The HHS Office for Civil Rights (OCR) issued two important bulletins this week regarding the novel coronavirus disease (COVID-19) outbreak. On Mar. 16, OCR issued a limited waiver of HIPAA sanctions and penalties for noncompliance with certain provisions of the HIPAA Privacy Rule, including the requirement to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care and the requirement to distribute a Notice of Privacy Practices to patients. Currently, the waiver applies only to those hospitals located in the emergency area identified in the public health emergency declaration that have instituted a disaster protocol, and then only for 72 hours from the time at which the disaster protocol was implemented. It is unclear if OCR will extend the time period for this waiver given the widespread and potentially prolonged nature of the COVID-19 outbreak. The bulletin also reminds providers that affirmative reporting to the media or the public about any identifiable patient may not be done without the written authorization of the patient or the patient’s personal representative. A copy of the bulletin can be found here.