With paramedics, law enforcement, public health authorities and other first responders at the forefront in helping combat COVID-19, the sharing of protected health information (PHI) with them is often critical to ensure that they can keep themselves and the public safe. Recognizing this, the Office for Civil Rights (OCR) at the Department of Health and Human Services released guidance explaining when covered entities (e.g., health care providers and health plans) can disclose the PHI of individuals who have been infected with or exposed to COVID-19 to first responders, such as law enforcement, paramedics and public health authorities, without the individuals’ authorization.

Specifically, the guidance permits covered entities to disclose PHI in the following circumstances:

• For treatment purposes. For example, HIPAA permits a covered rehabilitation center to disclose PHI about an individual who has COVID-19 to an EMS dispatcher who will provide treatment while transporting the individual to a hospital. 45 CFR 164.502(a)(1)(ii); 45 CFR 164.506(c)(2).
• When first responders may be at risk for an infection. For example, in accordance with state law, HIPAA permits a covered health department to disclose PHI to a police officer about an individual that tested positive for COVID-19 with whom the police officer came into contact. 45 CFR 164.512(b)(1)(iv).
• When necessary to prevent or lessen a serious and imminent threat. For example, consistent with applicable law, HIPAA allows a provider to disclose PHI about individuals who have tested positive for COVID-19 to those charged with protecting the health and safety of the public, such as fire department personnel, child welfare workers and mental health crisis services personnel, if the provider believes in good faith that the disclosure of the information is necessary to thwart or lessen the threat of imminent exposure of COVID-19 to such personnel when they carry out their duties. 45 CFR 164.512(j)(1).
• When required by law. For example, if state law requires the reporting of confirmed COVID-19 cases to public health authorities, HIPAA permits such disclosure in accordance with that state law. 45 CFR 164.512(a).

The guidance goes on to remind covered entities that unless the disclosure is required by law or for treatment purposes, covered entities must limit the information used or disclosed to that which is the minimum necessary to accomplish the purpose for the disclosure. Consequently, covered entities should continue to evaluate the PHI they are disclosing to ensure compliance with HIPAA’s “minimum necessary” rule.

While the guidance provides other examples of permitted uses and disclosures, these are the common exceptions covered entities should look to when determining whether they can disclose PHI to first responders. However, if you have any questions or want to talk about other permitted uses and disclosures of PHI under HIPAA, please feel free to reach out to any member of our team.