Do individuals maintain their right to privacy during the COVID-19 Pandemic? Yes and no. Given the national public health emergency and the existence of enforcement waivers relative to certain state and federal privacy and security provisions, a patient’s right to confidentiality is trumped by the incredible weight of the public interest to report and monitor cases of COVID-19. While a provider will not release a patient’s name or address, if the patient tests positive for coronavirus, the region or state in which he/she lives will be notified. Certain demographics will also be released, likely to include the patient’s age, gender, recent activities and places visited. In addition, that information may be locally publicized to raise awareness.

The local Department of Health will likely be asked to conduct “contact tracing” that will track the patient’s last two or three weeks (long enough to cover the incubation period or from date of known or presumed exposure) of activities, places visited or worked. In the course of the investigation, certain information about the patient may be released to those who may have had direct exposure to the patient. Under HIPAA, given the nature of the epidemic, the public has a legitimate need to access, use, disclose and manage the information in order to contain, control and quash the coronavirus. See more on HIPAA Privacy and Disclosure in Emergency Situations.