In late March 2020, OCR also issued guidance on when protected health information of a person infected with COVID-19 may be shared with law enforcement, paramedics, and other first responders and public health authorities without the person’s authorization. OCR noted that such info may be shared in certain circumstances, including:

  • When the disclosure is necessary to provide treatment.
  • When the notification is required by law.
  • To notify a public health authority in order to prevent or control the spread of disease.
  • When first responders may be at a risk of infection.
  • When the disclosure is necessary to prevent or lessen a serious and imminent threat to the health and safety of the public.
  • When responding to a request for protected health information by a correctional institution or law enforcement official having lawful custody or an inmate or other individual.

In mid-March, the OCR announced that it would exercise its enforcement discretion and waive penalties for HIPAA violations regarding telehealth remote communications. Recognizing that practitioners will have to meet with patients in unexpected ways during this time, such as FaceTime, Skype, and Zoom, OCR is allowing audio or video communication technology, even if it doesn’t fully comply with HIPAA rules, as long as it is used in good faith. 

According to OCR’s website, “covered healthcare providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 nationwide public health emergency. Providers are encouraged to notify patients that these third-party applications potentially introduce privacy risks, and providers should enable all available encryption and privacy modes when using such applications.”


Humans are litigious by nature, and it is sadly likely that lawsuits will ensue following this crisis. However, between federal and state protections for healthcare workers, hospital mandates against elective surgery, and relaxed HIPAA enforcement, it is likely that healthcare practitioners are not in great danger of liability.