The Office for Civil Rights, which is the HIPAA enforcement arm of U.S Department of Health and Human Services (HHS), issued guidance today on how entities subject to HIPAA (covered entities) may disclose protected health information (PHI) about an individual who has been exposed to COVID-19 to law enforcement, paramedics, other first responders, and public health authorities in compliance with the HIPAA Privacy Rule.
In its guidance, OCR explains the circumstances under which a covered entity may disclose PHI, such as the name or other identifying information about individuals, without their HIPAA authorization, and provides examples including:
· When needed to provide treatment;
· When required by law;
· When first responders may be at risk for an infection; and
· When disclosure is necessary to prevent or lessen a serious and imminent threat.
Today, OCR clarified the regulatory permissions that a covered entity may use to disclose PHI to first responders and others so they take the necessary precautions or use personal protective equipment. OCR is also careful to remind all covered entities to take reasonable steps to limit the PHI used or disclosed to that which is the “minimum necessary” to accomplish the purpose for the disclosure, which is frankly a good recommendation for all PHI related disclosures, pandemic or not. Even though these are extraordinary times, we must be sure to protect one another’s privacy while also striving to protect the health of our first responders during this crisis. OCR is careful to strike that balance in today’s guidance.
Clients and friends can find the guidance here https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf
Stay safe and healthy!
If you need further information, contact us here.