When Hurricanes Helene and Milton struck the Southeast this year, the U.S. Department of Health and Human Services (HHS) acted quickly to ensure that people in the impacted areas who were covered under Medicare, Medicaid, or the Children’s Health Insurance Program (CHIP) had continued access to essential healthcare services and supplies. By issuing emergency waivers to relax specific regulatory requirements, HHS empowered healthcare organizations and providers to adapt swiftly to evolving challenges without fear of sanctions or penalties.

HHS waivers play a critical role in disaster response. While some apply automatically to certain provider types within affected areas, individual providers may also request case-specific waivers tailored to their unique needs. Knowing how to identify relevant blanket waivers and how to apply for individual ones enables providers to continue serving their communities when it matters most.

Statutory Authority

HHS derives its authority to implement waivers during natural disasters or national emergencies from Section 1135 of the Social Security Act. Section 1135 specifies that two declarations must be in place before waivers can be issued: a Presidential emergency declaration under either the Stafford Act or National Emergencies Act, and a public health emergency (PHE) declaration by the HHS Secretary under Section 319 of the Public Health Service Act.

When both declarations are in effect, HHS may implement waivers to grant temporary relief from specific requirements for qualifying providers in the designated areas. These waivers include broad “blanket” waivers, which apply to all relevant providers across the affected region, and “individual” or “site-specific” waivers, which providers can request for unique situations or needs that require additional flexibility. Individual waivers are crucial for providers facing constraints such as staffing shortages or specialized care requirements that cannot be accommodated under blanket waivers alone.

Scope and Limitations of HHS Waivers

HHS waivers are specific to the provision of care and generally address conditions of program participation, certification requirements, and timetables or deadlines. Although certain sanctions may be temporarily lifted, Medicare coverage or payment rules generally cannot be waived, even in a disaster or emergency. Similarly, HHS may modify deadlines, it cannot eliminate them.

Waivers are typically retroactive to the effective date of an emergency declaration. For instance, the emergency declaration for North Carolina, signed on September 28, 2024, was retroactive to September 25, 2024. These waivers remain in effect for the duration of the public health emergency.

Examples of Waivers

HHS waivers can provide crucial regulatory relief for hospitals, nursing facilities, and other provider types in disaster-affected areas. For example, blanket waivers issued following natural disasters may allow acute care hospitals to use designated psychiatric or rehabilitation units for non-critical inpatients, enabling more efficient patient management. Similarly, waivers may permit critical access hospitals (CAHs) to exceed the standard 25-bed limit and the 96-hour length of stay requirement to manage surges in patient volume. And waivers can permit nursing homes to conduct patient visits via telehealth to ensure continuity of care for vulnerable populations.

HHS can also authorize states to temporarily relax medical licensing requirements to maximize healthcare provider availability. For instance, when California was impacted by extreme wildfires in 2017, the state requested and received a waiver allowing expedited provider enrollment through the temporary suspension of  specific screening requirements, including application fees, site visits, and background checks.

Such HHS licensing flexibilities do not override state licensing laws. Instead, they allow states to exercise greater latitude in establishing their own frameworks for rapid response, thus maximizing the availability of healthcare providers during emergencies while ensuring legal compliance.

EMTALA and HIPAA Waivers

HHS can use 1135 waivers to temporarily suspend certain sanctions under the Emergency Medical Treatment and Labor Act (EMTALA) and the Health Insurance Portability and Accountability Act (HIPAA), two foundational laws in American healthcare.

Under certain EMTALA waivers, hospitals in affected areas may be allowed to redirect or relocate individuals seeking emergency care to alternative sites for screening. This makes it possible for hospitals to manage overcrowding and triage patients effectively. Designated hospitals may also be authorized to transfer patients with unstable conditions without incurring the usual EMTALA penalties, provided the transfer is justified by emergency circumstances.

HHS may choose to temporarily suspend specific HIPAA penalties during PHEs. This gives healthcare providers the flexibility to share essential information without fear of regulatory penalties. Although the HIPAA Privacy Rule remains intact, temporary relief from sanctions under the act allows providers to coordinate with other agencies and ensure seamless communication during critical moments.

HIPAA waivers may apply to the following provisions:

1. Obtaining a patient’s consent to share information with family or friends involved in their care.
2. Honoring requests to opt out of a facility directory.
3. Distributing notices of privacy practices to patients.
4. Allowing patients to request privacy restrictions or confidential communications.

HIPAA waivers are typically limited to hospitals that have activated their disaster protocols and apply for up to 72 hours from when the protocol is implemented. If the public health emergency or disaster declaration ends sooner, hospitals must resume full HIPAA compliance immediately, even if the 72-hour period has not elapsed.

Other waiver types

HHS can issue waivers to temporarily waive the Medicare requirement for a three-day inpatient hospital stay before skilled nursing facility (SNF) coverage. HHS exercised this authority to issue “1812(f) waivers” in response to both Hurricane Helene and Milton. Similarly, 1812(f) waivers issued during New Mexico wildfires in 2022 and Oregon wildfires in 2020, allowed Medicare to cover SNF care for “beneficiaries who were evacuated, discharged early to free up hospital space, or needed SNF care due to the emergency, without a prior three-day hospital stay.”

Additionally, HHS has authority to waive certain sanctions under Section 1877(g) of the Social Security Act, The Stark Act. Waivers may also extend the appeal period for Medicare beneficiaries seeking review of coverage or payment decisions.

Applying for Individual Waivers

Implementation of disaster waivers should never be assumed, even when a PHE is in effect. Instead, healthcare providers should consult the websites of the HHS Administration for Strategic Preparedness and Response (ASPR) or the Centers for Medicare & Medicaid Services (CMS) to verify current waivers, relevant guidelines, and effective dates.

Providers needing relief beyond what is offered in blanket waivers may submit formal requests for individual waivers through the CMS portal, which lists each PHE currently in effect. Requests should specify the regulatory relief required and its relevance to the emergency circumstances. CMS’s Cross Regional Waiver Validation Team reviews each request and typically responds within three days of receipt. Approval is granted on a case-by-case basis, with CMS considering the provider’s operational needs and how it was impacted by the disaster. Approved waivers enable providers to continue delivering essential care without incurring penalties related to compliance or procedural delays.

Requests for waivers of sanctions under the Stark Law should be submitted to 1877CallCenter@cms.hhs.gov with the subject line ‘Request for 1877(g) Waiver.’ The request should include the name and address of the requesting entity; the name, phone number, and email address of the designated representative; the CMS Certification Number (CCN) or Taxpayer Identification Number (TIN) of the entity; and a detailed description of the nature of the request.

Submission of a waiver request does not guarantee approval, and providers should remain in compliance with all applicable statutes until official approval is granted.

Coding and Compliance

To bill for services provided under a disaster waiver, providers should use “DR” or “CR” modifier codes to indicate disaster-related services. To avoid compliance issues, providers should review current guidance on the CMS website for specific coding requirements.

If your organization requires assistance in applying for an individual 1135 waiver to address unique challenges in care delivery during a PHE, we encourage you to contact a member of Applied Policy’s healthcare services team.