What is the HIPAA Emergency Exception?

The HIPAA Emergency Exception refers to events in which HIPAA’s legal requirements remain fully in force, but an emergency disrupts the organization’s ability to follow its usual privacy and security procedures.

Rather than suspending HIPAA or creating a HIPAA emergency exception, these events activate built‑in flexibilities that allow alternate workflows, rapid disclosures, or emergency‑mode operations needed to protect life, safety, and continuity of care.

Healthcare workers sometimes hear phrases like “HIPAA doesn’t apply in an emergency” or “there’s a HIPAA emergency exception that can be used when a situation makes it impossible to comply with standard HIPAA safeguards.”

These ideas persist because emergencies force rapid decisions, improvisation, and temporary deviations from normal workflows. However, emergencies change procedures, not the law.

HIPAA remains fully in effect at all times, including during disasters, cyberattacks, and life‑threatening situations. What does change is how organizations apply their policies and procedures in order to protect patients when standard safeguards are disrupted.

The Reality: HIPAA Has Flexibilities, Not Exceptions

The HIPAA Administrative Simplification Regulations were developed with the understanding that healthcare does not always occur in controlled environments.

For example, the HIPAA Privacy Rule permits disclosures needed to prevent or lessen serious and imminent threats, and the HIPAA Security Rule requires emergency access procedures, contingency plans, and emergency‑mode operations.

These provisions allow covered entities to continue providing care and protecting life even when normal systems fail. Therefore, while operational procedures may shift, HIPAA’s legal requirements remain intact, and any HIPAA emergency exception still must be within HIPAA’s permitted uses and disclosures.

How Emergencies Disrupt Standard HIPAA Procedures

Emergencies create conditions where the usual safeguards such as private rooms, secure systems, controlled access, and structured workflows may be unavailable. In these circumstances, organizations rely on HIPAA’s built‑in flexibilities to maintain the continuity of care and protect individuals from harm.

The following scenarios illustrate when deviations from standard procedures may occur while remaining compliant with HIPAA.

Extreme Weather and Natural Disasters

Hurricanes, wildfires, floods, and earthquakes can destroy infrastructure, displace patients, and disrupt communication systems. When these events occur, a HIPAA emergency exception may allow staff to permissibly:

• Relocate patients without full registration workflows
• Use paper documentation or improvised systems
• Share PHI with emergency responders or shelters
• Communicate verbally in open or crowded environments

During declared emergencies, the Office for Civil Rights (OCR) may announce limited enforcement discretion. Enforcement discretion does not create a HIPAA emergency exception. It only means that OCR will not pursue enforcement action in the event of non-compliance with certain HIPAA Privacy Rule standards.

Cyberattacks and System Outages

Ransomware and network failures can instantly disable EHRs, email, and secure messaging systems. HIPAA’s Security Rule anticipates this by requiring covered entities and business associates to implement contingency plans and emergency access procedures. During outages, staff may:

• Use downtime documentation
• Access PHI through emergency‑mode accounts
• Rely on radios, phones, or personal devices
• Temporarily relax access controls to maintain care

These deviations from standard procedures are permissible when they follow the organization’s emergency operations plan and when PHI is used or disclosed within the limitations permitted by the HIPAA Privacy Rule.

Violent or Imminent Threat Situations

Active shooters, violent patients, or threats to staff, visitors, or the public require immediate action. The HIPAA Privacy Rule permits disclosures to law enforcement or others who can prevent or lessen a serious and imminent threat when disclosures are made in good faith. In these circumstances, staff may:

• Share PHI quickly with security or police
• Bypass certain routine verification steps
• Communicate patient location or status to protect others

With regard to this HIPAA emergency exception, it is important to be aware that conditions apply to how a threat became known to a staff member. There are also limits on what PHI can be disclosed to security or police.

Infrastructure Failures

Non-adversarial infrastructure failures such as power outages, HVAC failures, water damage, or structural hazards can force rapid patient movement and improvised workflows. During periods when the physical environment is unsuitable for the provision of care, staff may need to:

• Move patients without full intake procedures
• Store PHI temporarily in unsecured areas
• Conduct care in hallways or public spaces

Other types of non-adversarial emergencies that can be included in this category include software outages due to aging, connectivity problems, and system incompatibilities.

Mass Casualty Incidents and Surge Events

Large-scale emergencies attributable to industrial accidents, transportation disasters, or active shooters in the community can overwhelm normal operations and can affect healthcare facilities that do not have a full-service Emergency Department. In these circumstances, HIPAA emergency exceptions allow staff to:

• Conduct triage in open areas
• Share PHI with EMS, emergency management, or reunification teams
• Use whiteboards, radios, or public announcements

These actions support treatment and public safety and are permitted under HIPAA, provided the flexibilities are limited to the time necessary to support treatment and are documented.

Public Health Emergencies

Outbreaks, quarantines, and communicable disease investigations require rapid reporting and coordination. In some states, reporting certain diseases is mandatory. HIPAA permits limited disclosures of PHI to public health authorities and others responsible for preventing disease spread. When required, staff may:

• Report cases without patient authorization
• Share PHI with schools, shelters, or workplaces
• Support contact tracing and isolation efforts

It is important to be aware that, although these actions do not qualify as a HIPAA emergency exception under HIPAA, they may still be prohibited under the Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2) or by a state law.

Communication System Failures

When phones, Internet, or paging systems fail, while this may not qualify as an emergency “per se”, staff may need to use alternative channels of communication that have not been configured to support HIPAA compliance. In these situations, it may be necessary to:

• Use personal devices or unencrypted tools
• Deliver updates through mass announcements
• Post temporary patient lists for coordination

In these situations, it is important to remember that HIPAA requires reasonable safeguards, not perfection, during system failures. Nonetheless, healthcare organizations are expected to document how communications were managed during the system failure.

Emergency Medical Transport and Field Medicine

EMS and field clinicians often operate in chaotic environments where privacy is limited and/or where communication channels have limited connectivity. In these emergency situations, EMS and field clinicians may:

• Share PHI verbally in public spaces
• Document care on improvised materials
• Transmit information over unsecured radio channels

These disclosures are permitted by the HIPAA Privacy Rule when necessary for treatment, even though there is the risk of PHI being overheard or transmitted via an unsecure channel of communication.

Law Enforcement Emergencies

When law enforcement responds to an on-site emergency, enquires about a patient that has passed through the hospital, or investigates an injury to a patient, staff may disclose PHI to law enforcement agents to:

• Identify or locate a suspect, fugitive, or missing person
• Prevent or mitigate an imminent threat
• Support an active investigation involving serious harm

What information can be disclosed to law enforcement officers is limited by §164.512(f)(2) of the HIPAA Privacy Rule without a patient authorization. For example, it is not permitted to provide a law enforcement officer with a photo of a suspect’s face unless it is required by state law.

Patient Elopement or Missing Persons

When a patient goes missing, staff are allowed to use a HIPAA emergency exception when there is a good faith belief that the patient may come to harm or present a threat to others. In this scenario, staff may:

• Share PHI with law enforcement or search teams
• Broadcast identifying information internally or externally
• Review visitor logs or video footage quickly

Any disclosures of PHI in this scenario must be documented, and the same limitations apply with regard to providing law enforcement officers with a photo of the missing person’s face.

Emergency Staffing and Workforce Flexibility

During disasters or staff shortages, healthcare organizations may rely on volunteers, temporary staff, or mutual aid personnel. HIPAA allows these individuals to be part of the workforce and have access to PHI, even when:

• Onboarding is expedited
• Training is abbreviated
• Access to PHI is temporarily broadened

In all emergency staffing scenarios, it is still necessary for reasonable safeguards to be applied. This means that healthcare organizations must only provide volunteers, temporary staff, and mutual aid personnel with the PHI necessary to perform their roles.

What All These Scenarios Have in Common

Across every type of emergency, the same underlying pattern holds. HIPAA does not disappear, weaken, or pause, nor does the law allow for HIPAA emergency exceptions. The law remains fully in effect, but the environment changes, and with it, the organization’s ability to follow its usual privacy and security procedures.

Emergencies disrupt process, not legal obligation. When standard safeguards break down, staff rely on HIPAA’s existing allowances for treatment, public health reporting, and preventing or lessening serious and imminent threats. These provisions are intentionally broad enough to support rapid decision‑making when lives or safety are at risk.

In these moments, OCR evaluates actions through the lens of reasonableness and good‑faith effort, recognizing that perfect compliance may be impossible during chaotic conditions. What matters is that staff act to protect patients, maintain continuity of care, and use the safeguards that are feasible under the circumstances.

Organizational Responsibilities During Emergencies

Organizations carry significant responsibility for ensuring that emergency‑mode operations remain lawful, coordinated, and safe. This begins with maintaining and regularly testing contingency plans so staff know exactly how to function when systems fail or workflows collapse. Emergency access procedures must be clearly defined, technically functional, and familiar to the workforce, not theoretical documents that no one has practiced.

HIPAA training for emergency staff and staff who will be impacted by an emergency is essential. Employees need to understand what disclosures are permitted during emergencies, how to apply HIPAA’s flexibilities, and how to make good‑faith decisions under pressure.

Documentation also matters. Even when immediate recordkeeping is impossible, organizations should train staff on how to capture key decisions and disclosures as soon as conditions stabilize. Ultimately, preparedness determines whether an emergency response is confident and coordinated or chaotic and risky. When organizations invest in planning, training, and clear procedures, staff can act decisively to protect patients while staying within the boundaries of HIPAA.

Emergencies Require Training, Not Exceptions

The idea of a “HIPAA emergency exception” is a myth, but the need for emergency flexibility is real. Emergencies demand rapid decisions, alternate workflows, and good‑faith judgment. HIPAA supports this through built‑in provisions that allow disclosures and access necessary to protect life and safety.

To ensure staff can act quickly and lawfully, organizations should provide regular training on emergency scenarios, including drills, tabletop exercises, and scenario‑based learning. When staff understand how HIPAA’s flexibilities work, they can protect patients effectively, even under the most challenging conditions.