The Office of Civil Rights of the U.S. Department of Health and Human Services has issued guidance clarifying how HIPAA’s Privacy Rule permits covered entities (in particular, health care providers and health plans) or their business associates to contact former COVID-19 patients about plasma donation to treat or potentially treat patients. The guidance follows the FDA’s approval of blood plasma with COVID-19 antibodies to treat current COVID-19 patients.

The guidance observes that covered entities under HIPAA may also use former COVID-19 patients’ protected health information (PHI) for certain health care operations purposes that are not related to the care of that particular patient. For example, a covered entity may use and potentially disclose such PHI if it would help that entity with the case management of current COVID-19 patients. 

However, the guidance also addresses the limits that apply to the use or disclosure of such information.  Specifically, a covered entity or its business associate may not disclose or use the COVID-19 patients’ information on behalf of a third party. In particular, covered entities need to be careful not to use or disclose PHI for marketing purposes, which may happen, for example, if PHI is used or disclosed to encourage former COVID-19 patients to make a donation at a particular blood or plasma donation center.

In the case of health care operations, covered entities must also make reasonable efforts to use or disclose only the minimum amount of PHI necessary for the particular purpose.