New HIPAA guidance clarifies when healthcare providers may disclose information about patients who may have been infected with or exposed to COVID-19 to law enforcement, paramedics, first responders and public health authorities.

The guidance, issued by the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS), adds to previous guidance that was released earlier in March. (See our summary of the previous guidance.) OCR indicated the guidance is designed to help “ensure first responders will have greater access to real-time infection information to help keep them and the public safe.”

Here are some key takeaways from the guidance.

OCR highlights several existing HIPAA provisions that allow healthcare providers to share PHI with emergency responders, law enforcement, and others in the context of COVID-19 without the authorization of the patient.

OCR reviews many of the provisions covered in its previous guidance document, but includes new examples of how these provisions apply to COVID-19.

  • PHI can be shared when disclosure is needed to provide treatment. For example, a nursing home can disclose health information about a resident who has COVID-19 so that emergency responders can provide treatment while transporting the resident to a hospital.
  • PHI can be shared when law enforcement or first responders may be at risk of infection. OCR’s examples include:
    • A county health department disclosing PHI to a police officer or other person who may come into contact with a person who tested positive for COVID-19, and
    • A hospital providing a list of names and addresses of all individuals it knows to have tested positive, or received treatment, for COVID-19 to an EMS dispatch for use on a per-call basis.
  • PHI can be shared when necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public. OCR indicates that PHI can be disclosed about patients who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisis services personnel, or others charged with protecting the health or safety of the public if the healthcare provider believes in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to such individuals.

The Bottom Line

HIPAA gives healthcare providers leeway to make certain types of disclosures related to COVID-19 without the patient’s authorization, especially when it comes to protecting the health and safety of first responders. At the same time, patient privacy should remain a priority and disclosures should be limited to the “minimum necessary” amount of information to accomplish the purpose of the disclosure.

Read the full OCR guidance document.

If you have any questions about HIPAA and COVID-19, contact an attorney from the Woods Rogers Health Law Group.

Read more legal updates on COVID-19 from Woods Rogers attorneys.