Annex: Communications PlanI. Purpose, Scope, Situation, Hazard Vulnerability, Assumptions

A. Purpose

The purpose of this plan is to describe the routine and emergency communications capabilities, procedures, and assets used by [insert organization name] to communicate internally and externally, with health care recipients and families, related partner organizations and with the general public. Information is to be coordinated prior to release to ensure its accuracy, compliance with applicable laws and regulations, and consistency with organizational guidance.

B. Scope

This plan applies in general to all employees of the organization, but has particular applications to those who have communication-related responsibilities or functions during a response beyond just receipt of emergency communications.

C. Situation

Maine is a large, mostly rural state with a population of roughly 1.3 million residents. While the majority of these residents live in the more developed central and southern regions of the state, there is a considerable population in the northern rural areas. This, coupled with the state’s mountainous topography and minimal infrastructure, creates a number of communication challenges from a response perspective.

These challenges include: A lack of cellular coverage in rural areas that can negate the use of cellular

phones. Terrain features and a large geographic area that can inhibit radio

communications. Limited high-speed bandwidth availability in some areas that can prevent or

slow down access to web-based systems. Severe weather that can cause power outages. During a wide-scale incident communication systems will be stressed,

particularly cellular communications.

[Include details of organization and populations served that you would need to communicate with during an incident]

1

D. Hazard Vulnerability

This is an Annex of the Emergency Operations Plan which details the yearly conduct of a risk assessment, additional details can be found in the Emergency Operation Plan base plan. As mentioned above, there are several challenges that may occur to slow down or halt communications just when communications are needed most, during an incident response. Most incidents caused by hazards evaluated during the risk assessment process will require a robust communication system within the organization to make employees aware of actions they must take. Some hazards may also require communications of the organization so that citizens are aware of protective measures to be taken during an emergency in order to reduce the risk to our organization or if the incident requires additional resources that the organization cannot provide. During an emergency event, the need to disseminate accurate information to the public is essential. Accurate public information is necessary to keep people informed on what has happened and may/will happen. The information should address misinformation and provide information to assist the public in their planning.

E. Planning Assumptions

Multiple communication pathways will be required to ensure the highest level of visibility for messages that are sent.

Personnel will have access to multiple communication modalities (e-mail, text messaging, landline and cellular telephony, radios, etc.).

Messaging intended for employees will differ in subject matter and distribution method from messaging intended for public consumption.

Power loss or equipment failure can and will occur, reinforcing the need for redundant communications.

II. Concept of Operations

A. General

The communication functions carried out by the organization prior to and during an event are divided into four main categories: Staff, Patient and Visitor, External Organization, and Public Notifications.

Available means of communications include: [edit list as necessary] Telephone, Cellular Telephone, Pager, Electronic Mail, Voice Mail, Texts Telephone Recorded Messages, Online Web Page Postings, Twitter and Facebook

Postings

2

Satellite telephones, Very Small Aperture Terminal Communications Systems (Extended emergencies where all regular telephone service is non-functioning, cellular telephone service is disrupted, and satellite telephones need support)

Portable and Mobile Radios HAM radio Media, Radio/Television Relayed Messages Voice over Internet Protocol Phones

Certain key identified staff have Government Emergency Telecommunications System (GETS cards which allows the card holder priority access to phone lines with heavy traffic. [to enroll your organization: https://www.fcc.gov/general/government-emergency-telecommunications-service]

Certain key identified staff have Wireless Priority Service subscriptions [this is a fee service that is used in a crisis situation when the wireless network us congested https://www.dhs.gov/wireless-priority-service-wps]

Staff Notifications

Employees will be notified that the facility Emergency Operations Plan and Command Center has been activated and subsequently provided with information and instructions in the following manner. Please refer to Attachment A for an organizational phone list.

1. Notification will be made using telephone where immediate notification is necessary.

2. The facility mass notification computer based program will be used to transmit a message related to any emergency and the activation of the Command Center and Plan.

3. All employee electronic mail messages may be sent along with voice mail and text messages.

4. Telephone/Computer Outages – In the event that telephones and/or computers are not operational cellular telephones, pagers, satellite phones, and runners may be used.

5. Additional means of communication:a. Telephone message on the facility greeting phone message – or- pre-

determined emergency number for staff to call in to receive a pre-recorded message

b. Facility intranet homepagec. Radio and television media messagesd. Fact sheet prepared and forwarded to individual service linese. The [insert county name] Emergency Management Agency can provide

additional satellite phones and radios for communication purposes, as needed [Check with your county EMA offices before keeping this statement!]

3

f. HAM radio system may be activated, as needed, by the organization with additional assistance from the [insert county name] Emergency Management Agency [Check with your county EMA offices before keeping this statement!]

g. On duty staff may also be notified via runners

[Things to consider: Detail a notification system if you have it (Health Alert Network, Everbridge, Send

Word Now, One Call Now, etc.) Detail a phone tree if that’s what you’re using by department, etc. and place in an

appendix]

Patient and Visitor Notifications

1. Notification will be made by telephone2. Where phone service is disrupted cellular and satellite phones may be used.3. Additional means of communication:

a. Telephone message on the facility greeting telephone message, voice mail, and text messages

b. Facility internet home page messagec. Radio and television media messagesd. The [insert county name] Emergency Management Agency can provide

additional satellite phones and radios for communication purposes, as needed [Check with your county EMA offices before keeping this statement!]

e. Posting of signs at facility entrancesf. Overhead paging system

External Organization Notifications

Notifications to the health care coalition, local, county, and state governmental agencies, and suppliers of essential services, equipment and other items should occur whenever a facility emergency is more than a minor, totally self-contained event. If the emergency event may affect outside locations such notifications shall occur. Please refer to Attachment B for an external phone list.

1. Notification will be made using telephone where immediate notification is necessary.

2. Other means of communication that may be used are:a. Cellular telephone, pagers, satellite phonesb. Interoperable radio frequencies

4

c. The [insert county name] Emergency Management Agency can provide additional satellite phones and radios for communication purposes, as needed [Check with your county EMA offices before keeping this statement!]

d. Electronic mail messages, voice mails, text messages

[Note: Include names and contact information for other like-facilities. This would be a good time to discuss arrangements needed to be developed these facilities and providers to receive patients in the event of limitations of cessation of operations (does not apply to ambulatory surgical centers, home health agencies)]

Public and/or Media Notifications

Public notifications will be developed by the Public Information Officer and will be distributed only after approval from the incident commander. Switchboard operators will be instructed to forward any calls from the media to the Public Information Officer.

A fact sheet will be prepared that includes all known details that can be released publicly. Material developed to explain the crisis will be based on what is known about the crisis, will express empathy and caring early on, and will answer what the audiences affected by and those interested in the crisis will want to know. A copy of the fact sheet will be given to switchboard personnel and other key points of contact with the public and staff. Calls should be diverted to pre-identified staff members handling media, patient family members, and/or employees. Pre-scripted fact sheets for high-risk hazards or collected from real-world incidents are included in Attachment C.

Notifications will be made by:1. Telephone, cellular phone, voice mail, satellite phone2. Telephone interviews (Media)3. Facility internet postings4. New releases, news conferences, radio and television messages5. Telephone message on the facility greeting telephone message, voice mail, text

message

[Note: include information for your media contacts including phone and email. Also, consider specific plans with regards to where in your facility media will be directed to while awaiting information (do not want them roaming around facility), as well as considerations for locations to hold interviews.]

B. Hazard Control and Assessment

There is no way to control most disaster events; however it is important to prepare for the occurrence of disasters. [Organization name] prepares for disasters through collaborative planning and exercising, documenting Lessons Learned from

5

either exercises or real events, completing Improvement Plans and updating Response Plans to mitigate the effects of future disasters. Updates to plans or newly acquired equipment are then trained on, tested, and exercised again to further increase communication capabilities.

C. Protective Action

In the event that an emergency occurs or is anticipated a portion of the Command Center will be activated if deemed appropriate by the [insert title] that relates to preparing communication equipment for use, e.g. portable radios. Information Services will be notified to ensure they are aware of an emergency or pending emergency to check their communication related equipment. The [organization name] maintains communications within the facility by computer, telephones, cell phones, pagers and hand-held multi-channel radios [edit list as necessary]. Interoperable communications are available through telephones (conventional, IP, and cellular), email, GETS cards, and satellite phones [edit list as necessary]. HAM radio communication is provided by [external or internal staff – if external indicate how to request a HAM operator]. All communication is readily available for immediate use with the exception of HAM radio which would be operational in approximately [enter time] during off hours and [enter time] during normal business hours. Most means of communication would be sustainable for an indefinite period of time. Radio battery chargers could be connected to the facility’s generator. Appropriate personnel are available to train in the use of communication devices. [Organization name] has entered into a Memorandum of Understanding with the State of Maine for sharing of frequencies during an emergency (http://www.maine.gov/mema/communications/comm_conops.shtml) [If you need to develop this MOU contact Steve Mallory, MEMA, Steven.h.mallory@maine.gov]

D. Public Warning

The only authorized entity designated to speak with the media regarding the events surrounding an emergency or incident within the facility proper is the [Enter title] and Public Information Officer unless a subject matter expert is designated by the [insert title] or designee. The Incident Commander prior to release must approve messages developed by the Public Information Officer. If multiple organizations are affected by the same incident, Public Information Officers of each organization will collaborate via conference call with health care coalition partners to develop consistent messaging. Also, a designated spokesperson will be identified and assigned to a State and/or County Emergency Management Agency Joint Information Center, if necessary.

E. Protective Action Implementation

As communications protective actions are being implemented, the incident command staff must continuously monitor the actions. If initial protective action

6

activities are not successful, redundant or secondary communication systems will be implemented. The Public Information Officer or designees will be responsible for continuously monitoring the media for misinformation and will develop mitigation actions for implementation by the organization.

(This section should describe, in general, the capabilities and processes the division/department/program has in place to implement the range of protective actions that may be required for various hazards. The response activities listed below are examples of activities that may be required to implement protective actions in response to certain types of hazards. The following is sample language.)

1. Monitor progress of protective action implementation 2. Public information, guidance, directions3. Special populations information4. Clinician information, guidance

F. Short-term/Immediate Needs

(This section should describe, in general, the capabilities and processes the division/department/program has in place to address the short-term needs affecting the population as posed by the hazard. The response activities listed should be activities that may be required in the early stages after a disaster has occurred. These activities can help stabilize the division/department/program and the affected population.)

Examples of what you would need right away to implement the communications plan:Information Technology support (web-site, adjustment to telephone messages, computer needs, use of notification system)Security (radio)Labor Pool (runners within the facility to foster communication)Information sources – development of fact sheets which should be dated and time stamped to ensure the correct version is being usedHAM radio operatorsHave the needs been covered for every way to communicate listed in Section II

G. Long-term/Sustainment/Recovery Needs

(This section should describe, in general, the capabilities and processes the division/department/program has in place to restore the division/department/program and its affected population to a “normal” state.)

Examples, if the emergency goes on for multiple days or typical communication systems are damaged - who will be responsible for what in order to continue operations and lead recovery for the organization: RepairsPower

7

Requesting/receiving support from the community/response partnersReplacements of communications equipment

III. Organization and Assignment of Responsibilities

A. General

Most employees have emergency functions in addition to their normal, day-to-day duties. The emergency functions usually parallel or complement normal functions. Senior leadership of the organization will be the lead decision maker regarding communications within or outside of the organization until a time the incident command system is functioning.

B. Organization

Name of organization operates under the National Incident Management System’s Incident Command System and will follow its organization structure during the implementation of this annex.

The Incident Command System uses a defined chain of command, a common

language, common management sections, common functional response roles, and management by objectives. It has been established as the model for organizing and managing emergency personnel and resources in the management of many types of complex activities under emergency and non-emergency conditions.

C. Assignment of Responsibility

The department/programs involved in support of this communication annex will assume the following responsibilities within the framework of ICS:

(Primary and supporting emergency function responsibilities should be assigned to specific components of the organizations. The annex assigns general responsibilities for emergency functions during emergencies. These tasks should be clearly defined and assigned to the division/department/program component that has the capability to perform them. Coordination requirements should also be described. Each assignment of responsibilities list must be tailored for each particular division/department/program In order to be National Incident Management System (NIMS) compliant, this section should pre-designate functional area representatives to the command center. A simple statement indicating which component will send a representative to the command center upon activation of the annex will ensure that the annex is NIMS compliant.)

ExamplesPublic Information Officer = Media relations departmentIncident Commander = Administrator, CEO, Facilities Management

8

Logistics = Information Technology department, Facilities Management, Security (ex. assist with radios, etc. what personnel, supplies, and equipment will be needed)

D. Support Functions

If an incident overwhelms the response capabilities of the organization, additional support can be provided by the Central Maine Regional Health Care Coalition and/or [insert county name] County Emergency Management Agency. As both entities are regional response partners, requests for assistance will be shared to with the most appropriate entity to provide the resources needed. If either entity cannot provide the needed support they will reach out to their state counterparts for assistance. Assistance may also be sought directly from law enforcement and fire services. Please refer to Attachment B for appropriate contact information.

IV. Direction, Control and Coordination

A. Authority to Initiate Actions

The [insert title] is responsible for activating this Communications Plan annex.

B. Command Responsibility for Specific Actions

Incident Command System activation includes the following:

The Incident Commander will conduct ongoing situation and resource assessments; making activation/de-activation decisions; establishing objectives, priorities and policies during incident action planning meetings; and, ensuring coordination between operating units assigned under the Incident Command System. The Incident Commander must approve final release of information.

The Public Information Officer will coordinate and disseminate messaging using a variety of communication methods detailed above. Works with the Incident Commander, Incident Command staff, and subject matter experts to develop needed risk communication messages for the media and other modes of communication with the public and staff. During regional events will also take part in regional communication coordination and dissemination.

The Operations Section Chief will is responsible for managing the tactical operations for the organization. This information will be critical to formulate appropriate messaging for dissemination both internally and externally.

9

The Planning Section Chief will maintain the most up-to-date situational information and resource status for the organization. Dissemination of information can be in the form of an IAP and can be used to generate specific messaging to staff or generate information for the media.

The Logistic Section Chief helps make sure that there are adequate resources (personnel, supplies, and equipment) for meeting the incident objectives.

V. Information Collection and Dissemination

A. Disaster information is managed by the Planning Section personnel. These representatives collect information from inside and outside of the organization then record and distill that information to disseminate within the command center. This can be used to develop courses of action and manage emergency operations.

B. Release of Protected Health Information to Third Parties: The Privacy Act, Health Insurance Portability and Accountability Act (HIPAA) and organizational regulations govern the release of information concerning patients, employees of the organizations, and all others who are properly on the facility. These acts also identify exceptions allowing for the release of patient information and under what circumstances when patient names and/or deceased information is requested by another health care organization or to 3rd parties e.g. state health department, police, or other law enforcement agencies. Information concerning the death of a patient will not be released until after the next of kin has been notified. Please refer to Attachment D for further information.

[Note: Include a method for sharing information and medical documentation for patients. Long Term Care must document method in which you would release patient information consistent with the HIPPA Privacy Rule. Include HIPAA specific policies that pertain to your facility – also include instances of what you can share during an emergency]

VI. Communications

During an emergency event, communication is a major activity as sharing accurate and timely information is critical during an emergency. It is imperative to rapidly alert and notify employees, patients, visitors in order to update them on the situation, protect their health and safety, and facilitate provider-to-provider communication. Therefore, emergency communications must be able to be conducted by many modalities including computer, telephone, cellular telephone, hand held radios, satellite phones, and HAM radio [adjust listing as necessary].

10

VII. Administration, Finance and Logistics

A. Administration

The Planning Section Chief is responsible for collecting and compiling event documentation including the Incident Action Plans and completed ICS forms. These official records serve to document the response and recovery process of the organization and provide an historical record as well as form the basis for cost recovery, identification of insurance needs, and will guide mitigation strategies.

B. Finance

Each department head will submit reports/ledgers to the Finance Section Chief relating to their department’s expenditures and obligations during the emergency situation. Documentation should also be collected regarding the use of external resources for the determination of potential reimbursements. Original documents will then be forwarded to the Planning Section Chief for the official record. A financial report will be compiled, analyzed and submitted for possible reimbursement following the event.

C. Logistics

Once incident objectives are set the Logistics Section Chief will be responsible for supporting implementation of this annex by supplying the requested resources. Critical vendors to carry out this annex are included in Attachment B, External Phone List.

VIII. Annex Development and Maintenance

A. Development and Maintenance

This annex will be reviewed by yearly and revised as needed once an agreed upon version is reached. Lessons learned as they emerge from After Action Report/ Improvement Plans following real events or planned training exercises will be incorporated into the annex.

IX. Authorities and References

A. Legal Authority

Federal

11

Sections 319C-1 and 319C-2 of the Public Health Service (PHS) Act as amended by the Pandemic and All-Hazards Preparedness Act (PAHPA). (P.L. 109-417) (2013)

Presidential Policy Directive (PPD) 8: National Preparedness Homeland Security Directives (HSPD) 5 and 21 U.S. Department of Health and Human Services, Office of the Assistant Secretary

for Preparedness and Response, “Medical Surge Capacity and Capability: A Management System for Integrating Medical and Health Resources during Large-Scale Emergencies.” Accessed December 10, 2015 at: http://www.phe.gov/Preparedness/planning/mscc/healthcarecoalition/Pages/executivesummary.aspx.

State

Title 22: HEALTH AND WELFARE Subtitle 2: HEALTH Part 3: PUBLIC HEALTH HEADING: PL 1989, C. 487, §11 (RPR); Chapter 250: CONTROL OF NOTIFIABLE DISEASES AND CONDITIONS HEADING: PL 1989, C. 487, §11 (RPR); 2005, C. 383, §1 (RPR)

Chapter 634, S.P. 789, L.D. 2044, “An Act to Enhance the Protection of Maine’s Families from Terrorism and Natural Disasters”

B. References

Maine CDC All Hazards Emergency Operations Plan, 2014 US CDC, Public Health Emergency Preparedness Capabilities, March 2011 FEMA EOP ANNEX Template, 2009 VA Maine Healthcare System, Comprehensive Emergency Management Plan,

January 2017

X. Attachments

A. Organizational Phone ListB. External Phone ListC. Public and/or Media Pre-scripted Messages [Fact Sheets]D. November 2014 U.S. Department of Health and Human Services, Office for Civil

Rights BULLETIN: HIPAA Privacy in Emergency Situations

12

A. Organizational Phone List

13

B. External Phone List

Organization Phone NumberAndroscoggin Emergency Management Agency 207-784-0147Franklin County Emergency Management Agency 207-778-5892Kennebec County Emergency Management Agency 207-623-8407Oxford Count y Emergency Management Agency 207-743-6336Central Maine Regional Health Care Coalition 207-558-5999[Insert like community organizations][Insert local fire department][Insert local law enforcement or sheriff’s office][Insert vendor information]

STATEMaine Emergency Management Agency 207-624-4400Maine Center for Disease Control and Prevention Disease Reporting Line

800-821-5821

FEDERALFederal Bureau of Investigation Augusta – 207-622-2902

Boston – 617-742-5533Occupational Safety and Health Administration DC – 800-321-6742

Boston – 617-565-9860U.S. Centers for Disease Control and Prevention 404-639-3311

770-488-7100U.S. Environmental Protection Agency Boston -617-918-1111

DC – 222-272-0167

14

C. Public and/or Media Pre-scripted Messages [Fact Sheets]

15

D. November 2014 U.S. Department of Health and Human Services, Office for Civil Rights BULLETIN: HIPAA Privacy in Emergency Situations

16

November 2014 U.S. Department of Health and Human Services, Office for Civil Rights BULLETIN: HIPAA Privacy in Emergency Situations In light of the Ebola outbreak and other events, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), is providing this bulletin to ensure that HIPAA covered entities and their business associates are aware of the ways in which patient information may be shared under the HIPAA Privacy Rule in an emergency situation, and to serve as a reminder that the protections of the Privacy Rule are not set aside during an emergency.

The HIPAA Privacy Rule protects the privacy of patients’ health information (protected health information) but is balanced to ensure that appropriate uses and disclosures of the information still may be made when necessary to treat a patient, to protect the nation’s public health, and for other critical purposes.

Sharing Patient Information

Treatment Under the Privacy Rule, covered entities may disclose, without a patient’s authorization, protected health information about the patient as necessary to treat the patient or to treat a different patient. Treatment includes the coordination or management of health care and related services by one or more health care providers and others, consultation between providers, and the referral of patients for treatment. See 45 CFR §§ 164.502(a)(1)(ii), 164.506(c), and the definition of “treatment” at 164.501.

Public Health Activities The HIPAA Privacy Rule recognizes the legitimate need for public health authorities and others responsible for ensuring public health and safety to have access to protected health information that is necessary to carry out their public health mission. Therefore, the Privacy Rule permits covered entities to disclose needed protected health information without individual authorization:

• To a public health authority, such as the Centers for Disease Control and Prevention (CDC) or a state or local health department, that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability. This would include, for example, the reporting of disease or injury; reporting vital events, such as births or deaths; and conducting public health surveillance, investigations, or interventions. A “public health authority” is an agency or authority of the United States government, a State, a territory, a political subdivision of a State or territory, or Indian tribe that is responsible for public health matters as part of its official mandate, as well as a person or entity acting under a grant of authority from, or under a contract with, a public health agency. See 45 CFR §§ 164.501 and 164.512(b)(1)(i). For example, a covered entity may disclose to the CDC protected health information on an ongoing basis as needed to report all prior and prospective cases of patients exposed to or suspected or confirmed to have Ebola virus disease.

• At the direction of a public health authority, to a foreign government agency that is acting in collaboration with the public health authority. See 45 CFR 164.512(b)(1)(i).

17

• To persons at risk of contracting or spreading a disease or condition if other law, such as state law, authorizes the covered entity to notify such persons as necessary to prevent or control the spread of the disease or otherwise to carry out public health interventions or investigations. See 45 CFR 164.512(b)(1)(iv).

Disclosures to Family, Friends, and Others Involved in an Individual’s Care and for Notification a covered entity may share protected health information with a patient’s family members, relatives, friends, or other persons identified by the patient as involved in the patient’s care. A covered entity also may share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death. This may include, where necessary to notify family members and others, the police, the press, or the public at large. See 45 CFR 164.510(b).

• The covered entity should get verbal permission from individuals or otherwise be able to reasonably infer that the patient does not object, when possible; if the individual is incapacitated or not available, covered entities may share information for these purposes if, in their professional judgment, doing so is in the patient’s best interest.

• In addition, a covered entity may share protected health information with disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts, for the purpose of coordinating the notification of family members or other persons involved in the patient’s care, of the patient’s location, general condition, or death. It is unnecessary to obtain a patient’s permission to share the information in this situation if doing so would interfere with the organization’s ability to respond to the emergency.

Imminent Danger Health care providers may share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public – consistent with applicable law (such as state statutes, regulations, or case law) and the provider’s standards of ethical conduct. See 45 CFR 164.512(j).

Disclosures to the Media or Others Not Involved in the Care of the Patient/Notification Upon request for information about a particular patient by name, a hospital or other health care facility may release limited facility directory information to acknowledge an individual is a patient at the facility and provide basic information about the patient’s condition in general terms (e.g., critical or stable, deceased, or treated and released) if the patient has not objected to or restricted the release of such information or, if the patient is incapacitated, if the disclosure is believed to be in the best interest of the patient and is consistent with any prior expressed preferences of the patient. See 45 CFR 164.510(a). In general, except in the limited circumstances described elsewhere in this Bulletin, affirmative reporting to the media or the public at large about an identifiable patient, or the disclosure to the public or media of specific information about treatment of an identifiable patient, such as specific tests, test results or details of a patient’s illness, may not be done without the patient’s written authorization (or the written authorization of a personal representative who is a person legally authorized to make health care decisions for the patient). See 45 CFR 164.508 for the requirements for a HIPAA authorization.

Minimum Necessary For most disclosures, a covered entity must make reasonable efforts to limit the information disclosed to that which is the “minimum necessary” to accomplish the purpose. (Minimum necessary requirements do not apply to disclosures to health care providers for treatment purposes.) Covered entities may rely on representations from a public health authority or other public official that

18

the requested information is the minimum necessary for the purpose. For example, a covered entity may rely on representations from the CDC that the protected health information requested by the CDC about all patients exposed to or suspected or confirmed to have Ebola virus disease is the minimum necessary for the public health purpose. Internally, covered entities should continue to apply their role-based access policies to limit access to protected health information to only those workforce members who need it to carry out their duties. See 45 CFR §§ 164.502(b), 164.514(d).

Business Associates A business associate of a covered entity (including a business associate that is a subcontractor) may make disclosures permitted by the Privacy Rule, such as to a public health authority, on behalf of a covered entity or another business associate to the extent authorized by its business associate agreement.

Safeguarding Patient Information

In an emergency situation, covered entities must continue to implement reasonable safeguards to protect patient information against intentional or unintentional impermissible uses and disclosures. Further, covered entities (and their business associates) must apply the administrative, physical, and technical safeguards of the HIPAA Security Rule to electronic protected health information.

Other Information

Limited Waiver The HIPAA Privacy Rule is not suspended during a public health or other emergency; however, the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act. If the President declares an emergency or disaster and the Secretary declares a public health emergency, the Secretary may waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the HIPAA Privacy Rule:

• the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).

• the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a). • the requirement to distribute a notice of privacy practices. See 45 CFR 164.520. • the patient's right to request privacy restrictions. See 45 CFR 164.522(a). • the patient's right to request confidential communications. See 45 CFR 164.522(b).

If the Secretary issues such a waiver, it only applies: (1) in the emergency area and for the emergency period identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol. When the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol.

HIPAA Applies Only to Covered Entities and Business Associates The HIPAA Privacy Rule applies to disclosures made by employees, volunteers, and other members of a covered entity’s or business associate’s workforce. Covered entities are health plans, health care clearinghouses, and those health care providers that conduct one or more covered health care transactions electronically, such as transmitting health care claims to a health plan. Business associates generally are persons or entities

19

(other than members of the workforce of a covered entity) that perform functions or activities on behalf of, or provide certain services to, a covered entity that involve creating, receiving, maintaining, or transmitting protected health information. Business associates also include subcontractors that create, receive, maintain, or transmit protected health information on behalf of another business associate. The Privacy Rule does not apply to disclosures made by entities or other persons who are not covered entities or business associates (although such persons or entities are free to follow the standards on a voluntary basis if desired). There may be other state or federal rules that apply.

Other Resources For more information on HIPAA and Public Health, please visit: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/publichealth/index.html For more information on HIPAA and Emergency Preparedness and Response, please visit: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/index.html General information on understanding the HIPAA Privacy Rule may be found at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html

20