HIPAA and COVID-19

We are empowering medical providers to serve patients wherever they are during this national public health emergency. We are especially concerned about reaching those most at risk, including older persons and persons with disabilities.

Roger Severino, OCR Director

How HIPAA has changed in relation to COVID-19

The COVID-19 pandemic has changed the way we administer health care in this country. One thing that has changed is that some details about the way health professionals can share patient information has been modified. Here is a quick overview of HIPAA as it is relevant to the current pandemic , and a brief update on what has changed.

The COVID-19 outbreak imposes additional challenges on health care providers. Some of us may have questions about the ability of healthcare providers to share information, including with friends and family, public health officials, and emergency personnel. In summary, the HIPAA Privacy Rule allows patient information to be shared to assist in nationwide public health emergencies, and to assist patients in receiving the care they need. The HIPAA Privacy Rule is not suspended during a public health or other emergency, but the Secretary of HHS may waive certain provisions of the Privacy Rule. In response to the President’s declaration of a nationwide emergency concerning COVID-19, the Secretary of the U.S. Department of Health and Human Services, Alex M. Azar, has exercised the authority to waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the HIPAA Privacy Rule:

To obtain a patient’s agreement to speak with family members or friends involved in the patient’s care.

• To honor a request to opt out of the facility directory.
• To distribute a notice of privacy practices.
• The patient’s right to request privacy restrictions.
• The patient’s right to request confidential communications.

Here is a link to the original HIPPA and COVID-19 Bulletin: Bulletin

Some HIPAA regulations have not changed, but are relevant to the COVID-19 pandemic

HIPAA has always allowed for sharing protected health information with law enforcement, paramedics, other first responders and public health authorities. When the disclosure is needed to provide treatment, for example, HIPAA permits a covered skilled nursing facility to disclose PHI about an individual who has COVID-19 to emergency medical transport personnel who will provide treatment while transporting the individual to a hospital’s emergency department. Here is a link to the rules governing law enforcement and first responders: First Responders.

Public health authorities are another class of entities who are allowed access to protected health information for the purpose of preventing or controlling disease, injury or disability.

A covered entity may share protected health information with a patient’s family members, relatives, friends, or other persons identified by the patient as involved in the patient’s care. A covered entity also may share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death. This may include, where necessary to notify family members and others, the police, the press, or the public at large. Here is a link to the rules concerning notifications to family: Family

The world is in the midst of a public health crisis, the magnitude of which remains to be seen. The privacy of protected health information may not be at the forefront of anyone’s concerns, but patients’ right to privacy still exists and still matters. Stay safe, everyone.