What are some of the privacy and security mistakes and pitfalls that covered entities and business associates should avoid making as they respond to the COVID-19 crisis? I'm Marianne Colbusak-McGee, Executive Editor at Information Security Media Group. Today, I'm speaking with privacy attorney Iliana Peters of the law firm Paul Sennelly. So Iliana, the Department of Health and Human Services Office for Civil Rights, has made a number of moves lately during the COVID-19 crisis.
Those include waiving certain HEPA privacy requirements, allowing the use of certain technologies for telehealth that might have been frowned upon in the past, allowing business associates to use or disclose protected health information for public health activities, and then most recently saying that the agency will exercise enforcement discretion for potential HEPA violations by community-based testing centers that are performing these COVID-19 tests. Of these moves, or other recent moves by HHS during the COVID-19 crisis so far, any that you find potentially problematic from a privacy or security perspective, and why? You know, I think there's a bit of confusion about all of these notices for different reasons, and so I think it's helpful to sort of walk through the different notices briefly to kind of highlight those issues where there has been a bit of confusion. So for example, the Department of Health and Human Services issued a limited waiver of certain provisions of the HEPA privacy rule under section 1135 of the Social Security Act, and every time HHS does this in association with the public health emergency of some kind, and they've done it obviously not only for COVID, but also in cases of natural disasters like hurricanes, et cetera, every time they issue one of these limited waivers, there is a lot of confusion about how this applies, and many people think that HEPA, just generally, all of the protections under HEPA are waived.
That's just not the case. A limited waiver under section 1135 of the Social Security Act applies only to five pieces of the HEPA privacy rule that have to do with individual rights, and those include obtaining a patient's agreement before speaking with family members or friends, honoring a request to opt out of a facility directory, distributing a notice of privacy practices to new patients, honoring the patient's right to request privacy restrictions, and honoring the patient's right to request confidential information and confidential communications. So again, these are very limited waivers of very few provisions of the HEPA privacy rule that are difficult to implement in times of crisis, but it certainly does not waive anything beyond that, and so entities need to be aware that the rest of the HEPA protections apply, and they should comply with the rest of the HEPA rules requirements. Now, as you mentioned, Mary-Ann, OCR has also issued some notices of enforcement discretion, so not waivers.
None of the provisions of the privacy rules have been waived pursuant to these notices, but what OCR has said in these notices is that they will exercise enforcement discretion on certain provisions of the rules during the public health emergency, specifically related to COVID. So as you mentioned, Mary-Ann, the first of those had to deal with telehealth, and it was limited to healthcare providers. So the idea under this notice of enforcement discretion is that healthcare providers may have circumstances where they need to use telehealth technologies to treat individuals, both with COVID-related conditions and otherwise, and have probably business associate agreements in place with telehealth application vendors, of course, that comply with the HEPA privacy rule and the security rule, but at the same time, they may need to use other technologies to treat patients who may not have access to those particular telehealth applications. So for example, a healthcare provider may have a business associate agreement in place with an application vendor like Skype for Business or Microsoft Teams, and that's the telehealth application they use regularly.
Everybody's attempting to do their best to comply with the HEPA requirements. There's a business associate agreement in place, but they have a patient who doesn't have access to a computer, can't use Microsoft Teams, and has to use some other type of potential application that they can use on their phone, for example. What HHS is saying here is that if the provider needs to use that application without signing up a business associate agreement first, in order to treat that patient, they will exercise enforcement discretion related to that activity. So the default for healthcare providers still should always be compliant technologies and business associate agreements, but if it's just not possible in a particular circumstance to provide treatment, then OCR will exercise enforcement discretion.
The second note is that OCR published related to enforcement discretion, which was about a week ago, has to do with business associates. And as we know, business associates themselves are somewhat limited in the uses and disclosures of protective health information that they can make, because they are limited by their business associate agreements. So most of the business associate agreements that are placed, obviously outline the uses and disclosures that a business associate can make to provide services to their covered entity clients. Those uses and disclosures generally do not include permissions to disclose for public health activities.
So business associates are generally constrained for making those types of disclosures, even though they are permitted for covered entities under the privacy rule. So HHS said in this particular notice of enforcement discretion that as long as business associates are making public health disclosures as otherwise permitted by the HIPAA privacy rule, and the appropriate safeguard to be in place, including, for example, encryption and access controls under the security rule, and if the business associate makes those disclosures to public health authorities in good faith and then provides notice to their covered entity clients, they can do so even if their business associate agreements don't allow for it. So again, they want business associates to comply with the requirements of the privacy rule as much as possible, and of course, with the security rule as well, and then provide notice to their HIPAA covered entity clients that they've made that disclosure that's authorized by law to a public health authority. And then as you mentioned, there's a fresh off-the-press new notice of enforcement discretion from HHS that deals with community-based testing sites.
So obviously, these are very specific to this COVID emergency. And we know that there are several different opportunities for different types of health care providers and their business associates to set up community-based testing sites, for example, in parking lots to try and increase the availability of testing for the public related to COVID. So what OCR has said in this particular notice of enforcement discretion is, again, limited to health care providers and their business associates that are undertaking community-based testing sites. So this is only applicable to the community-based testing sites.
If a health care provider does some other types of activities like a physician and it has a physician's office separately from the testing sites or if it's a pharmacy and it operates a retail pharmacy separately from this testing site, this notice of enforcement discretion does not apply to those other activities. It only applies to the community-based testing sites. And in those circumstances, OCR still encourages entities to implement reasonable safeguards related to the information that is shared during those testing site activities. But if there are circumstances where there may be disclosures that aren't made as permitted or with the appropriate safeguards under the privacy rule, then OCR will exercise enforcement discretion in those circumstances.
So again, the default should be compliance with the HIPAA rules. But if there is a circumstance related to those community-based testing sites, then OCR will exercise enforcement discretion in that regard. So I think, again, these are quite important and nuanced notices and entities really should dig in and try and best understand that the default should be compliance with the rules and then there may be very specific circumstances where OCR will utilize enforcement discretion because of the emergency. So now, Eliana, as we know, during state and city lockdowns, health care entities and business associates are also allowing many more members of their workforces to telecommute.
What are some of the top privacy and security considerations that health care entities and business associates should be keeping in mind as they expand their telecommuting ranks? So in this new world where we're all working from home, not only as business associates or as covered entities, the health care providers, health plans, and business associates that are involved here really have to remember not only the safeguards requirements under the privacy rule, but also the administrative physical and technical safeguards that are required under the security rule. So much like all different types of businesses that are issued guidance for their employees who are working from home, you know, health care providers, business associates, health plans also must do the same. So in any case where they have workforce members working from home, those workforce members should really understand what their responsibilities are to keep that information private and secure, both with regard to, again, security controls.
So what kind of technical controls should be implemented, including using secured Wi-Fi and VPN, making sure that people who have access to the information have the appropriate access controls in place, transmitting information in an encrypted manner, all of those important technical controls under the security rule that these entities are responsible for implementing. But also, physical controls and administrative controls, both under the security rule and under the privacy rule. And those are things like keeping devices safe, making sure that they're not left anywhere. They shouldn't be making sure that family members and friends don't have access to them, ensuring that any paper data that these workforce members have at home from their entities is kept safe, secure, and is not shared with individuals who don't have a right to that information.
So again, this is nothing new for a lot of entities because there are a lot of people covered entities and business associates that do in fact have employees that work from home and have for a long time. And of course, that's not prohibited by the rules. But what they do need to ensure is the compliance with all of those important safeguards requirements, technical, physical, and administrative, to make sure that both the electronic data that they have at home and are transmitting out of their homes and the paper data that they have at home is kept private and secure. So, Aliana, in many cities, including New York, government officials have been encouraging retired healthcare professionals to volunteer in the COVID-19 response.
And some medical schools have allowed their students to graduate early to allow these individuals to also help out in the effort. What are the potential privacy and security concerns as these individuals suddenly join the COVID-19 response effort? What about vetting and training these individuals? Is there even an ample time to do that properly?
So, obviously, the HIPAA rules do require that individuals who will be interacting with protected health information are trained on the requirements of the HIPAA rules. So, that provision is not something that has been waived or affected by one of these notices of enforcement discretion. It's also really important on some level to make sure that everyone who's handling PHI understand their responsibilities to keep that information private and secure. But as you say, we may not have the time or the resources for some of these healthcare providers and professionals reentering the workforce to help with this incredibly important response to give robust and really full-sum hour-long trainings on HIPAA requirements.
So, maybe it is really about ensuring that these individuals understand their responsibilities with regard to what they do every day and how they interact with PHI. So, for example, if you have volunteers that are working in healthcare facilities that are going to interact with social media or media, this is a huge area of risk for HIPAA covered entities and business associates. And so, it's really important that anyone who can have any interactions with social media understand that they cannot use patient information for those interactions without a HIPAA compliant authorization from the patient who's subject to the information. Obviously, that's an area where OCR has really concentrated enforcement efforts and over the life of the enforcement program.
So, a huge risk area. So, everybody who's dealing with PHI, particularly those who are interacting with the public and the media, should know they should not be using patient information for those purposes. Otherwise, it's really about understanding how those professionals are going to interact with the information and making sure they understand what the boundaries are. So, for example, what are the safeguards for the information that they're going to be interacting with?
Is it about bad access? Is it about passwords? Is it about ensuring appropriate security controls for information in electronic health records? Is it understanding that they can't, unfortunately, talk with our family members about specific patient matters at the end of the day to make sure we keep that information private and secure?
But there's there are other resources for them if they need to decompress and talk with colleagues about specific matters related to patients. How does that work for these professionals day-to-day? And really, maybe it's investing the resources that we have in those types of training conversations rather than online training for an hour or a classroom training because we just don't have the resources for it at the moment. Related to that, also, you have these people who are entering the workforce at new organizations perhaps.
Maybe some of these people were retired, some of these people might be newly graduated medical school students who are now on the front lines. Is there enough time even to have these people trained on the electronic health record systems, for instance? The various interfaces that maybe they're not familiar with are organizations going to be forced to resort to paper records and then have somebody else enter a bad data later on because there's not enough time to get these people acclimated in the electronic systems? And what are some of the dangers involved with the paper process being then transitioned to electronic records later on?
Yeah, I think that's a really good question, Marian. I mean, I think from my perspective, certainly our newer healthcare professionals do everything electronically anyway. So I think the learning curve for newer professionals entering the workforce related to this crisis is probably a lot lower because they are very used to using electronic technologies. And really, I think they're about helping them understand how to use those technologies in a secure way because they may be more inclined to use new and interesting applications or other types of technologies like devices that may or may not be approved through the HIPAA covered entities normal approval process.
So that creates risk, obviously. We want to make sure that all of the applications that we use to the extent possible, at least with regard to telehealth, are approved through the HIPAA covered entity or business associates normal approval process so we can ensure that we understand the risk to the data involved and that we can ensure that we have the appropriate business associate agreement in place, of course. So I think really those are the risks that I see with some of the younger professionals, obviously with some of the older professionals to your point, Marian, that may be more difficult for them to understand some of the more complicated pieces of electronic health record technology. But certainly, I think, again, even older professionals are using electronic applications every day.
And particularly during this time, all of our parents and grandparents are getting used to using different types of VTC technologies, different types of online applications to help with banking and healthcare issues and potentially ordering grocery deliveries. So I think what we can hope for is really an opportunity to train both new and older professionals on the best and most secure methods of using these technologies so we can make sure that that information stays private in the care. Thanks, Iliana. I've been speaking to attorney Iliana Peters.
I'm Mary-Ann Cobissette McGee of Information Security Media Group. Thanks for listening.