On April 2, HHS OCR issued a notification that, effective immediately, OCR will not be imposing penalties for violations of certain provisions of the Privacy Rule against business associates of HIPAA covered entities for uses and disclosures of protected health information for public health and health oversight activities during the current COVID-19 crisis. Examples of permitted disclosures include disclosure to the CDC to enable the prevention or control of COVID-19, or disclosure to CMS or a similar state agency to assist the health care system in its COVID-19 response. Enforcement discretion will remain in place until the end of the crisis.