OCR Issues Guidance on Allowable Disclosures of PHI to First Responders During the COVID-19 Crisis
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has issued further guidance on HIPAA and COVID-19, the disease caused by the 2019 Novel Coronavirus, SARS-CoV-2. The new guidance document provides examples of allowable disclosures of protected health information (PHI) by covered entities under the HIPAA Privacy Rule to help make sure first responders and others receive PHI about individuals exposed to SARS-CoV-2 or displaying symptoms of COVID-19.
The new guidance document is in Q&A form and explains when covered entities are permitted to disclose PHI such as names and other identifying information to first responders, law enforcement officers, paramedics, and public health authorities without first obtaining a HIPAA authorization.
The document confirms that under the HIPAA Privacy Rule, disclosures of PHI are permitted when the information is required to provide treatment, when a disclosure is required by law, when first responders such as paramedics are at risk of contracting COVID-19 and need information to prevent infection, and when a disclosure could prevent or lessen a serious and imminent threat.
OCR also confirms that a disclosure of PHI is permitted when responding to a request for PHI from a correctional institution or law enforcement official in lawful custody of an inmate or other individual, and PHI is required in order to provide healthcare services to the individual, to ensure the health and safety of the individual or others in the institution, those required to transport the individual, and when PHI is required to maintain safety, security, and good order in a correctional institution.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR explains that a hospital is permitted to provide a list of names and addresses of all individuals known to have tested positive for COVID-19 to an EMS dispatch for use on a per-call basis. That information can then be used to ensure that any personnel responding to an emergency at the patient’s location knows they must take extra precautions to ensure their own safety, such as wearing personal protective equipment (PPE).
911 call center staff may ask for information about a patient’s symptoms in order to determine whether there is a risk they have been infected with SARS-CoV-2. Information may then be passed to law enforcement officers and others responding to an incident at the person’s location to ensure they take steps to protect themselves.
In all cases, a covered entity must make reasonable efforts to limit the disclosed information to the minimum amount necessary to accomplish the purpose for the disclosure.
“Our nation needs our first responders like never before and we must do all we can to assure their safety while they assure the safety of others,” said Roger Severino, OCR Director. “This guidance helps ensure first responders will have greater access to real time infection information to help keep them and the public safe.”
The guidance document – COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities – can be found on the HHS website on this link (PDF).
