The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services recently released guidance clarifying that, in certain circumstances, providers may, in a HIPAA-compliant manner without obtaining individual patient HIPAA authorizations, identify patients who have recovered from COVID-19 and provide them with information about how they can donate their blood and plasma to help treat other patients with COVID-19. Specifically, the HIPAA privacy rule permits covered entities (i.e., providers, or their business associates on their behalf) to use or disclose protected health information (PHI) for their own treatment, payment, or health care operations purposes. Included in the definition of “health care operations” purposes are population-based case management activities relating to improving health, and these COVID-19-related activities would fall within that category.

In providing this guidance, OCR reminds providers that although such uses of patient information are permissible, providers must make reasonable efforts to limit the uses of patient information to the minimum necessary to accomplish their intended purpose. Furthermore, health care providers cannot conduct such activities without HIPAA authorizations if such activities would constitute “marketing” activities under HIPAA. Generally, communications for population-based case management or related health care operations functions would not be “marketing” communications if the provider sending such communications does not receive any direct or indirect payment from, or on behalf of, any third party whose service is being described in the communication, such as a blood and plasma donation center. Lastly, even if there is no “marketing” issue under HIPAA, a covered entity, such as a provider, must send the communication to patients and generally may not (without authorization) disclose patient information to a third party to allow the third party to send communications to patients about the third party’s products and services.