The important thing to recognize is that while CMS and the Office of Civil Rights have relaxed certain HIPAA procedures for the course of this national health emergency the rules have been modified and not abandoned. For instance, a covered entity (doctors, hospitals, Federally Qualified Health Centers, etc.) permits “the disclosure of needed health information to CDC on an ongoing basis as needed to report all prior and prospective cases of patients exposed to or suspected or confirmed to have Novel Coronavirus (2019-n-COV).” Office of Civil Rights, U.S. Department of Health and Human Services: Bulletin: HIPAA Privacy and Novel Coronavirus.
Related issues re: disclosure concern disclosures that can be made by non-covered entities which are not subject to the normal HIPAA rules (except with respect to their health plans) and what and how much they can disclose.
In all instances the minimum necessary requirements of HIPAA should be considered and followed with respect to all disclosures.
Our health care lawyers are here to help you through this time in answering these and other questions. Do not hesitate to reach out to any one of us for help.
Including these other issues as they come up:
- Under what circumstances can you now disclose PHI without a patient authorization?
- What if another family member care giver requests PHI re: potential coronavirus infection of another family member?
- Are there rules in effect on how to report relevant information to the relevant state and federal agencies: CDC, state and local health departments?
- Do you need a coronavirus patient's authorization to speak with their family or friends regarding status?
- When are you now required to distribute a notice of privacy practices and when you don’t and how should your regular notice be modified?
- What type of information can you share with a patient regarding their potential exposure to COVID-19?
- What type of information are you allowed to share with the media, should they ask?