we do with everything else. So Kirk as COVID-19 testing is expanded in the US any top privacy and security concerns that you think entities should consider?
Well in terms of testing itself I mean the biggest issue we've been getting questions about has to do with what employers can do with information about employees typically employees who have tested positive there might be visitors to an office there might be you know guests if it's a hotel sort of what do companies do when they learn that somebody who's been in contact with their business accept the positive or has symptoms or whatever it is interestingly enough the privacy rules the traditional privacy rules are actually pretty permitted in terms of reasonable balances in that area where we're seeing many more restrictions are on some of the employment laws in particular so for example the Americans with Disabilities Act which extends way beyond just information about disabilities is coming into play in a lot of employee situations where employees have tested positive those obviously don't apply to guests or visitors or things like that so we're seeing a lot of balancing acts we're seeing that both in the United States there's a lot of issues in Europe and in fact a number of the data protection authorities in Europe have come out with their own guidance that guidance that was coming out initially was somewhat inconsistent across countries and now at a European level they've tried to come up with some integrated advice which basically says look you can't abandon the privacy rules but you're still permitted to make reasonable and appropriate disclosures as long as you've thought about the right kinds of privacy protection so it's something that obviously we're paying a lot of attention to it's going to continue to be an important part of the public health crisis and and the main method that I've been communicating is that you know for the most part the privacy rules if handled appropriately and your use and disclosure of this information is thoughtful and limited and targeted you're generally permitted by these areas rules to make disclosures that are necessary to make and finally kirk hhs also recently issued final patient access information blocking and interoperability rules some of the provisions in these rules begin taking effect this year for instance hhs specifies that by september hospitals must be able to send electronic notifications about admissions transfers and discharges to a wide range of recipients including a patient's primary care doctor and others that are involved with the patient's care do you think hhs will need to readjust some of the regulatory deadlines i have in light of covid-19 and everything else that the health care sector is dealing with right now and why so that's really a hot button issue that with an issue with those regulations even before we got into the current crisis i mean there was a concern that some of the timetables were too quick i've got to assume that they're going to give some flexibility on that and again maybe the flexibility is on enforcement as a sink from the requirements i mean that's obviously something you can you can do is basically say look the rules are remaining in effect we expect people to get to that point but we're not going to take action against you if you haven't met that deadline i i would have a minimum expect something like that and look at something that's going to be applied to our cross-star system i mean that's been part of my advice on privacy issues i think it's true on all of these issues regulators are watching what's going on it's affecting them it's affecting their families it's affecting their workplaces and i think people are from the enforcement perspective are generally going to to recognize that we can't hold everyone to all the normal rules that we hold them to and so when there are new regs coming out again i said we'll see much fewer of them in the next few months i think all of those timetables are going to have some slide to them whether it's a formal slide or just an enforcement taking a back or unenforcement in the short term but i i again government certainly recognizes all these issues are at all levels of government thanks kirk i've been speaking to attorney kirk nara i'm mary and colbus at mcgee of information security media group thanks for listening