HIPAA Training for Emergency Preparedness Coordinators: What You Need to Know

Emergency preparedness coordinators may need to help teams plan for evacuation, continuity of care, public health response, and family notification. If those activities involve protected health information (PHI), your plan should explain who may use or disclose it, for what purpose, and how to safeguard it.

HIPAA applies to covered entities and their business associates—not automatically to every emergency agency or coordinator. When you work within a covered entity’s workforce or handle PHI on its behalf, follow that organization’s policies, applicable law, and assigned role.

What HIPAA privacy protections remain in effect during emergencies

The HIPAA Privacy Rule does not generally stop applying during a disaster or public health emergency. Covered entities and business associates must continue to protect PHI and follow applicable privacy policies, although the Rule permits certain disclosures without individual authorization. HHS: Is the HIPAA Privacy Rule suspended during an emergency?

In practice, emergency response does not create a blanket permission to share patient lists, diagnoses, or other identifiable information. Staff should use approved communication channels, limit access to people with a legitimate role, and follow safeguards that apply to paper records, verbal communications, and electronic PHI. 45 CFR § 164.530(c), Privacy Rule safeguards

HIPAA obligations depend on the organization and the person’s role. An emergency coordinator who is part of a covered entity’s workforce must follow its policies; an outside partner receiving PHI may need to act under an appropriate business associate arrangement or another permitted basis for disclosure.

When can coordinators disclose PHI without individual authorization

HIPAA allows certain disclosures without a patient’s written authorization. The correct basis depends on the purpose, recipient, circumstances, and applicable law. A coordinator should not assume that an emergency request by itself authorizes disclosure; follow the organization’s procedures and refer uncertain requests to its privacy officer or counsel.

• Treatment and continuity of care: Covered entities may share PHI with health care providers for treatment, including coordinating care for people who have been relocated. The minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment. HHS: Emergency preparedness disclosures for treatment
• Public health activities: A covered entity may disclose PHI to a public health authority when the authority is authorized by law to receive it for public health activities. The Privacy Rule permits these disclosures; it does not generally require them unless another law does. HHS: Disclosures to officials responding to public health emergencies
• Family notification and disaster relief: Under specified conditions, a covered entity may share information needed to identify, locate, or notify family members, guardians, or others responsible for a person’s care. It may also share relevant information with an authorized disaster relief organization for notification purposes. HHS: Sharing health information in a severe disaster
• Serious and imminent threat: A covered entity may disclose PHI it believes is necessary to prevent or lessen a serious and imminent threat to a person or the public, to someone reasonably able to help prevent or lessen the threat, consistent with applicable law and professional standards. HHS: Serious and imminent threat disclosures
• Disclosure required by law: A covered entity may disclose PHI when another law requires the disclosure, subject to the applicable legal requirements.

For planned information sharing, use HHS’s emergency preparedness decision tool to consider who holds the information, who will receive it, and the purpose of the proposed disclosure.

How to assess privacy requirements in emergency plans

Review privacy requirements while building or updating the plan—not only after an incident begins. Identify where PHI may be used, who may request it, which roles approve disclosure, and how staff will protect it if normal facilities, systems, or communications are unavailable.

• Map likely information flows among health care providers, public health authorities, emergency management agencies, transportation partners, and disaster relief organizations.
• For each recipient, record the purpose of the request and the legal or operational basis for sharing. Confirm whether the recipient is an authorized public health authority or another permitted recipient.
• Set procedures for requests that require review, escalation, or consultation with the privacy officer. Include a process for documenting decisions as required by organizational policy and applicable law.
• Determine what information is needed for each task. For planning, aggregate or less-identifiable information may be sufficient; operational evacuation support may require specific details, depending on the circumstances.
• Check for state, local, and other federal confidentiality rules that may provide additional protections or impose separate requirements.

HHS’s public health authority disclosure decision tool can help assess whether a recipient fits that category. HHS also explains that the information needed for disaster planning depends on the activity—for example, transportation coordination may require different details than estimating equipment needs. HHS: Minimum necessary standard in emergency preparedness

What HIPAA training should cover for each workforce role

The Privacy Rule requires covered entities to train workforce members on relevant privacy policies and procedures as necessary and appropriate for their functions. Training must be provided to new workforce members within a reasonable period and to affected staff within a reasonable period after a material policy change; the covered entity must document training. The rule does not establish a universal annual renewal schedule for everyone. 45 CFR § 164.530(b), workforce training

For emergency preparedness coordinators, training should connect the organization’s policies to the decisions they may make or route during planning and response. Depending on the role, cover:

• What counts as PHI and which staff, systems, and records are within the coordinator’s access.
• How to recognize permitted disclosure pathways, including treatment, public health authority disclosure, family notification, and the serious and imminent threat exception.
• How to evaluate requests, apply minimum-necessary limits when they apply, and escalate uncertain or non-routine requests.
• How to protect PHI in incident command briefings, evacuation rosters, printed documents, radios, mobile devices, messaging systems, and shared work areas.
• How to report suspected loss, misdirection, unauthorized access, or disclosure under the organization’s incident and breach procedures.

Training should reflect employer-specific policies, assigned duties, and applicable law. A course-completion certificate can document that a person completed a course, but it is not proof that the organization as a whole is HIPAA-compliant. Coordinators should use their employer’s training and escalation procedures rather than treating a general certificate as a substitute.

How coordinators integrate privacy into exercises and incident command

Include privacy decision-making in tabletop and functional exercises. Practice realistic requests for patient location information, evacuation assistance, public health data, and family notification. Ask participants to identify the requester, purpose, applicable disclosure basis, approving role, information needed, and secure method of transmission.

In incident command, define who can approve or transmit PHI, who consults the privacy officer, and how decisions reach field teams. Use role-based access and designated communication channels where feasible. Exercise fallback procedures for system outages, paper records, and transfers to receiving facilities.

After each exercise or activation, review whether staff could locate current policies, distinguish permitted sharing from over-disclosure, and protect records while operating under pressure. Update training and procedures when the review identifies a gap or when a material policy change affects workforce functions.

How to safeguard PHI during evacuation and disaster response

Plan for the physical movement of records and devices as carefully as the movement of patients. Limit access to staff who need the information for their assigned duties, keep paper records under control, and use approved methods to transfer or store electronic PHI. If normal systems are unavailable, use the organization’s downtime and emergency procedures.

• Carry only the records or identifiers needed for the task; secure documents and devices during transport and prevent them from being left in public or unattended areas.
• Verify the recipient and the destination before sending information, particularly when coordinating transfers or using a temporary location.
• Use privacy-conscious verbal communications in staging areas, vehicles, shelters, and incident command spaces. Avoid discussing identifiable patient details where people without an operational need can hear.
• Follow organizational procedures for access controls, device security, approved messaging, backups, and reporting lost or compromised information.
• At temporary sites, control who can view rosters and lists, and store or dispose of records according to policy.

For electronic PHI, the HIPAA Security Rule includes contingency planning requirements for emergencies affecting systems that contain ePHI, including procedures for emergency operations. Coordinators should know how their organization’s plan supports continuity of operations while protecting that information. 45 CFR § 164.308(a)(7), contingency plan

What limits apply to emergency-related PHI disclosures

A permitted disclosure is limited by its legal basis and purpose. For disclosures subject to the minimum necessary standard, covered entities must make reasonable efforts to limit PHI to what is needed for the purpose. The standard does not apply to provider-to-provider disclosures for treatment, but it generally does apply to disclosures for many other purposes, including public health activities. HHS: Minimum necessary requirement

Do not treat an emergency as permission to make broad public announcements about identifiable patients. Facility directory information may be shared under specific conditions and in limited terms; more detailed disclosures to media or the public generally require an authorization unless another rule permits them. HHS: HIPAA Privacy in Emergency Situations

Any emergency declaration waiver is limited, not automatic. If the required declarations are made, the HHS Secretary may waive sanctions and penalties for certain Privacy Rule provisions for covered hospitals that have instituted a disaster protocol. The waiver applies only in the specified emergency area and period and for up to 72 hours after the hospital implements its disaster protocol. It does not suspend the Privacy Rule generally, and ordinary permitted disclosures remain governed by the Rule. HHS: Scope of the HIPAA emergency waiver

In short, effective emergency preparedness combines role-based training, planned disclosure pathways, and practical safeguards. Build those protections into your emergency plan and exercises so staff can support response needs without treating a crisis as a blanket exception to privacy requirements.

FAQs.

Does the HIPAA Privacy Rule still apply during an emergency?

Yes. The HIPAA Privacy Rule generally remains in effect during emergencies. It permits certain disclosures without individual authorization, and a limited waiver may apply to specific provisions under defined conditions; an emergency does not suspend the Rule as a whole. HHS: HIPAA during emergencies

Can emergency coordinators disclose PHI without patient authorization?

Sometimes. A disclosure may be permitted for treatment, certain public health activities, family notification, disaster relief, or to prevent or lessen a serious and imminent threat, among other circumstances. The coordinator should confirm the applicable basis, recipient, purpose, and organizational approval process before sharing PHI. HHS: Emergency preparedness disclosure decision tool

What HIPAA training do emergency preparedness coordinators need?

Covered entities must train workforce members on relevant privacy policies and procedures as necessary and appropriate for their job functions, provide training to new members within a reasonable period, and address material policy changes within a reasonable period. Training should cover the coordinator’s actual responsibilities, disclosure decisions, safeguards, and escalation procedures. HIPAA does not set a universal annual training schedule for every workforce member. 45 CFR § 164.530(b)

When can an emergency declaration waive HIPAA requirements?

A declaration does not automatically waive HIPAA. Under specified conditions, the HHS Secretary may waive sanctions and penalties for certain Privacy Rule provisions for covered hospitals that have instituted a disaster protocol. Any waiver is limited by the emergency area and period and applies for up to 72 hours from implementation of the hospital’s disaster protocol. HHS: Limited HIPAA waiver during an emergency