HHS enforcement discretion is a formal decision by the HHS Office for Civil Rights to temporarily hold off on penalties for certain HIPAA violations while a public health emergency is active, provided the healthcare provider is acting in good faith to deliver care. It does not rewrite HIPAA or create new legal rights. It tells providers, in writing, which technical requirements OCR will not enforce during the crisis and what conditions apply. COVID-19 produced the broadest use of this authority, but OCR has issued similar notices during hurricanes, wildfires, and other disasters.
The key word is discretion, not waiver. HIPAA stays fully intact. Any conduct outside the stated conditions remains enforceable throughout, and the underlying rules snap back into full force the moment the discretion period ends.
How Enforcement Discretion Gets Triggered
Enforcement discretion typically follows a formal declaration by the Secretary of HHS under Section 319 of the Public Health Service Act. That statute lets the Secretary recognize that a disease or public health crisis requires an emergency federal response, including grants, contracts, and investigations into treatment or prevention of the underlying threat.1Office of the Law Revision Counsel. 42 USC 247d – Public Health Emergencies With that declaration in place, OCR can issue a notice explaining which HIPAA requirements it will not enforce and under what conditions.
Every notice sets boundaries. OCR specifies which rules are covered, which entities qualify, and what good faith looks like in context. A provider who reads the notice and follows its terms gets protection. A provider who ignores the conditions or exploits the emergency for other purposes does not.
Which HIPAA Penalties Get Paused
Under normal circumstances, HIPAA violations carry civil monetary penalties across four tiers based on the level of fault. The 2026 inflation-adjusted amounts are:2Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- Tier 1, did not know: $145 to $73,011 per violation
- Tier 2, reasonable cause: $1,461 to $73,011 per violation
- Tier 3, willful neglect corrected within 30 days: $14,602 to $73,011 per violation
- Tier 4, willful neglect not corrected: $71,162 to $2,190,294 per violation
Each tier carries an annual cap of $2,190,294 for violations of the same provision. During an active enforcement discretion period, OCR announces it will not pursue penalties in Tiers 1 through 3 for the specific requirements identified in the notice. Willful neglect that goes uncorrected still invites scrutiny, because that kind of failure signals indifference to patient privacy rather than a resource-strained effort to keep providing care.
What the COVID-19 Notices Actually Covered
Telehealth
The most visible use of enforcement discretion during COVID-19 involved telehealth. OCR announced it would not penalize healthcare providers who used non-public-facing communication platforms to deliver remote care, even if those platforms lacked a formal business associate agreement or failed to meet every HIPAA Security Rule requirement.3U.S. Department of Health & Human Services. Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency That removed the barrier of needing expensive, HIPAA-compliant software to see patients remotely during a crisis.
The discretion covered any good-faith telehealth encounter, not just visits related to the emergency itself. A physician could conduct a routine follow-up or a mental health session using a consumer video platform while the notice was active. OCR encouraged providers to enable all available encryption and privacy features and to tell patients that consumer applications carry inherent privacy risks.
Public-facing applications were explicitly excluded. Platforms like TikTok, Facebook Live, Twitch, and public chat rooms broadcast content to anyone who clicks in, which makes them fundamentally incompatible with patient privacy.3U.S. Department of Health & Human Services. Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19 Nationwide Public Health Emergency Using one of these services for a patient consultation would count as a privacy violation regardless of the emergency status.
Business Associate Disclosures
A separate notice addressed how business associates handle patient data. Normally, a business associate can only use or share protected health information in the ways its contract with the healthcare provider allows. Changing those contract terms takes time, and during a fast-moving emergency, that delay can slow the flow of data to public health authorities tracking the crisis.
OCR announced it would not penalize business associates or covered entities for sharing patient data for public health or health oversight purposes without a formal contract amendment, as long as two conditions were met. The disclosure had to be a good-faith effort to support public health activities, and the business associate had to notify the covered entity within ten calendar days after the disclosure occurred.4Department of Health and Human Services. Notification of Enforcement Discretion under HIPAA to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19 For ongoing disclosures, the ten-day clock started when the sharing began. Missing that notification step, or disclosing data for a purpose unrelated to public health, meant the standard penalty exposure applied.5Federal Register. Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19
What Enforcement Discretion Does Not Cover
Enforcement discretion is not a suspension of HIPAA. Several categories of conduct remain fully enforceable regardless of any active emergency.
Criminal Violations
Fraud, identity theft, and intentional misuse of patient data are never protected. HIPAA’s criminal statute sets out three tiers of punishment:6GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
- General violations: up to $50,000 in fines and one year in prison
- False pretenses: up to $100,000 and five years
- Commercial advantage, personal gain, or malicious harm: up to $250,000 and ten years
No enforcement discretion notice has ever suggested these penalties would be relaxed during an emergency. A provider who steals patient data during a pandemic faces the same criminal exposure as one who does so on an ordinary Tuesday.
Breach Notification Duties
The HIPAA Breach Notification Rule requires covered entities to report breaches of unsecured patient data to the HHS Secretary. Breaches affecting 500 or more people must be reported within 60 calendar days of discovery, and smaller breaches must be reported within 60 days after the calendar year in which they are discovered.7HHS.gov. Submitting Notice of a Breach to the Secretary None of the COVID-era enforcement discretion notices waived this obligation. A data breach during an emergency still triggers the same reporting clock.
State Attorney General Enforcement
Federal enforcement discretion does not bind state officials. The HITECH Act gave state attorneys general independent authority to bring civil actions on behalf of their residents for violations of the HIPAA Privacy and Security Rules, and an attorney general pursuing such an action must notify HHS at least 48 hours before filing the complaint.8HHS.gov. State Attorneys General Even while OCR is choosing not to pursue penalties for certain violations, a state attorney general retains the ability to investigate and sue over the same conduct under HIPAA or under that state’s own health privacy laws.
When the Discretion Ends
Every enforcement discretion notice is tied to the underlying public health emergency. When the emergency declaration ends, the discretion period ends with it.
The COVID-19 public health emergency expired at 11:59 PM on May 11, 2023. All enforcement discretion notices issued during the pandemic expired at that same moment. OCR then provided a 90-calendar-day transition period, running from May 12, 2023, through 11:59 PM on August 9, 2023, for providers to bring their telehealth operations back into full HIPAA compliance.9U.S. Department of Health and Human Services. HIPAA and Telehealth That meant switching from consumer video platforms to HIPAA-compliant telehealth software, executing business associate agreements with any technology vendors, and restoring full encryption and access controls.
After August 9, 2023, the standard penalty structure applied again in full. Providers who missed the deadline faced the same civil penalty tiers that applied before the pandemic, with no residual protection from the expired notices.
How This Differs From a Section 1135 Waiver
People researching enforcement discretion often run into Section 1135 of the Social Security Act and assume it covers the same ground. It does not. A Section 1135 waiver is a separate mechanism that lets the Secretary waive specific federal healthcare requirements when both a presidential emergency or disaster declaration and a public health emergency declaration are in effect. Section 1135 covers Medicare and Medicaid participation rules, EMTALA requirements, and a narrow set of HIPAA Privacy Rule provisions.10Social Security Administration. Social Security Act 1135 – Authority to Waive Requirements During National Emergencies
The HIPAA provisions that can be waived under Section 1135 are limited to three areas: the requirement to get a patient’s agreement before listing them in a facility directory or speaking with family members, the requirement to distribute a notice of privacy practices, and the patient’s right to request privacy restrictions or confidential communications. Those waivers apply only to hospital workforce members after the hospital has activated its disaster protocol, and they last just 72 hours from that activation.
OCR enforcement discretion notices, by contrast, have covered a much broader range of HIPAA requirements, applied to covered entities and business associates beyond hospital staff, and lasted for the duration of the public health emergency.