March 23, 2020
On March 25, 2020, the U.S Department of Health and Human Services Office for Civil Rights (“OCR”) issued guidance for covered entities regarding disclosing protected health information (“PHI”) to law enforcement, paramedics, other first responders, and public health authorities during the COVID-19 health emergency.
The guidance explains that, under certain circumstances, a covered entity may disclose the name or other identifying information of an individual who has been infected with, or exposed to, COVID-19 with law enforcement, paramedics, other first responders, and public health authorities without an individual’s authorization without violating the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule. Permitted circumstances for disclosure include:
1. When the disclosure is needed to provide treatment.
2. When the notification is required by law.
3. To notify a public health authority in order to prevent or control spread of disease.
4. When first responders may be at risk of infection.
5. When the disclosure of PHI to first responders is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public.
6. When responding to a request for PHI by a correctional institution or law enforcement official having lawful custody of an inmate or other individual, if the facility or official represents that the PHI is needed for:
a. providing health care to the individual;
b. the health and safety of the individual, other inmates, officers, employees and others present at the correctional institution, or persons responsible for the transporting or transferring of inmates;
c. law enforcement on the premises of the correctional institution; or
d. the administration and maintenance of the safety, security, and good order of the correctional institution.
The guidance reiterates that, except when required by law, or for treatment disclosures, a covered entity must make reasonable efforts to limit the information used or disclosed to that which is the “minimum necessary” to accomplish the purpose for the disclosure.
For more information and examples of the circumstances outlined above, the full press release is available here. As always, we are available to advise and assist you at every turn. Please do not hesitate to reach out to us with any questions.
