We have already seen extensive regulatory responses to the COVID-19 public health emergency. On March 24, 2020, the Office for Civil Rights (“OCR”), a department of the U.S. Department of Health and Human Services (“HHS”) issued guidance clarifying when entities covered under HIPAA and the Privacy Rule can disclose the protected health information (“PHI”) of patients exposed to COVID-19 to first responders and other individuals.

The guidance reiterates that covered entities can disclose the PHI of individuals infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities without the patient’s HIPAA authorization in the following circumstances:

• To provide treatment, such as when emergency medical transport personnel need to provide treatment during the transfer of a patient from a SNF to a hospital’s emergency room.
• When required by law, such as mandatory reporting to public health officials, under applicable state law, of individuals testing positive for COVID-19.
• To prevent or control spread of disease. HIPAA permits disclosure to public health authorities that are authorized to receive PHI for the purpose of controlling disease (like the CDC or local public health departments).
• When first responders may be at risk. Covered entities may disclose PHI to first responders or others charged with protecting the health and safety of the public (such as firemen, police officers, child welfare workers, etc.) if disclosure is necessary to prevent or minimize the exposure threat of these individuals while they perform their duties.
• If requested by a correctional facility, that has lawful custody of an inmate or other individual. A law enforcement official or correctional facility may receive PHI if:
  • Treating the individual;
  • For the public and safety of the inmate or other individuals at the correctional facility;
  • To law enforcement on the premises of a correctional facility; or
  • For the administration and maintenance of safety, security, and good order of the facility.

Covered entities disclosing PHI for the above reasons must still make reasonable efforts to limit the information provided to that which is the “minimum necessary” to accomplish the reason for disclosure.  

The full text of the guidance can be found here.

Contacts:

Sarah Churchill Llamas l 512.370.2889 l sllamas@winstead.com 

Corinne Smith | 512.370.2808 | cssmith@winstead.com

Kevin Wood | 512.370.2826 | kwood@winstead.com

Disclaimer: Content contained within this news alert provides information on general legal issues and is not intended to provide advice on any specific legal matter or factual situation. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional counsel.