PHI may be disclosed as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public based on the health care provider's professional judgment under 45 CFR 164.512(j). The disclosure may be to anyone in a position to prevent or lessen the serious and imminent threat, including family, friends, caregivers, and law enforcement.
PHI may be disclosed as necessary to treat the patient, or to treat a different patient. Treatment includes the coordination or management of health care and related services by one or more healthcare providers and others, consultation between providers, and the referral of patients for treatment.
PHI may be disclosed to public health authorities, such as the Centers for Disease Control and Prevention or a state or local health department, which are authorized to collect or receive such information for the purpose of preventing or controlling disease, injury or disability. This allows disclosure of prior, current, and prospective patients diagnosed with COVID-19; PHI may be disclosed at the direction of a public health authority; and to persons at risk of contracting or spreading COVID-19 so long as state law authorizes the disclosure.
PHI may be disclosed to a patient's family, friends, or other persons identified by the patient as involved in the patient's care, as well as to the police, press, or public. Verbal permission from the patient should be obtained if possible. However, if the patient is incapacitated, then the PHI disclosure should be made based on professional judgment and limited to only necessary and related information. Patient permission is not necessary for disclosures to disaster relief organizations for the purpose of coordinating these family, friend, and caretaker notifications, if doing so would interfere with the organization's ability to respond to the emergency.
Disclosure of Specific, Detailed PHI
Health care providers should obtain a written HIPAA authorization from the patient or the patient's legally authorized representative before disclosing specific, detailed PHI to the media or the public.
Disclosure of Basic, General PHI
If the patient has not objected to or restricted the release of PHI, health care providers may disclose basic information about the patient's general condition (e.g., stable or critical) upon request about a particular patient. If the patient is incapacitated, PHI may be disclosed if it is in the best interest of the patient and consistent with any prior expressed preferences of the patient.
Read the guidance published by the OCR (PDF)