Hurricane Sandy spotlighted the provision allowing the Secretary of Health and Human Services (“HHS”) to waive certain provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations in an emergency.

The President and the HHS Secretary have the authority to waive HIPAA requirements temporarily in an emergency. In response to Hurricane Sandy, President Obama declared under the Robert T. Stafford Disaster Relief and Emergency Assistance Act that a major disaster existed in New York and New Jersey as a result of the hurricane. The President’s declaration was retroactive to October 27, 2012. On October 31, 2012, HHS Secretary Sebelius declared a public health emergency and authorized waivers and modifications under Section 1135 of the Social Security Act for New York and New Jersey.

Section 1135 waives sanctions and penalties arising from noncompliance with the following provisions of the HIPAA privacy regulations:(a) the requirements to not speak with family members or friends if the patient objects or to honor a patient’s request to opt out of the facility directory; (b) the requirement to distribute a notice of privacy practices; and (c) the patient’s right to request privacy restrictions or confidential communications. Section 1135 waivers are limited, however, only to the designated geographic area and are in effect only during the emergency period. The law limits these waivers to a 72-hour period. You may read these waivers for the two states at the following links: New York and New Jersey.