Public Health vs. Patient Privacy – How Coronavirus Is Putting HIPAA to the Test

In a recent blog post, colleagues in our Employment, Labor & Workforce Management practice addressed the legal framework pertaining to coronavirus (COVID-19) risks in the workplace.  As the number of cases continues to the climb in the U.S., it is imperative that HIPAA covered entities and their business associates are aware of their privacy and security responsibilities in the midst of this public health emergency.  EBG provides this guidance on how to effectively respond to the coronavirus public health crisis while navigating patient privacy issues.

Last month, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) provided a bulletin to assist entities in determining ways patient information could be permissibly shared in compliance with HIPAA in the event of an outbreak of infectious disease or other emergency situations.  The regulators are onboard with dissemination of protected health information (PHI) to support public health. OCR has outlined several ways by which the HIPAA Privacy Rule permits entities to disclose PHI without a patient’s authorization:

1. Covered entities may disclose PHI about the patient as necessary to treat the patient or to treat a different patient.
2. Covered entities may disclose requested PHI to a public health authority, a foreign government agency (at the direction of a public health authority) that is collaborating with the public health authority, and persons at risk of contracting or spreading a disease or condition if authorized by law.
3. Covered entities may share PHI with a patient’s family, friends, relatives, or other persons identified that were involved in the patient’s care.
4. Health care providers may share PHI with anyone in order to prevent or lessen a serious and imminent threat to the public health and safety.

Health care providers are required to comply with the “minimum necessary” standard when disclosing PHI of patients with the coronavirus, which means that such providers must make reasonable efforts to disclose only the patient information necessary to achieve the purpose of the disclosure.  In addition, during emergencies, covered entities must implement reasonable safeguards to protect PHI against any “intentional or unintentional uses and disclosures” in violation of HIPAA.

As public health agencies and entities feverishly work together to contain the spread of coronavirus and treat affected individuals in the U.S., it is vital that entities leverage this HIPAA guidance to effectively share patient information while protecting privacy.  Effective response to public health crises will require striking this appropriate balance of interests.