Among a stream of other releases in recent weeks, on March 24 the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services issued guidance to HIPAA-covered entities regarding how they may be able to disclose to law enforcement, paramedics and other first responders the protected health information (PHI) of individuals who have been infected with, or exposed to, COVID-19 without first getting HIPAA authorization from those individuals.
Citing particular provisions of the HIPAA regulations that permit disclosures without HIPAA authorization, the guidance provides a number of scenarios that may be relevant to the current pandemic. Specifically, the guidance discusses disclosures when the first responder may be at risk, when required by law, when needed to provide treatment, when the disclosure is to a public health authority, and when the disclosure is to prevent or lessen a serious and imminent threat to the health and safety of either the first responder or the public.
In one of the examples, the guidance discusses how a covered entity such as a hospital may disclose its records related to individuals it knows have tested positive or received treatment for COVID-19 to an EMS dispatch so that the dispatch may use it on a per-call basis. If EMS personnel are responding to an individual on that list, the guidance states that the EMS dispatch would be permitted to disclose the information to the EMS personnel so that such personnel may exercise extra precaution.
In another example, the guidance states that a 911 call center may ask all callers screening questions related, for instance, to whether the caller has a fever, cough or difficulty breathing. The call center may then use that information to advise a responding police officer of the name, address and screening answers so that the officer may prepare accordingly. In each of the examples, the guidance is careful to point out the limits of the scope of each disclosure.
It is important to note that the guidance does not alter HIPAA or its protections — it merely applies existing bases in the law and its regulations to circumstances relevant to the current pandemic. Also, the introductory language of the guidance mentions that it relates not just to those who have tested positive or been treated for COVID-19, but also to those who have been “exposed to” the virus. While exposure is a broad concept, it is clear from the discussion and examples in the guidance that OCR’s focus is primarily on disclosing the PHI of those who have tested positive or been treated for COVID-19.
View the press release and the text of the guidance.
For more information on COVID-19’s effects on HIPAA, please contact Andrew Stein or the Stevens & Lee attorney with whom you regularly work.
This News Alert has been prepared for informational purposes only and should not be construed as, and does not constitute, legal advice on any specific matter. For more information, please see the disclaimer.
