The HHS Office for Civil Rights, which enforces HIPAA’s Privacy Rule, has released guidance for covered entities and business associates to describe information flows in the event of an emergency, such as Hurricane Katrina. Covered entities should consider incorporating this guidance in their Privacy Policies and Procedures.