What is enforcement discretion?
Enforcement discretion means the OCR will not impose penalties on covered entities or business associates if they are non-compliant with HIPAA guidelines.
When will the OCR use enforcement discretion?In an effort to increase vaccine distribution, the OCR is using enforcement discretion to help organizations schedule appointments for the COVID-19 vaccination using web-based scheduling applications, like Zocdoc or Phreesia for example.
What does this mean for healthcare providers?
Usually, a WBSA would have to follow specific rules to keep protected health information ( PHI ) safe and sign a business associate agreement ( BAA ). However, this recent announcement means that healthcare providers are free to choose a WBSA without signing a BAA or ensuring the vendor is capable of meeting HIPAA security requirements. This news protects healthcare providers and also protects WBSA companies that may be unaware they are handing PHI. The OCR has made similar decisions in the past like relaxing requirements around telehealth during the pandemic .
Enforcement discretion doesn't mean healthcare providers should ignore data security. It would be best to put reasonable safeguards in place with a WBSA like:
- Using only the minimum PHI
- Enabling all privacy settings
- Using encryption technology
- Ensuring PHI storage by the vendor is temporary
- Ensuring WSBA vendor doesn't use or disclose PHI
Are all circumstances covered under enforcement discretion?
While the OCR is willing to make many exceptions, there are still a few circumstances where you could face HIPAA violations . The OCR will enforce HIPAA guidelines if it discovers an organization is not acting “in good faith.” Some circumstances include:
- A WBSA selling PHI that it collects
- Using a WBSA for other services besides COVID-19 vaccine appointments
- No reasonable safeguards to prevent unauthorized users from accessing data
- Using WSBA to screen individuals before their visits
To learn more about enforcement discretion for COVID-19 vaccine appointments, read the OCR’s announcement .