OCR issues guidance on permitted health information sharing to protect US law enforcement and first responders

On March 24, 2020, the US Department of Health and Human Services Office for Civil Rights (HHS-OCR) issued guidance clarifying that a HIPAA-covered entity may, under certain circumstances, disclose protected health information (PHI) about an individual who has been infected with, or exposed to, the virus SARS-CoV-2, or the disease caused by the virus, COVID-19, to law enforcement, paramedics, other first responders and public health authorities without an individual’s authorization. The HIPAA Privacy Rule freely permits such disclosures so that recipients are aware of the risk of transmission of a virus or disease and are able to take action to protect themselves, such as wearing personal protective equipment (PPE). Applicable rules also safeguard the public by allowing the collection, use and disclosure of health information by public health authorities who are empowered to conduct public health surveillance, investigations and interventions, including those that are key to fighting the spread of COVID-19. 

Permitted disclosures include the following:

• For treatment purposes,[1] such as where a skilled nursing facility discloses PHI about an individual with COVID-19 to emergency transport personnel who will be transporting the individual to the hospital.
  
  
• Where required by law,[2] such as the disclosure by a hospital of PHI about an individual who tested positive for COVID-19 to state public health officials in accordance with state law requiring reporting of infectious diseases.
  
  
• To a public health authority,[3] such as the Centers for Disease Control and Prevention (CDC) or local or state health departments for public health investigations and interventions to prevent community spread.  These disclosures are discussed in more detail here.  
  
  
• When first responders may be at risk,[4] a covered entity may disclose PHI to a first responder who may have been exposed to COVID-19 or is at risk of contracting or spreading the virus, if authorized by law. For example, a HIPAA-covered county health department may, in accordance with state law, disclose PHI to a police officer who may come into contact with a person who tested positive for COVID-19.
  
  
• When disclosure to first responders is necessary to prevent or lessen a serious and imminent health and safety threat.[5] For example, a covered entity may, consistent with applicable law and standards of ethical conduct, disclose PHI about individuals who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisis services personnel or others charged with protecting the health or safety of the public if the covered entity believes in good faith that the disclosure of the information is necessary to prevent or minimize the threat of imminent exposure to such personnel in the discharge of their duties.
  
  
• To a correctional institution or law enforcement official having lawful custody of an inmate[6], such as disclosure by a correctional facility physician about an inmate’s positive COVID-19 test result to correctional guards for the health and safety of all people at the facility.

While clarifying that disclosures of PHI for these public policy purposes are permitted, HHS-OCR emphasized that, other than for treatment purposes and where required by law, permitted disclosures must be limited to the “minimum necessary” to accomplish the purpose for the disclosure.[7]

To illustrate the minimum necessary rules, the guidance provided additional examples involving disclosure of limited information by a hospital to EMS dispatch for use on a per-call basis. According to the guidance, a HIPAA-covered EMS dispatch would be permitted to use PHI regarding a patient who tested positive for COVID-19 to notify particular personnel responding to the emergency call so that they could take extra precautions or use PPE. HHS-OCR was clear in this instance that the dispatch center would not be able to post the contents of an entire list of patients with COVID-19 publicly or distribute an entire list of such individuals to all EMS personnel. Rather, the sharing of PHI must be made on an individualized basis only to those personnel actually responding to a particular call where they might be at heightened risk. 

HHS-OCR also noted that a 911 call center may ask screening questions of all callers to determine whether such callers may be at a heightened risk of having COVID-19. The call center may then share the screening results with responding officers so that they could take proper precautions, even if the nature of the call is for a non-medical situation. HHS-OCR noted that “minimum necessary” in these cases may include the individual’s name and the result of the screening.

HHS-OCR reminded entities to consult other applicable laws, such as state laws, prior to making disclosures, as such laws may include further restrictions. While HIPAA preempts contrary state law, it does not preempt stricter state laws. As a result, HIPAA sets a floor of privacy protection, not a ceiling. Entities are urged to review the applicable privacy laws in their jurisdictions when updating their policies to address COVID-19 concerns.  

The CDC has also issued guidance designed to safeguard law enforcement personnel and first responders, who are at greater risk of contracting the virus through their official duties. For more information about CDC’s COVID-19 guidance for law enforcement personnel, which recommends steps that such persons can take to protect themselves against exposure, visit https://www.cdc.gov/coronavirus/2019-ncov/community/guidance-law-enforcement.html.

For more information about HIPAA issues related to COVID-19, see our client alerts US HHS issues waiver of certain HIPAA sanctions and penalties amidst COVID-19 and US HHS-OCR Clarifies Waiver of HIPAA Sanctions for Telehealth Services during COVID-19. To learn more about COVID-19 guidance and activities, please contact any member of our Healthcare Industry team or your regular DLA Piper attorney.

Please visit our Coronavirus Resource Center and subscribe to our mailing list to receive alerts, webinar invitations and other publications to help you navigate this challenging time.