News & Insights

HHS Waives Certain HIPAA Privacy Rule Provisions for Texas and Louisiana Hospitals

September 06, 2017

HHS Waives Certain HIPAA Privacy Rule Provisions for Texas and Louisiana Hospitals

In light of Hurricane Harvey, the U.S. Department of Health and Human Services (HHS) Secretary Tom Price, M.D., declared a public health emergency in Texas and Louisiana and has exercised the authority to waive sanctions and penalties against a Texas or Louisiana covered hospital that does not comply with the following provisions of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule:

  • The requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care
  • The requirement to honor a request to opt out of the facility directory
  • The requirement to distribute a notice of privacy practices
  • The patient's right to request privacy restrictions
  • The patient's right to request confidential communications

Other provisions of the Privacy Rule continue to apply, even during the waiver period.

When the Secretary issues such a waiver, it only applies: (1) in the emergency area and for theemergency period identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; (3) with respect to the provisions identified above; and (4) for up to 72 hours from the time the hospital implements its disaster protocol. When the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours have not elapsed since implementation of its disaster protocol. All other provisions of the HIPAA regulations, including the Security Rule and the Breach Notification Rule, remain in effect.

As emergency personnel and medical facilities undertake immediate action to ensure the safety of those affected, OCR continues to highlight how the HIPAA Privacy Rule allows patient information to be shared to assist in disaster relief efforts and to assist patients in receiving the care they need, regardless of whether a waiver is granted.

For more detailed information regarding HIPAA privacy and disclosures in emergency situations, click here.

For more detailed information regarding emergency situation preparedness, planning, and response, click here.

To utilize the Disclosures for Emergency Preparedness Decision Tool, click here.

Please view the Civil Rights Emergency Preparedness page to learn how nondiscrimination laws apply during an emergency.

Contact your local LAMMICO Risk Management and Patient Safety representative or dial 504.841.5211 for consultation or additional information.

Hurricane Preparedness for Medical Practices

LAMMICO reminds policyholders of resources available to help you prepare in the event of a weather emergency to limit disruption to your practice. LAMMICO policyholders can access our complimentary Hurricane Preparedness Manual for Medical Practices by logging into as a Member. Encourage office managers to download this year's copy for helpful tools such as checklists and emergency tips unique to medical practices. The guide is available in the "Risk Management - Reference Manuals" section in the right-hand navigation.

Remember, LAMMICO is here to protect our policyholders. We are confident in the strength of our business continuity efforts to ensure that we can continue to serve you with minimal disruption in the event of a hurricane.

Recommended Reading For You

Managing Malicious Insider Threats

Read More

Check it...and Keep the Check!

Read More

Cost of Physician Burnout: $4.6 Billion

Read More


Annual Reports:

Receive Regular Updates: