Today's briefing covers one CMS item dated 2026-10-15: the resources and flexibilities CMS announced for the public health emergency in Alabama and Florida following Hurricane Isaias. For health-data and privacy teams the operative part is the HIPAA Privacy Rule sanctions waiver, which is narrow in whom it covers and short in how long it lasts.
CMS announced additional resources and flexibilities on 2026-10-15 in response to a public health emergency (PHE) in Alabama, beginning 2026-10-07, and in Florida, beginning 2026-10-06, due to emergency conditions resulting from Hurricane Isaias. The HHS Secretary declared the PHE on 2026-10-13. CMS blanket waivers and other flexibilities are available to affected providers in both states, and providers that need additional flexibility can submit a request through the CMS 1135 Waiver/Flexibility Request and Inquiry Form.
The health information privacy section of the alert sets out the HIPAA position. During a PHE, the HHS Secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the HIPAA Privacy Rule. The waiver applies in the emergency area and for the emergency period identified in the PHE declaration; to hospitals that have instituted a disaster protocol; and for up to 72 hours from the time the hospital implements its disaster protocol, not exceeding the period described in section 1135(e) of the Social Security Act. The alert points to the HHS Office for Civil Rights for more information on HIPAA enforcement during emergency responses.
The alert's other measures bear on continuity of care and records. CMS activated the Kidney Community Emergency Response program with ESRD Network 7 (Florida) and Network 8 (Alabama) to assess dialysis facilities and help evacuated patients receive dialysis, and advises patients to keep important personal, medical and insurance information in a waterproof emergency kit. Medicare beneficiaries can obtain replacements for durable medical equipment, prosthetics, orthotics and supplies lost or damaged in the hurricane. Part D plans must ensure access to drugs at out-of-network pharmacies for displaced enrollees, and CMS expects refill-too-soon edits to be removed for beneficiaries who lost their drugs. People affected by a FEMA-declared event in states served by HealthCare.gov have up to 60 days from the end of the incident period to select or change a Marketplace plan.
The waiver is far narrower than a general suspension of HIPAA. It covers only hospitals, only those that have instituted a disaster protocol, only within the declared emergency area and period, and only for up to 72 hours from the moment the protocol is implemented; it addresses sanctions for certain Privacy Rule provisions and says nothing about the Security Rule. Clinics, other covered entities and business associates in Alabama and Florida should assume no waiver applies to them. Hospitals relying on it should record exactly when the disaster protocol was implemented, since the 72-hour clock runs from that time, review the OCR emergency-response guidance the alert cites, and plan for full Privacy Rule obligations to resume when the window closes.
