On February 3, 2020, the U.S. Department of Health and Human Services (HHS) issued a bulletin (the Bulletin) to remind covered entities and business associates of how patient information may be shared under HIPAA in the event of an emergency, such as an outbreak of infectious disease. The Bulletin was issued in response to the emergence of the Coronavirus (2019-nCoV), and reiterates that HIPAA’s Privacy Rule is “balanced to ensure that appropriate uses and disclosures” of patient information can be made to treat patients, as well as for public health and other critical purposes.
The Bulletin reviews when patient information may be disclosed without a patient’s authorization in certain instances that may be relevant to an outbreak of infectious disease (including for treatment purposes); public health activities; to family, friends and others involved in care and for notification; to prevent a serious and imminent threat; and to the media. The Bulletin reminds covered entities and business associates that most such disclosures must adhere to the minimum necessary standard, except for those made for treatment purposes.
Of particular relevance in an outbreak situation, the Bulletin notes that disclosures for public health activities can include disclosures to public health authorities authorized by law to collect or receive such information in order to prevent or control disease, injury, or disability, and disclosures made at the direction of a public health authority to a foreign government agency collaborating with the public health authority. Disclosures may also be made to persons at risk of contracting or spreading a disease or condition, to the extent authorized under state law.
Finally, the Bulletin emphasizes the importance of safeguarding protected health information under HIPAA in an emergency situation, and states that covered entities “must continue to implement reasonable safeguards to protect” against impermissible uses and disclosures.
The Bulletin is a timely reminder of HIPAA’s requirements – and its allowances – applicable to covered entities and business associates that might be implicated in the event of an outbreak of disease. Covered entities would be well advised to incorporate a review of HIPAA restrictions on uses and disclosures of health information as part of disaster readiness planning as hospitals and other providers prepare for potential cases of Coronavirus, influenza, and other infectious diseases.