Interest Groups

OCR Announces HIPAA Changes for Community Based Testing Sites - Health Care and Life Sciences News

Get the news you want the way you want it: click the RSS button in the right corner to add this feed to your RSS reader, or click here to subscribe to this content. By subscribing, you’ll find this news on your Member Account page, and the latest articles will be emailed to you in your customized IndyBar E-Bulletin e-newsletter.

Health Care and Life Sciences News

Posted on: May 18, 2020

By Andrew Owen, Indiana University Health

The Office of Civil Rights (OCR) has announced that it will lift certain penalties associated with HIPAA noncompliance to allow Community Based Testing Sites (CBTS) during the COVID 19 pandemic.

In an announcement made late last week, OCR through the Department of Health and Human Services (HHS) informed the public that, “[a]s a matter of enforcement discretion….OCR will not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered health care providers or their business associates in connection with the good faith participation in the operation of a COVID-19 Community Based Testing Site during the COVID 19 nationwide public health emergency.” This change in policy will have retroactive effect to March 13, 2020 and will remain in effect until HHS declares that the COVID-19 public health emergency is no longer in place.

While OCR is laxing its enforcement authority on covered entities and business associates who are participating in CBTS, providers are still required to implement reasonable safeguards when operating CBTS. Those reasonable safeguards include:

  1. Only using or disclosing the minimum PHI as necessary;
  2. Setting up canopies at the CBTS to provide some level of privacy to patients while samples are collected;
  3. Limiting traffic around the CBTS to create adequate distance at the point of service for a patient to minimize the possibility of an individual to see or overhear patient interactions;
  4. Establishing “buffer zones” to prevent members of the public or media the ability to observe or film patients while receiving screenings at CBTS. HHS specifically identifies posting signs prohibiting filming around a CBTS. 
  5. Using secure technology to store, record, and transmit ePHI at CBTS.
  6. Either post a Notice of Privacy Practice (NPP) on site, or information on how to find the NPP online.

This discretionary lift on penalties for HIPAA noncompliance for CBTS during the COVID 19 pandemic is just the most recent instance of HHS and OCR understanding that health providers need more options to adequately care for their patients during this unprecedented time. For more information on HIPAA, Civil Rights, and HHS/OCR’s response to COVID-19, please check out their webpage. We can expect to see more waivers like this, not only in HIPAA but also in other areas of health law, as we move deeper and deeper into this pandemic. 

If you would like to submit content or write an article for the Health Care & Life Sciences Section, please email Kara Sikorski at

Subscribe to Health Care & Life Sciences Section news here!


Indianapolis Bar Association (IndyBar) est. 1878 | 4,536 Members (as of 2.11.21)