Keeping ePHI secure while working remotely under HIPAA

The Office for Civil Rights (OCR) recently declared that it would use discretion when enforcing the COVID-19 pandemic version of the Health Insurance Portability and Accountability Act (HIPAA). For “good faith uses and disclosures of PHI by business associates for public health and health oversight activities,” businesses will not face penalties.

The break, while pleasant for healthcare organizations and their employees as they concentrate on saving lives, is actually fleeting and shouldn’t be viewed as a potential free pass. Importantly, the discretion does not broaden the scope of the Privacy Rule, so businesses must continue to protect data confidentially and the secure transmission of electronic data. Health Information That Is Not Public