On March 24, the Office for Civil Rights at the US Department of Health and Human Services provided guidance on how covered entities may disclose protected health information (PHI) about an individual who has been infected with or exposed to COVID-19 to law enforcement, paramedics, other first responders, and public health authorities in compliance with the Health Insurance Portability and Accountability Act (HIPAA) rules.
The HIPAA rule allows covered entities to disclose, without authorization, the PHI of individuals infected or exposed to COVID-19 in the following circumstances:
- When the disclosure is needed to provide treatment
- When the notification is required by law
- To notify a public health authority to prevent or control the spread of the disease
- When first responders may be at risk of infection
- When disclosing PHI to first responders is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public
Unless required by law or for treatment disclosures, covered entities must make reasonable efforts to limit the information used or disclosed under any of the circumstances above to the “minimum necessary” to accomplish the purpose for the disclosure. Multiple provisions can apply simultaneously, and disclosure for each provision should be limited to the minimum necessary. The purpose of the guidance is to ensure that first responders have greater access to real-time infection information to help keep them and the public safe.
HIPAA-covered entities protected by these provisions are not exempt from the law’s privacy rules. Before disclosing information, health care providers should consult local and state statutes and regulations in their jurisdiction, as these laws may place further restrictions on disclosures that are permitted by HIPAA.
New York State also requires that, unless required by law or compliance review, disclosure shall be the “minimum necessary” needed to accomplish the intended purpose of the use, request, or disclosure.
Barclay Damon attorneys will keep you updated of any further significant developments related to COVID-19 and emergency responders.
If you have any questions regarding the content in this alert, please contact Kadeem Wolliaston, associate, at kwolliaston@barclaydamon.com or another member of the firm’s Health Care & Human Services Practice Area.
We also have a specific team of Barclay Damon attorneys who are actively working on assessing regulatory, legislative, and other governmental updates on non-trademark-related COVID-19 matters and who are prepared to assist clients. You can reach our COVID-19 Response Team at COVID-19ResponseTeam@barclaydamon.com.