Emergency Response — Corrective action / RA
Resolution —
Penalty
Corrective action / RA
Action type
Resolution agreement
Entity profile
CA
Case number
—
What went wrong
Emergency Response
- Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process En
Full description
Navigate to: HIPAA for Professionals Regulatory Initiatives Privacy Summary of the Privacy Rule Guidance Combined Text of All Rules HIPAA Related Links Security Security Rule NPRM Summary of the Security Rule Security Guidance Cyber Security Guidance Breach Notification Breach Reporting Guidance Reports to Congress Regulation History Compliance & Enforcement Enforcement Rule Enforcement Process Enforcement Data Resolution Agreements Case Examples Audit Reports to Congress State Attorneys General Special Topics Parental Access Mental and Behavioral Health Change Healthcare Cybersecurity Incident FAQs HIPAA and COVID-19 HIPAA and Reproductive Health HIPAA and Final Rule Notice HIPAA and Telehealth HIPAA and FERPA Research Public Health Emergency Response Health Information Technology Health Apps Patient Safety Covered Entities & Business Associates Business Associate Contracts Business Associates Training & Resources FAQs for Professionals Other Administrative Simplification Rules Substance Use Disorder Confidentiality Emergency Situations: Preparedness, Planning, and Response The Privacy Rule protects individually identifiable health information from unauthorized or impermissible uses and disclosures. The Rule is carefully designed to protect the privacy of health information, while allowing important health care communications to occur. These pages address the release of protected health information for planning or response activities in emergency situations. In addition, please view the Civil Rights Emergency Preparedness page to learn how nondiscrimination laws apply during an emergency.COVID-19 and HIPAADuring the COVID-19 national emergency, which also constitutes a nationwide public health emergency, the HHS Office for Civil Rights (OCR) has provided guidance that helps explain how the HIPAA Privacy Rule allows patient information to be shared in the outbreak of infectious disease and to assist patients in receiving the care they need.Click to access guidance on HIPAA flexibility during the COVID-19 emergencyPlanningAccess an interactive decision tool designed to assist emergency preparedness and recovery planners in determining how to gain access to and use health information about persons with disabilities or others consistent with the Privacy Rule.The tool guides the user through a series of questions to find out how the Privacy Rule would apply in specific situations. By helping users focus on key Privacy Rule issues, the tool helps users appropriately obtain health information for their public safety activities.The tool is designed for covered entities as well as emergency preparedness and recovery planners at the local, state and federal levels.Emergency Preparedness Planning and the Privacy Rule:Press Release: HHS Announces New HIPAA Privacy Decision Tool for Emergency Preparedness PlanningHIPAA Privacy Rule: Disclosures for Emergency Preparedness - A Decision ToolNorma de Privacidad de la ley HIPAA: Divulgación de Información para Fines de Preparación en Casos de Emergencia – Una Herramienta Para la Toma de DecisionesResponseIn this section, access guidance about sharing patient information under the Privacy Rule in emergency situations, such as to assist patients in receiving the care they need, as well as to assist in disaster relief, public health, and law enforcement efforts.2025 Public Health Emergency for Washington in Response to Consequences of Severe Storms, Straight-Line Winds, Flooding, Landslides, and Mudslides2025 Public Health Emergency for Texas in Response to Consequences of Severe Storms, Straight-Line Winds, and Flooding2025 Public Health Emergency for CA in Response to Wildfires and Straight-Line Winds2024 Public Health Emergency for FL in Response to Hurricane Milton2024 Public Health Emergency for SC and TN in Response to Hurricane Helene2024 Public Health Emergency for NC in Response to Hurricane Helene2024 Public Health Emergency for GA in Response to Hurricane Helene2024 Public Health Emergency for FL in Response to Hurricane Helene2024 Public Health Emergency for LA in Response to Hurricane Francine2024 Public Health Emergency for FL, GA and SC in Response to Hurricane Debby2024 Public Health Emergency for Texas in Response to Hurricane Beryl*2023 Public Health Emergency for Georgia in Response to Hurricane Idalia*2023 Public Health Emergency for Florida in Response to Hurricane Idalia*2023 Hawaii Wildfires Bulletin*2023 Typhoon Mawar – Guam*2023 Mississippi Severe Storms, Straight-Line Winds, and Tornadoes Bulletin*2022 Hurricane Ian - South Carolina2022 Hurricane Ian - Florida2022 Hurricane Fiona2022 Kentucky Flooding Bulletin2022 New Mexico Wildfires and Straight-Line Winds Bulletin2021 Hurricane Ida Bulletin2021 Texas Winter Storm Bulletin2020 Oregon Wildfires BulletinAugust 2020 Hurricane Laura Bulletin2020 California Wildfires BulletinMarch 2020 HIPAA and COVID-19 BulletinMarzo de 2020 Boletín informativo sobre el COVID-19 y la Ley HIPAAFebruary 2020 HIPAA and Novel CoronavirusFebrero de 2020: la Norma de Privacidad de la ley HIPAA y el nuevo coronavirusJanuary 2020 Puerto Rico Earthquakes BulletinTerremotos en Puerto Rico de enero de 2020September 2019 Hurricane Dorian BulletinJuly 2019 Tropical Storm Barry BulletinOctober 2018 Super Typhoon Yutu BulletinOctober 2018 Hurricane Michael BulletinSeptember 2018 Hurricane Florence BulletinOctober 2017 California Wildfires BulletinLos Huracanes y la Ley HIPAA [September 2017]September 2017 Hurrican Maria BulletinSeptember 2017 Hurricane Irma BulletinAugust 2017 Hurricane Harvey BulletinNovember 2014 Bulletin: HIPAA Privacy in Emergency Situations September 2013 HIPAA Guide for Law Enforcement Norma de Privacidad de la Ley de Responsabilidad y Movilidad del Seguro de Salud: Guía para órganos del orden públicoSeptember 2005 Hurricane Katrina BulletinsDisclosing PHI in Emergency Situations Compliance Guidance and Enforcement Statement Disclosures to Public Health AuthoritiesCuándo las entidades cubiertas por la Ley HIPAA pueden entregar información de salud protegida a las autoridades de salud públicaPublic Health Authority Disclosure Request ChecklistLey HIPAA: Lista de verificación para solicitud de divulgación de información por parte de una autoridad de salud públicaWaiversIf the President declares an emergency or disaster and the Secretary of HHS declares a public health emergency, the Secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the Privacy Rule. The Privacy Rule remains in effect. The waivers are limited and apply only for limited periods of time.Frequently Asked Question: HIPAA waiver during a national or public health emergency¿La Norma de Privacidad de la Ley HIPAA se suspende durante una emergencia de salud pública o nacional?* People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing OCRMail@hhs.gov.Back to Top Content last reviewed December 23, 2025
Timeline
- Resolution—
- Incident and investigation milestones are not consistently published by OCR in machine-readable form.
Key takeaways for your organization
- Treat internet-facing systems and vendor-hosted environments as in-scope for HIPAA risk analysis and technical safeguards testing.
- Maintain an actionable risk analysis tied to remediation milestones; evidence should map to Security Rule implementation specifications.
- Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
- Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
Related actions
Source
U.S. Department of Health and Human Services release
Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use — not legal advice.