September 16, 2021

Volume XI, Number 259

Advertisement

September 16, 2021

Subscribe to Latest Legal News and Analysis

September 15, 2021

Subscribe to Latest Legal News and Analysis

September 14, 2021

Subscribe to Latest Legal News and Analysis

September 13, 2021

Subscribe to Latest Legal News and Analysis
Advertisement

Friendly Reminder: HIPAA Still Applies During the Coronavirus Outbreak

Our Employment, Labor & Benefits colleagues recently blogged on the coronavirus and its ramifications for employers impacted by the outbreak. As this is still an active outbreak with cases increasing within the United States, it's a good time to review how HIPAA applies in a public health emergency, including its restrictions and flexibility in these types of situations. Accordingly, last week, the Office for Civil Rights (OCR) released a helpful bulletin on how the HIPAA Privacy Rule comes into play with the coronavirus outbreak and other public health emergencies.

The most important thing to remember is that the basic requirements of HIPAA still apply even in a public health emergency. For instance, health care providers must still uphold the “minimum necessary” standard when treating patients with the coronavirus. A covered entity must make a reasonable effort to disclose only the “minimum necessary” protected health information (PHI) to accomplish the purpose. When a public health authority asks a covered entity to disclose information to it for infectious disease reporting, a covered entity can rely that the request meets the “minimum necessary” standard to meet the authority’s public health purpose. Additionally, just because a public health emergency exists does not mean that covered entities can freely disclose patient information. The HIPAA Privacy Rule permits covered entities to disclose PHI without a patient’s authorization for the purpose of treating the patient.  

However, disclosure of PHI to the media or others not involved in the patient’s care is generally not permissible except under certain circumstances. Notwithstanding the above, special rules are activated during a public health emergency. Under certain conditions, which are further detailed in OCR’s recent bulletin, it is permissible to disclose PHI to the following categories of individuals and entities:

  • Public health authorities;

  • Foreign government authorities (at the direction of public health authorities);

  • Persons at risk;

  • Family, friends, police, disaster relief organizations, etc. who are involved in the patient’s care; and

  • Anyone, if it would lessen or prevent a serious and imminent threat to the health and safety of the public at large or an individual person.

As public health agencies are still trying to contain the coronavirus in the U.S. and elsewhere, it is imperative for covered entities and business associates alike to comply with HIPAA while simultaneously balancing a public health emergency. Although HIPAA has taken account for these types of situations, the HIPAA rulebook cannot be set aside and disregarded during this time.

©1994-2021 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.National Law Review, Volume X, Number 43
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

The health industry is a complex system, and reimbursement is the lifeblood. Reduction in payments from governmental and commercial payors affects providers, suppliers, manufacturers, and all others across the health care continuum.

Regulatory approval and accreditation is the heart of the system. For many, delay in licensure and other regulatory approvals can threaten financing and corporate viability. Accreditation of residency training programs is essential to the vitality of academic medical centers and teaching hospitals.

Restructuring is a fact of life in this dynamic...

202-434-7324
Advertisement
Advertisement
Advertisement