On April 14 and 15, 2020, Ohio Department of Health (ODH) Director Amy Acton issued two new orders mandating certain disclosures of COVID-19 case information.

The order issued April 14 requires local health departments to provide the name and address of individuals who test positive for COVID-19 to emergency dispatch agencies in that jurisdiction. The dispatch agencies are permitted to share this information only with first responders who are responding to or may be called to respond to the address of an individual who has tested positive for COVID-19.

The order requires that the information be used solely as necessary to control, mitigate or prevent the spread of COVID-19 during an interaction between a first responder and the individual who has tested positive for COVID-19. The order states that unauthorized use of the information is subject to criminal penalties. It also requires that the information of an individual be “removed from the dispatch agency’s system” once that person has recovered from COVID-19 and of all individuals upon termination of the statewide public health emergency.

The order acknowledges that the information to be disclosed constitutes protected health information. While not cited by the order, Ohio law restricts ODH’s use of protected health information that it has obtained in most instances, however, it makes an exception under R.C. 3701.17(B)(4) to permit disclosure if the “[t]he director determines the release of the information is necessary, based on an evaluation of relevant information, to avert or mitigate a clear threat to an individual or to the public health.” 

The order issued April 15 requires nursing homes and residential care facilities to notify residents (and sponsors or guardians) of positive or probable cases of COVID-19 in the facility of either residents or staff. 

The notification is required to be made within 24 hours after the facility is aware of the confirmed or probable case and must include steps being taken to reduce the spread of infection at the facility. Nursing homes and residential care facilities with current positive or probable cases of COVID-19 are required to make the notification within 24 hours after issuance of this order. A copy of the notification must be provided to ODH.

Nursing homes and residential care facilities should take steps to ensure that they comply with HIPAA while fulfilling the requirements of this order. The order does not state that protected health information, such as the identity of the individual who is positive or probable, is to be included in the notification. Accordingly, nursing homes and residential care facilities should be able to comply with HIPAA while making these notifications. 

[View source.]