Federal health care privacy laws, most notably privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), permit covered entities to disclose information concerning COVID-19 victims in some circumstances. These “covered entities” include health care providers, health insurers, and employer-funded health plans. State-mandated restrictions and reports concerning infectious diseases also are permitted under HIPAA.
1. Disclosures Permitted
Existing HIPAA provisions allow disclosure of information concerning COVID-19 victims for treatment purposes, to family and friends involved in the infected person’s care, in circumstances suggesting an imminent danger to the infected individual or to others, or to business associates acting on behalf of or for the benefit of the covered entity. The Secretary of Health and Human Services has the power to waive restrictions on disclosure, but has not done so as yet.
2. Public Health Reporting
HIPAA permits disclosures concerning communicable diseases to public health authorities under HIPAA’s provisions concerning disclosures that are “required by law.” Public health authorities may be federal, such as the Centers for Disease Control and Prevention, or local, like the county health department. Specific rules will apply to specific categories of health care providers; e.g., hospitals, laboratories, long-term care facilities.
3. Business Associates
This is a good time to remember that business associates also are subject to HIPAA’s restrictions on the disclosure of identifiable health information. Particularly as regards to electronic health information, business associates must observe most of the security standards demanded of covered entities. This is a good time to review, or put in place, required policies and procedures.
4. The Media
There is no special dispensation for the media under HIPAA’s prohibition against disclosures of identifiable health information. The information a facility may disclose concerning a patient or resident (unless that patient or resident has objected) is limited to “status” information (condition is “stable,” “good,” etc.) and when the provider believes the release of such information is in the individual’s best interests. Specific health information should not be shared.
5. Long-Term Care
Given their care of especially vulnerable, elderly populations, long-term care facilities (e.g., assisted living, nursing, or rehabilitation facilities) operate currently under enhanced restrictions by the state. Access to residents and patients is being restricted. Reporting of “novel influenza” is mandatory. Special emphasis by state regulators is being placed on infection control, such as health screening or gathering information about recent travel by staff, visitors, or vendors. Persons presenting with concerning information or symptoms may be denied access to a facility. Facilities are strongly encouraged to post a notice to visitors concerning preventative policies and measures.
6. Public Events
The governors of both Oregon and Washington have declared a state of emergency and issued by executive order restrictions on gatherings of 250 or more persons for social, spiritual, and recreational purposes. The restrictions in Washington are currently effective through March 31, 2020. In Oregon, the restrictions are in force until April 8, 2020. Both sets of emergency restrictions are enforceable by criminal sanctions.
