The U.S. Department of Health and Human Services’ Office for Civil Rights announced Feb. 24 that it will not impose penalties for noncompliance with the Health Insurance Portability and Accountability Act against covered health care providers in connection with the good faith use of online or web-based applications for scheduling appointments of COVID-19 vaccinations.
The suspension of penalties will remain in effect until the HHS secretary determines that the public health emergency no longer exists.
The HHS Office of Civil Rights encourages covered health care providers and their business associates utilizing online scheduling to implement reasonable safeguards to protect the privacy and security of individuals' protected health information.
The office recommends that covered health care providers and their business associates consider the following safeguards:
This notification does not apply to activities of a covered health care provider and its business associates other than the scheduling of COVID-19 vaccinations. Potential HIPAA penalties still apply to all other HIPAA-covered operations of the covered health care provider and its business associates, unless otherwise stated by the Office of Civil Rights. Additionally, this notification does not apply to a covered health care provider or business associate when it fails to act in good faith.
The Office for Civil Rights is responsible for enforcing certain regulations issued under HIPAA to protect the privacy and security of protected health information.