HHS Drafts HIPAA Guidance on Disclosure to COVID-19 First Responders

With the Coronavirus (COVID-19) pandemic widening across the U.S., the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) has issued direction on how health care entities can pass along HIPAA-protected health information (PHI) to first responders.

The March 24, 2020, bulletin lays out circumstances for which covered entities are allowed release PHI about someone who is infected with or exposed to COVID-19, to law enforcement, paramedics and other first responders – without the patient’s authorization but in compliance with HIPAA.

When Can HIPAA-Protected Coronavirus Patient Information Be Disclosed?

In its bulletin, the OCR-HHS states that situations for which HIPAA-protected health information of a patient who has, or has been exposed to, COVID-19 can be released to first responders include:

• When needed to provide treatment: As an example, a “covered skilled nursing facility [can] disclose PHI about an individual who has COVID-19 to emergency medical transport personnel who will provide treatment while transporting the individual to a hospital’s emergency department.”
• When required by law: “HIPAA permits a covered entity, such as a hospital, to disclose PHI about an individual who tests positive for COVID-19 in accordance with a state law requiring the reporting of confirmed or suspected cases of infectious disease to public health officials.”
• When first responders may be at risk for an infection: “HIPAA permits a covered county health department, in accordance with a state law, to disclose PHI to a police officer or other person who may come into contact with a person who tested positive for COVID-19, for purposes of preventing or controlling the spread of COVID-19.”
• When disclosure is necessary to prevent or lessen a serious and imminent threat: “HIPAA permits a covered entity, consistent with applicable law and standards of ethical conduct, to disclose PHI about individuals who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisis services personnel, or others charged with protecting the health or safety of the public if the covered entity believes in good faith that the disclosure of the information is necessary to prevent or minimize the threat of imminent exposure to such personnel in the discharge of their duties.”
• For correctional institutions or law enforcement officials having lawful custody of an inmate: “HIPAA permits a covered entity, such as a physician, located at a prison medical facility to share an inmate’s positive COVID-19 test results with correctional guards at the facility for the health and safety of all people at the facility.”

‘Reasonable Efforts’ Must Be Made to Limit PHI

The OCR-HHS bulletin also stresses that, “Except when required by law, or for treatment disclosures, a covered entity must make reasonable efforts to limit the information used or disclosed under any provision [listed in the above circumstances] to that which is the ‘minimum necessary’ to accomplish the purpose for the disclosure.”

Let Us Keep You Informed, Compliant with HIPAA

We at Chapman Law Group understand that this OCR-HHS HIPAA notice comes at a critical time for medical professionals.

Health care practices are facing not just a surge of patients being tested or treated for Coronavirus, but also the potential for exposure. Employers and employees must stay concerned with having proper protection and safety measures at the work site. And temporary changes to state and federal health policy and practice are being issued at a rapid clip.

Through it all, our health care lawyers are here to help you make sense of what is happening. We’re here to advise you on staying compliant with HIPAA and to keep you informed about other compliance matters your practice may be facing. 

The health care compliance attorneys at Chapman Law Group have vast experience in state and federal health care regulations and best practices across the U.S. One of our lawyers is a former Medicare attorney, another is a former Medicaid fraud prosecutor, and each of us holds an LL.M. in Health Law from Loyola University Chicago School of Law — the top school in the U.S. for healthcare law.

Our extensive experience in key areas of regulatory compliance in healthcare include:

• • Anti-kickback (federal and state specific) and self-referral laws
  • Audits and appeals
  • CMS and third-party appeals
  • Controlled substances issues
  • DEA compliance
  • Developing a compliance program
  • False claims act concerns
  • Health reform initiatives
  • Medicaid audits and appeals
  • Medicare MAC audits and appeals
  • Patient data privacy under HIPAA and HITECH
  • Peer review and credentialing best practices
  • Pharmacy FDA inspections
  • Regulatory Compliance
  • Reimbursement and self-disclosure inquiries
  • Telemedicine

We represent licensed medical professionals, including:

• • Physicians
  • Nurses and nurse practitioners
  • Dentists
  • Pharmacists
  • Pain management specialists
  • Chiropractors
  • Mental health professionals
  • Uninsured healthcare providers
  • Other licensed medical professionals

Our offices are in Detroit; Miami and Sarasota, Florida; Los Angeles/Southern California; and Chicago. Contact us today so we may answer any questions you have about compliance and all other legal matters that concern your practice.