Since the COVID-19 outbreak, many health care providers have had a myriad of HIPAA questions, including questions about whether they can share some types of information and, if so, the type of information they can share with first responders who may have been exposed.

Today, the Office for Civil Rights (OCR) published guidance outlining the already-existing HIPAA provisions that permit health care providers to share the name or other identifying information of an individual who has been infected with or exposed to the virus, with paramedics, other first responders, law enforcement and public health authorities, available here.

The guidance addresses some of the most relevant disclosures that are allowed under HIPAA without the individual’s authorization:

• when needed for treatment, when required by law
• to notify a public health authority
• when necessary to prevent or lessen a serious and imminent threat to the health and safety of a person of the public, and
• when responding to a request by a correctional institution or law enforcement official that has custody of an inmate or other individual.

As a reminder, except for disclosures that are required by law or disclosures for treatment purposes, health care providers are required to make reasonable efforts to limit the information to that which is “minimum necessary” to accomplish the purpose of the disclosure.

The OCR also provided a couple of helpful examples that will be relevant to health care providers in the coming days.  Here is one of them:

“Example: A covered entity, such as a hospital, may provide a list of the names and addresses of all individuals it knows to have tested positive, or received treatment, for COVID-19 to an EMS dispatch for use on a per-call basis. The EMS dispatch (even if it is a covered entity) would be allowed to use information on the list to inform EMS personnel who are responding to any particular emergency call so that they can take extra precautions or use personal protective equipment (PPE).

Discussion: Under this example, a covered entity should not post the contents of such a list publicly, such as on a website or through distribution to the media. A covered entity under this example also should not distribute compiled lists of individuals to EMS personnel, and instead should disclose only an individual’s information on a per-call basis. Sharing the lists or disclosing the contents publicly would not ordinarily constitute the minimum necessary to accomplish the purpose of the disclosure (i.e., protecting the health and safety of the first responders from infectious disease for each particular call).”