The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) released additional guidance on HIPAA and COVID-19, the illness resulting from the 2019 Novel Coronavirus or SARS-CoV-2. The latest guidance document gives covered entities the cases of permitted disclosures of protected health information (PHI) according to the HIPAA Privacy Rule to ensure that first responders to people exposed to SARS-CoV-2 or showing signs of COVID-19 can disclose their PHI.
The latest guidance uses a Q&A format and makes clear when covered entities are allowed to share PHI including names and other ID details to first responders, police officers, public health specialists and paramedics without first needing a HIPAA authorization.
The document concurs that the HIPAA Privacy Rule permits disclosures of PHI if the data is necessary to give treatment when the law requires disclosure, when first responders like paramedics are vulnerable to getting COVID-19 and require data to avoid infection, and when disclosure can stop or minimize a critical and impending threat.
OCR additionally stated that a PHI disclosure is allowed whenever a request for PHI is made by a correctional institution or a police officer in legal custody of an inmate or another person, and PHI is needed to provide medical services to the person, to make sure the health and security of a person or other people within the institution, those transporting the person, and when PHI is needed to preserve security, protection, peace and order within a correctional institution.
OCR clarifies that a hospital is allowed to give an EMS dispatch a listing of names and addresses of all people identified to be positive for the COVID-19 test to be used on a per-call basis. The availability of that data ensures that any staff going to a patient’s location in response to an emergency is aware of the need to take extra safety measures, such as putting on personal protective equipment (PPE), to protect their own health and wellbeing.
911 call center personnel may request data concerning a patient’s signs or symptoms to know if there’s a probability of infection with SARS-CoV-2. The data is then handed to law enforcement authorities and other people who responded to an occurrence at the person’s place to make sure they do something to secure themselves.
In all instances, a covered entity should take reasonable attempts to restrict the disclosed data to the least amount required to achieve the reason for the disclosure.
OCR Director Roger Severino stated that the country needs the help of first responders now more than ever and OCR should do all that is necessary to keep them safe while they help other people. This guidance document helps make certain that first responders have access to updated infection data so that they remain safe including the public.
The guidance document entitled COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders, and public health authorities may be downloaded from the HHS website.