HIPAA Enforcement Discretion for HIPAA Business Associates to Share Health Data with Public Health Organizations

OCR (Office for Civil Rights) inside of HHS which is in charge of HIPAA enforcement has issued another notice of enforcement discretion. Roger Severino, OCR Director, announced that OCR will exercise it’s enforcement discretion and not impose penalties for violations of certain HIPAA provisions.

This is a pretty narrow HIPAA enforcement discretion, but is a good one. As is noted in the announcement, covered entities (healthcare delivery organizations and payers) were already granted permission under HIPAA to share protected health information (PHI) with public health entities. Now under this enforcement discretion, HIPAA Business Associates can share PHI with public health entities.