How Section 1135 Waivers Work During a Public Health Emergency

Section 1135 waivers are temporary suspensions of certain Medicare, Medicaid, and Children’s Health Insurance Program rules that the Secretary of Health and Human Services can issue during a declared public health emergency. Each waiver runs for up to 60 days, applies only inside the geographic area covered by the emergency declaration, and lets hospitals, clinics, and other providers keep delivering care and receiving federal reimbursement when following every regulation to the letter would be impossible or unsafe.¹

What Has To Happen Before a Waiver Can Exist

Two federal declarations must be active at the same time. The President must declare an emergency or major disaster under either the Stafford Act or the National Emergencies Act, and the Secretary of Health and Human Services must separately declare a public health emergency under Section 319 of the Public Health Service Act.¹ One alone is not enough. Both must overlap in time before the Secretary gains any waiver authority.

They also have to overlap in place. The statute defines the “emergency area” as the region where both declarations apply.² A hurricane declaration for three coastal counties does not create statewide relief. A nationwide pandemic can cover the entire country. CMS has used this authority for events ranging from COVID-19 to Hurricane Helene in 2024.³

What Can Actually Be Waived

The Secretary’s power is limited to seven categories. Anything outside these categories stays in full force during the emergency.²

Conditions of participation and certification, including the health and safety standards providers must meet to receive federal funding, along with program enrollment and pre-approval requirements.
State licensure for reimbursement purposes, provided the practitioner holds an equivalent license in another state and has not been excluded from practice in any state within the emergency area.
Certain EMTALA obligations, including redirecting patients to alternative screening locations under a state emergency plan and transferring unstable patients when the emergency itself makes the transfer necessary.
Sanctions for physician self-referrals that would otherwise violate the Stark Law.
Filing deadlines and timetables for cost reports, quality data, and other administrative submissions. These can only be pushed back, not eliminated.
Medicare Advantage payment limits on care delivered by out-of-network providers to enrollees.
Penalties for three specific HIPAA privacy practices: not obtaining a patient’s agreement before speaking with family members, not distributing a privacy notice, and not honoring requests for privacy restrictions or confidential communications.

How the Categories Play Out in Practice

The bed-capacity and conditions-of-participation waivers let hospitals exceed their licensed bed count and adjust staffing or physical environment requirements to handle a surge without losing Medicare certification. Critical Access Hospitals, which normally face a 25-bed limit and a 96-hour average length-of-stay rule, can operate outside both restrictions under a blanket waiver, so patients do not have to be transferred out of small rural facilities when transport itself is unsafe.⁴

The state licensure waiver is the one that catches practitioners off guard. It applies only to federal reimbursement. State law still controls whether a provider is legally authorized to practice inside that state’s borders.⁴ A clinician crossing state lines to help with a disaster still needs to check whether the destination state has issued its own emergency licensure provisions. The federal waiver on its own does not authorize practice.

Stark Law relief suspends the penalties for self-referrals but does not eliminate the underlying reporting obligations, so referral relationships still need to be documented.⁴ The HIPAA relief is narrow. It touches three specific practices only. The broader HIPAA Security Rule and the rest of the Privacy Rule remain fully in effect. And deadline relief means later, not gone; the paperwork still comes due.²

How Long a Waiver Lasts

A Section 1135 waiver ends at whichever comes first: the end of the presidential emergency declaration, the end of the HHS public health emergency declaration, or 60 days after the waiver was first published. The Secretary can extend the 60-day window in additional 60-day increments as long as both underlying declarations remain active, with each extension requiring a separate notice.² The moment either declaration ends, no number of extensions keeps the waiver alive.

The Secretary can also make a waiver retroactive to the start of the emergency period or any later date within it.⁵ That matters when providers had to change operations for patient safety before the formal waiver paperwork caught up. During Hurricane Helene, the waiver authority took effect on September 28, 2024, but was applied retroactively to September 25.³

Blanket Waivers vs. Individual Requests

CMS can issue blanket waivers that automatically cover every similarly situated provider in the emergency area. No application is needed when a blanket waiver covers the situation.⁶ Blanket waivers are common for widespread problems that hit an entire class of providers, and past examples have included the Critical Access Hospital bed and stay limits, EMTALA screening for patient redirection, and lifting bed-capacity restrictions for hospitals operating under their disaster plans.⁴

Individual requests are only necessary when a facility’s specific situation falls outside what any blanket waiver addresses. Checking the blanket waiver list first is worth the few minutes it takes, because submitting an unnecessary individual request wastes time clinical staff usually cannot spare.

Submitting an Individual Request

When no blanket waiver covers the need, the provider submits an individual request through the CMS online portal.⁷ Requests can also go to the State Survey Agency or the relevant CMS Regional Office, though the portal is the primary channel.

Each request needs the provider’s legal name, National Provider Identifier, and the physical address of the affected facility.¹ Beyond those basics, it has to name the specific regulation the provider needs relief from and explain why the emergency makes compliance impossible or dangerous. Vague justifications slow the process down. The strongest requests connect the disaster’s impact on the facility to the number of patients affected and the concrete risk that following the standard rule would create.

The portal issues a confirmation number that anchors all follow-up correspondence. CMS uses a cross-regional Waiver Validation Team to review each request. Decisions and follow-up questions come to the email address registered during submission, and approval or denial letters spell out the exact scope of relief granted and its expiration date.

The Good Faith Line and What Documentation To Keep

Section 1135 protects providers who deliver care in good faith during the emergency period, allowing reimbursement for services and shielding them from the sanctions that would normally apply to regulatory violations. The protection disappears entirely when there is a determination of fraud or abuse.¹ “Good faith” is not defined with precision in the statute, but the working test is straightforward: the deviation from normal rules has to be genuinely driven by the emergency, not by an opportunity to profit from relaxed oversight. A hospital that exceeds bed capacity for a real surge is protected. A facility billing for services that were never medically necessary is not.

Waivers relax compliance rules. They do not relax record-keeping. Documentation is often the only thing between a provider and a fraud allegation years after the emergency ends, and the HHS Office of Inspector General looks at whether arrangements were in signed written agreements, whether payments reflected fair market value, whether services were medically necessary, whether the same costs were reimbursed through other funding, and whether any arrangement was tied to referral volume.⁸

When the Waivers End

Once the trigger conditions disappear, every waived requirement snaps back into full effect. There is no built-in grace period. Care delivered after the waiver terminates is judged against the full, unmodified regulatory framework, even if the facility is still dealing with damage on the ground.

Emergencies rarely end cleanly. The formal end date of the declarations may not line up with conditions at the facility, so providers need to watch CMS communications as the emergency winds down. Anyone who took advantage of deadline extensions should build a calendar of deferred obligations well before the emergency period closes, because the backlog of cost reports, quality submissions, and other filings all comes due in short order once the waivers expire.

1
Centers for Medicare & Medicaid Services. 1135 Waivers
2
Office of the Law Revision Counsel. 42 USC 1320b-5 – Authority to Waive Requirements During National Emergencies
3
Medicaid.gov. Section 1135 Waiver Flexibilities – North Carolina 2024 Hurricane
4
Centers for Medicare & Medicaid Services. 1135 Waiver at a Glance
5
Social Security Administration. Social Security Act 1135 – Authority to Waive Requirements During National Emergencies
6
Centers for Medicare & Medicaid Services. Coronavirus Waivers
7
Centers for Medicare & Medicaid Services. CMS Launches Automated Web Tool for 1135 Waiver Requests and Public Health Emergency-Related Inquiries
8
Office of Inspector General. HHS-OIG’s Oversight of COVID-19 Response and Recovery Authorities Frequently Asked Questions