South Dakota Hospital Emergency Management Privacy Laws: A Practical Guide

What HIPAA permits during emergency preparedness and response

The HIPAA Privacy Rule does not stop applying during an emergency. It does, however, permit certain disclosures of protected health information (PHI) without a patient’s authorization when the disclosure fits a specific legal basis. A South Dakota hospital that is a HIPAA covered entity should identify that basis before sharing patient information; an emergency by itself does not authorize unrestricted disclosure. See HHS guidance on emergency preparedness disclosures.

HIPAA generally permits providers to share PHI with other providers for treatment. It also permits disclosures to a legally authorized public health authority for public health activities, including disease reporting and surveillance. South Dakota’s Department of Health is a public health authority, and state law requires reports from hospitals and other specified reporters. HHS guidance on public health disclosures explains the federal permission; South Dakota Codified Law 34-22-12 establishes the state reporting framework.

Depending on the circumstances, a hospital may also share limited information with family members, friends, or disaster-relief organizations involved in a patient’s care or location, subject to HIPAA’s conditions. For example, when a patient is incapacitated, a provider may use professional judgment to disclose information in the patient’s best interests. A hospital may also give facility-directory information to someone who asks for a patient by name if the patient has not objected and the applicable conditions are met. These permissions are specific—not a blanket exception for anyone assisting with an emergency.

Which federal emergency waivers may apply and what they cover

Two different kinds of federal relief are often confused. Under Social Security Act section 1135, the HHS Secretary may waive or modify certain Medicare, Medicaid, or CHIP requirements when the required federal emergency declarations are in place. Such a waiver is limited to the requirements and circumstances the Secretary identifies; it does not automatically suspend HIPAA. See HHS’s overview of section 1135 waivers.

A separate, limited HIPAA emergency waiver may be available when the President declares an emergency or disaster and the HHS Secretary declares a public health emergency. If issued, it may waive sanctions for a covered hospital’s noncompliance with specified Privacy Rule provisions concerning family or friend involvement, facility-directory opt-outs, notices of privacy practices, requested restrictions, and confidential communications. It applies only in the declared area and period, to a hospital that has activated its disaster protocol, and for up to 72 hours after that protocol begins. When the relevant declaration ends, the hospital must resume compliance for patients still in its care, even if 72 hours have not passed. Read HHS’s explanation of the limited HIPAA waiver.

The waiver is not automatic for every disaster or emergency declaration. Hospitals should verify whether a waiver has actually been issued and check its scope and dates. The HIPAA Security Rule is not suspended by this limited Privacy Rule waiver; electronic PHI still requires security protections and emergency contingency planning. See HHS guidance on the Security Rule during emergencies.

How hospitals should plan for emergency information sharing

An effective emergency operations plan should tell staff what information may be shared, with whom, for what purpose, and through which approved channels. Build practical decision steps into the plan for treatment coordination, family or disaster-relief inquiries, public health reporting, and requests from emergency officials. Identify who can approve unusual disclosures and how staff should document the recipient, purpose, and information shared.

For Medicare- and Medicaid-participating hospitals, CMS emergency preparedness requirements include an emergency plan, policies and procedures, a communication plan, and training and testing. CMS says the communication plan must comply with federal and state law and support coordination within the facility and with other providers, public health departments, and emergency-management agencies. See CMS’s emergency preparedness rule guidance.

Prepare for loss of usual systems as well as surges in patient volume. Decide in advance how staff will verify identity and authority, access only the records they need, communicate securely when normal systems are unavailable, and record decisions made during downtime. These operational safeguards help staff act quickly while keeping disclosures tied to a valid purpose.

What patient privacy practices hospitals must maintain during emergencies

Outside a valid waiver, hospitals must continue to follow applicable HIPAA Privacy Rule requirements. That means using an appropriate legal basis for each disclosure, honoring applicable patient choices and restrictions, and limiting access to workforce members who need information for their jobs. Where the minimum necessary standard applies, disclose only the PHI reasonably needed for the purpose. HIPAA does not require a minimum-necessary determination for disclosures required by law, among other exceptions. See HHS’s explanation of public health disclosures and minimum necessary.

Hospitals should continue reasonable administrative, technical, and physical safeguards, including appropriate access controls and care with conversations, printed records, screens, and shared work areas. HIPAA does not require a private room for every patient or soundproofing, but it does require reasonable safeguards against impermissible uses and disclosures. See HHS’s guidance on private rooms and reasonable safeguards.

Staff should use approved channels for urgent communications where feasible and avoid treating emergency conditions as permission to disclose full records to broad groups. When immediate care or safety needs require rapid sharing, staff should still disclose information only to an appropriate recipient and for the relevant purpose.

Which communicable diseases hospitals must report in South Dakota

South Dakota law requires the Department of Health to collect reports of identifiable and suspected communicable disease cases, carriers, and related laboratory results from physicians, hospitals, laboratories, and institutions. The Department’s rules classify reportable conditions into categories with different reporting timelines. The Department currently directs that Category I diseases be reported immediately upon suspicion and Category II diseases within three days. See SDCL 34-22-12 and the South Dakota Department of Health’s reportable diseases and conditions page.

Reportable conditions include a broad range of infections and public health events. Examples on the state list include anthrax, botulism, measles, invasive meningococcal disease, novel influenza strains, tuberculosis, and certain outbreaks, as well as syndromes suggestive of bioterrorism and unexplained illnesses or deaths. This is not a complete list; categories and reporting requirements can change. Hospitals should consult the Department’s current list and reporting instructions rather than rely on examples in a general guide.

South Dakota law treats required disease reports as strictly confidential medical information and permits the Department to release medical or epidemiological information only in specified circumstances, such as for non-identifying statistics or as necessary for disease control or to protect a named person’s health or life. See SDCL 34-22-12.1.

How South Dakota law protects ambulance patient information

South Dakota law makes personally identifiable information obtained by ambulance-service staff—including a patient’s name, address, diagnosis, or treatment—confidential. The statute says the information may not be published or disclosed without authorization from the patient or the patient’s designee, except as authorized by law. See SDCL 34-11-5.1.

Separate state law requires ambulance services to submit electronic trip records to the Department at the time and in the manner it directs. Those records must be statistical in nature and may not include information made confidential under the ambulance confidentiality statute. See South Dakota Codified Law, Chapter 34-11.

Hospitals coordinating with ambulance services should account for both HIPAA and South Dakota’s ambulance-service confidentiality rule. Before using or redisclosing ambulance-originated information, staff should confirm that the recipient and purpose are permitted by applicable law or that the required authorization is in place.

What limits apply to emergency-purpose information

Permission to disclose information for an emergency purpose does not mean a recipient may use it for unrelated purposes or pass it along without limits. HIPAA’s minimum necessary standard applies to many disclosures, including public health disclosures, though specific exceptions exist—for example, when a disclosure is required by law. A hospital can create standard protocols for recurring requests so staff know which information is appropriate to share. See HHS guidance on the minimum necessary standard in emergency preparedness.

South Dakota’s communicable-disease reporting records have their own strict confidentiality rules and statutory exceptions. Ambulance patient information is also subject to the state confidentiality provision. In addition, other federal or state privacy laws may impose stricter rules for particular records, so hospitals should check for overlapping protections before disclosing information.

For practical compliance, document the authority and purpose for a disclosure, share only what that purpose calls for, and follow applicable confidentiality and security procedures. The key distinction is that emergency response may create lawful routes for sharing information, but it does not erase the limits attached to those routes.

FAQs.

When may a South Dakota hospital disclose protected health information during an emergency?

A hospital may disclose PHI when a HIPAA permission or requirement applies—for example, for treatment, to a legally authorized public health authority, or in certain circumstances to family, friends, or disaster-relief organizations involved in care or locating the patient. The hospital should confirm the applicable conditions and limit the disclosure as required. An emergency alone does not authorize unrestricted disclosure.

Do HIPAA emergency waivers apply to every disaster?

No. A limited HIPAA waiver requires the specified federal declarations and an issued waiver, and it applies only to the covered hospital, area, period, and Privacy Rule provisions identified. For an eligible hospital, the waiver is limited to up to 72 hours after implementation of its disaster protocol, subject to the end of the declarations. HIPAA is not generally suspended during emergencies.

Are hospitals required to provide every patient with a private room?

No. HIPAA does not require hospitals to provide a private room for every patient. It does require reasonable safeguards to protect PHI and prevent impermissible disclosures, which may include practical measures such as curtains, screens, or careful handling of conversations and records.

Which communicable diseases must South Dakota hospitals report?

Hospitals must report diseases and conditions listed under South Dakota’s communicable-disease rules, with timing that depends on the category: the Department of Health directs immediate reporting upon suspicion for Category I conditions and reporting within three days for Category II conditions. The list includes conditions such as measles, tuberculosis, and certain outbreaks, but it is broader than these examples. Hospitals should check the Department of Health’s current reportable-disease list and instructions.