Whenever patients get an infectious respiratory disease like COVID-19, the immune system produces antibodies that give protection to the body when the pathogen is contracted again. The antibodies found in the blood of patients who get healed from this kind of sickness are invaluable, because they not only give protection to the patient, but that protection can be transmitted to other patients as well.
Two preparations can be made from the donation of plasma and blood: hyperimmune immunoglobulin and convalescent plasma. Hyperimmune immunoglobulin and convalescent plasma were both used to effectively treat patients who got other viral respiratory illnesses. Considering the severeness of COVID-19 and the high fatality rate, these therapies can be important for patients who are finding it hard to combat the illness. Research studies are currently ongoing to test if antibody treatments are potent against COVID-19.
To take part in these programs, previously diagnosed COVID-19 patients must be contacted and questioned if they would like to donate their blood and plasma. However, does the HIPAA Privacy Rule permit this contact?
On June 12, 2020, the Department of Health and Human Services’ Office for Civil Rights published guidance for healthcare organizations regarding the HIPAA Privacy Rule and the permission to get in touch with COVID-19 patients to ask for blood and plasma donations.
According to OCR, the HIPAA Privacy Rule doesn’t stop healthcare organizations from getting in touch with COVID-19 patients to ask for blood and plasma donations and there is no need to ask for prior consent from the patient.
Healthcare organizations can get in touch with patients to tell them about the options to donate blood and plasma to help in the COVID-19 response to boost the chances of other patents to fight the disease.
HIPAA covered entities and business associates responding on their behalf could use or share PHI for reasons of treatment, medical operations, and payment without the need to get patient authorization first. Asking for a blood or plasma donation doesn’t fall under the classification of a treatment since the blood/plasma is not going to be used for patient treatment, rather it is being employed for population-based medical care operations to better health, case supervision, and coordination of care, which are listed in the meaning of healthcare operations.
Certain misunderstandings regarding the contacting of patients to request blood donations would make up marketing communications, which are typically not allowed by the HIPAA Privacy Rule without getting patient authorization first.
In this instance, there is an exception to the Privacy Rule’s Marketing provision as per the OCR guidance. A covered health care entity is allowed to communicate regarding the covered entity’s population-based case supervision and associated medical care operations activities, so long as the covered entity does not get direct or indirect payment from, or for the third party whose service is referred to in the communication (for example, a blood and plasma donation center).
Patient authorization is necessary before disclosing PHI to a third party, like a blood and plasma donation center, to permit contact of a COVID-19 patient to ask for blood and plasma donations on behalf of the donation center’s own needs.