The U.S. Department of Health and Human Service’s Office of Civil Rights (“OCR”) has announced that several notifications of enforcement discretion issued during the COVID-19 public health emergency (“PHE”) will expire concurrently with the expiration of the PHE on May 11, 2023 at 11:59 PM. OCR originally issued guidance in March 2020, April 2020, and December 2020 explaining how it would apply enforcement discretion and not enforce penalties as they related to violations of Privacy, Security, and Breach Notification Rules promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA Rules”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Both arose from certain activities related to the COVID-19 PHE.
