Choose Site


Hurricane Recovery Client Alert: Regulatory Relief for Healthcare Providers in Disaster Areas

September 08, 2017 (Updated September 18, 2017)

Hurricanes Harvey and Irma have led to the declaration of a public health emergency in various affected areas across the country. As healthcare providers continue to provide essential disaster response operations, CMS and HHS have provided limited regulatory relief to healthcare providers through temporary exemptions, waivers, and other actions.

Due to Hurricanes Harvey and Irma, the US Department of Health and Human Services (HHS) declared a public health emergency in Florida, Georgia, Louisiana, South Carolina, Texas, the Commonwealth of Puerto Rico, and the territory of the US Virgin Islands, and invoked certain waivers that offer immediate regulatory relief for providers under Section 1135 of the Social Security Act.[1] Additionally, due to the devastating impact of Hurricanes Harvey and Irma, the Centers for Medicare & Medicaid Services (CMS) is granting exceptions under certain Medicare quality reporting and value-based purchasing programs to all types of acute care hospitals, skilled nursing facilities, home health agencies, hospices, renal dialysis facilities, and ambulatory surgical centers located in affected counties, municipios, and county equivalents designated by FEMA in the areas affected by Hurricanes Harvey and Irma.[2]


Under § 1135 of the Social Security Act, the Secretary of HHS may temporarily waive or modify certain Medicare, Medicaid, and Children’s Health Insurance Program requirements (e.g., conditions of participation, Emergency Medical Treatment & Labor Act (EMTALA) requirements, or Health Insurance Portability and Accountability Act (HIPAA) disclosure requirements) so that providers that furnish services in the affected areas in good faith can be reimbursed and exempted from sanctions. In order to qualify for the waiver, the provider must be located in the geographic region covered by the public health emergency and be unable to comply with regulatory requirements due to the conditions created by the emergency.

Providers should refer to these two documents for an explanation of


Below is an overview of exemptions to certain Medicare quality reporting and value-based purchasing programs for providers located in one of the Texas counties or Louisiana parishes designated by the Federal Emergency Management Agency (FEMA) as a major disaster county (see Applicability of Reporting Requirements for Facilities Affected by Hurricane Harvey for further exception applicability guidelines).

Hospital—Inpatient Services


  • Reporting requirements under the Hospital Inpatient Quality Reporting (IQR) Program
  • Hospital Consumer Assessment of Healthcare Providers and Systems (HCAHPS) Survey
  • Influenza Vaccination Coverage Among Healthcare Personnel (HCP) measure
  • Hospital IQR Program chart-abstracted measures, including clinical population and sampling data
  • National Healthcare Safety Network (NHSN) Healthcare-Associated Infection (HAI) measures
  • Hospital IQR Program chart-abstracted data validation due to the Clinical Data Abstraction Center (CDAC) medical record submission requirements for validation.
  • HAI Validation Template

Potential subsequent future impact

  • Hospital Value-Based Purchasing (VBP) Program
  • Hospital Readmissions Reduction Program
  • Hospital-Acquired Condition (HAC) Reduction Program

Hospitals—Outpatient Services

Exemptions to reporting requirements under the Hospital Outpatient Quality Reporting (OQR) Program

  • Influenza Vaccination Coverage Among Healthcare Personnel (HCP) measure
  • Hospital OQR Program chart-abstracted measures
  • Hospital OQR Program chart-abstracted data validation medical record submission requirements for CDAC record requests for specified encounter periods

Home Health Agencies, Hospices, Inpatient Rehabilitation Facilities, Long-Term Care Hospitals, and Skilled Nursing Facilities


  • Quality Reporting Program reporting requirements for Q2 and Q3 2017

Ambulatory Surgical Centers

Exemptions to reporting requirements under the Ambulatory Surgical Center Quality Reporting (ASCQR) Program

  • Data collection and submission requirements that apply for the remainder of Calendar Year (CY) 2017 and the 2017/2018 Influenza Season that relate to CY 2019 payment determinations
  • All data submitted via the QualityNet Secure Portal and the NHSN web-based measure collection tools that are due May 15, 2018
  • Note: This exemption does not apply to claims-based measures that do not utilize QDCs for calculation purposes

Renal Dialysis Facilities


  • Reporting requirements of the End-Stage Renal Disease Quality Incentive Program (ESRD QIP) reporting measures
  • Facilities that desire an exemption beyond the specified timeframe may submit an Extraordinary Circumstances Exceptions (ECE) request via the established process


  • Providers outside the specified areas may request an exception to the reporting requirements under one or more Medicare quality reporting or value-based purchasing programs using the applicable ECE procedures
  • Hospitals, regardless of location, may request an exception to reporting requirements under the Hospital VBP Program, HAC Reduction Program, and Hospital Readmissions Reduction Program
  • Hospitals and ASCs in counties, parishes, and states outside of the designated areas may submit ECE requests based on individual circumstances
  • Certain providers—those that are not within the region that has been declared to have a public health emergency but nevertheless have been affected by Hurricane Harvey, or those that are within the region declared to be an emergency but are still able to operate under normal compliance procedures—should refer to Emergency-Related Policies and Procedures That May Be Implemented Without § 1135 Waivers


HHS has issued guidance on HIPAA Privacy Rule and Security Rule requirements in the wake of Hurricanes Harvey and Irma. HHS released a limited waiver of sanctions and penalties against covered hospitals that do not comply with specified provisions of the HIPAA Privacy Rule. The waiver is limited (1) to the emergency area and for the emergency period identified in the public health emergency declaration, (2) to hospitals that have instituted a disaster protocol, and (3) for up to 72 hours from the time the hospital implements its disaster protocol.

The limited waiver covers the following provisions of the HIPAA Privacy Rule:

  • Requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care (see 45 CFR 164.510(b))
  • Requirement to honor a request to opt out of the facility directory (see 45 CFR 164.510(a))
  • Requirement to distribute a notice of privacy practices (see 45 CFR 164.520)
  • Patient's right to request privacy restrictions (see 45 CFR 164.522(a))
  • Patient's right to request confidential communications (see 45 CFR 164.522(b))

Once the declaration terminates, healthcare providers must comply with all requirements of the Privacy Rule.

For more information from CMS on the scope of the § 1135 waivers that apply in Texas, Louisiana, and Florida, as well as other administrative actions in response to Hurricanes Harvey and Irma, please visit Hurricanes: Centers for Medicare and Medicaid Services (CMS)


If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:

Washington, DC
Albert Shay
Howard Young

[1] These waivers and modifications became effective in Florida on September 9, 2017, in Texas on August 25, 2017, in Louisiana on August 27, 2017, and in the Commonwealth of Puerto Rico and the territory of the US Virgin Islands on September 5, 2017.

[2] Please see the CMS Hurricane Page for specific effective dates and dates of declaration for each state or territory.