Authority
Section 1135 of the Social Security Act [42 USC §1320b–5] permits the Secretary of Health and Human Services to waive certain regulatory requirements for healthcare facilities in response to emergencies. Two conditions must be met for the Secretary to be able to issue such “1135 waivers”: first, the Secretary must have declared a Public Health Emergency; second, the President must have declared a National Emergency either through a Stafford Act Declaration or National Emergencies act Declaration. If these conditions are met, then healthcare facilities may petition for 1135 waivers in response to particular needs, and only within the geographic and temporal limits of the emergency declarations.
Under Section 1135:
The Secretary may tailor authorities granted under Section 1135 waivers to match the specific situational needs, but the requirements that may be waived include those related to Medicare, Medicaid or the Children’s Health Insurance Program (CHIP), the Emergency Medical Treatment and Active Labor Act (EMTALA), and the Health Insurance Portability and Accountability Act (HIPAA). These requirements provide important protections for patients during normal day-to-day operations, but they may impede the ability of healthcare facilities to fully implement disaster operations plans that enable appropriate care during emergencies. For example, requirements under the Emergency Medical Treatment and Active Labor Act (EMTALA) would prohibit hospitals from certain rapid triage or sorting activities and prevent the establishment of off-site, alternate care facilities that could off-load emergency department demand.
- Waivers are permitted only to the extent they ensure that sufficient health care items and services are available to meet the needs of Medicare, Medicaid, and CHIP beneficiaries in the emergency area during the emergency period. The “emergency area” and the “emergency period” are the geographic area, in which, and the time period, during which, the dual declarations exist.
- Permitted actions include the waiver or modification of conditions of participation, other certification requirements, program participation requirements, pre-approval requirements for health care providers; waiver of sanctions for certain directions or relocations and transfers that otherwise would violate the Emergency Medical Treatment and Labor Act (EMTALA); waiver of sanctions related to Stark self-referral prohibitions; modifications to deadlines and timetables for the performance of required activities; and waiver of sanctions and penalties arising from noncompliance with certain Health Insurance Portability and Accountability Act (HIPAA) privacy regulations.
Examples of use of waivers:
- Hospitals request to set up an alternative screening location for patients away from the hospital’s main campus (requiring waiver of the Emergency Medical Treatment and Labor Act-EMTALA)
- Hospitals request to facilitate transfer of patients between ERs and inpatient wards between hospitals (requiring waiver of both EMTALA and HIPAA regulations)
- Critical Access Hospitals requesting waiver of 42 CFR 485.620, which requires a 25-bed limit and average patient stays less than 96 hours
- Skilled Nursing Facilities requesting a waiver of 42 CFR 483.5, which requires CMS approval prior to increasing the number of certified beds in a distinct part
Past instances where authority to grant Section 1135 waivers was enabled for recent disaster events include
- Hurricane Katrina (2005)
- 56th Presidential Inauguration (2009)
- Hurricanes Ike and Gustav (2008)
- North Dakota flooding (2009)
Q: Why do this now; why can’t we wait until a hospital or region needs these 1135 Waivers?
A: The H1N1 epidemic is moving rapidly. By the time regions or healthcare systems recognize they are becoming overburdened, they need to implement disaster plans quickly. 1135 Waivers still require specific requests be submitted to HHS and processed, and some State laws may need to be addressed as well. Adding a potential delay while waiting for a National Emergency Declaration is not in the best interest of the public, particularly if this step can be done proactively as the President has done today.
Q: Has the authority to grant 1135 waivers been granted before?
A: Yes, there are several instances where 1135 Waiver authority has been granted under the Stafford Disaster Relief and Emergency Assistance Act (vice National Emergencies Act) to help healthcare facilities cope with large patient burdens. Recent examples include Hurricane Katrina (2005), Hurricanes Ike and Gustav (2008), and the North Dakota flooding (2009). In addition, 1135 waiver authority has been granted previously as a precautionary measure, as in the case of the recent 56th Presidential Inauguration (2009).
Q: Specifically, what will this NEA Declaration enable and what will this allow hospitals to do, if a waiver is requested and granted?
A: An NEA Declaration fulfills the second of the two conditions required for the Secretary of HHS to be able to grant 1135 waivers. If requested, and HHS grants an 1135 waiver, healthcare facilities will be able to utilize alternate care sites, modified patient triage protocols, patient transfer procedures, and other actions that occur when they fully implement disaster operations plans.
Q: Is the HIPAA Privacy Rule suspended during a national or public health emergency?
A (from the HHS Office for Civil Rights website): No; however, the Secretary of HHS may waive certain provisions of the Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.
What provisions may be waived
If the President declares an emergency or disaster and the Secretary declares a public health emergency, the Secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the HIPAA Privacy Rule:
- the requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care (45 CFR 164.510(b))
- the requirement to honor a request to opt out of the facility directory (45 CFR 164.510(a))
- the requirement to distribute a notice of privacy practices (45 CFR 164.520)
- the patient’s right to request privacy restrictions (45 CFR 164.522(a))
- the patient’s right to request confidential communications (45 CFR 164.522(b))
When and to what entities does the waiver apply
If the Secretary issues such a waiver, it only applies:
1. In the emergency area and for the emergency period identified in the public health emergency declaration.
2. To hospitals that have instituted a disaster protocol. The waiver would apply to all patients at such hospitals.
3. For up to 72 hours from the time the hospital implements its disaster protocol.
When the Presidential or Secretarial declaration terminates, a hospital must then comply with all the requirements of the Privacy Rule for any patient still under its care, even if 72 hours has not elapsed since implementation of its disaster protocol.
Regardless of the activation of an emergency waiver, the HIPAA Privacy Rule permits disclosures for treatment purposes and certain disclosures to disaster relief organizations. For instance, the Privacy Rule allows covered entities to share patient information with the American Red Cross so it can notify family members of the patient’s location. See 45 CFR 164.510(b)(4).
Learn More: * See http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/katrinanhipaa.pdf for information on sharing information in emergency situations.