The Office for Civil Rights within the Department of Health and Human Services (OCR) provided guidance in June that reassured covered entity health care providers and that it is generally OK to use or disclose protected health information (PHI) to contact individuals who have recovered from COVID-19 for case management and care coordination.

The OCR has now updated the guidance (“Guidance”) to clarify that health plans may also use or disclose PHI  for purposes of contacting individuals who have recovered from COVID-19 about donating plasma containing antibodies .  The Guidance also emphasizes neither health care providers nor health plans can receive any payment from or on behalf of a blood or plasma donation center in exchange for making  these communications without first getting each individual’s written authorization.   Accordingly, both types of covered entities must carefully navigate when such outreach is considered “marketing” and requires prior authorization.

The HIPAA regulations define “marketing” as making “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service,” unless an exception applies.  Exceptions include situations involving communications for treatment and specified  purposes involving the covered entity’s “health care operations” (as that term is defined in the regulations), as long as the covered entity does not receive “financial remuneration” in exchange for making the communication. The regulations define “financial remuneration” as “any direct or indirect payment from or on behalf of a third party whose product or service is being described,” but does not include “any payment for treatment of an individual.”  45 C.F.R. 164.501.

Interestingly, the Guidance does not precisely track the marketing definition and its exceptions, but interprets the “health care operations” exception for “case management or care coordination … and related functions”  as permitting the use of PHI for this type of outreach, as long as no financial remuneration is involved.

This means that there are certain situations in which a health plan or health care provider that is a covered entity may use and/or disclose PHI of recovered COVID-19 patients to encourage them to donate plasma, and others in which it may not (without first getting the patients’ written HIPAA authorizations):

Allowed:  a covered entity may use member or patient information to contact the covered entity’s own members or patients to encourage them to donate plasma, if: (i) it is to facilitatd the supply of donated plasma would be expected to improve case management for infected individuals; and (ii) the covered entity does not receive financial remuneration from or on behalf of any blood or plasma donation center

 Allowed:  a covered entity may disclose member or patient information to a blood or plasma donation center that is acting as its business associate in order to improve the covered entity’s ability to conduct case management [while not expressly mentioned in the Guidance, if the center pays the covered entity, the existence of a business associate agreement may not protect the center from allegations that it is really an improper marketing arrangement]

X    Not Allowed:  a  covered entity MAY NOT disclose member or patient information to a blood or plasma donation center so that the donation center can reach out to recovered individuals for its own purposes, even if the plan or provider does not receive financial remuneration in exchange for the PHI

X    Not Allowed:  a covered entity MAY NOT use member or patient information to contact those recovered from COVID-19 to encourage them to donate plasma, if the covered entity received financial remuneration from or on behalf of the blood or plasma to make the communication

In all cases, a covered entity that intends to rely upon the Guidance should carefully document all aspects of the planning and execution of the uses and disclosures of member or patient PHI, including the determination as to whether a HIPAA authorization is required, prior to the use or disclosure of PHI related to potential plasma donation.

[View source.]