August 3, 2020

Volume X, Number 216

July 31, 2020

Subscribe to Latest Legal News and Analysis

Friendly Reminder: HIPAA Still Applies During the Coronavirus Outbreak

Our Employment, Labor & Benefits colleagues recently blogged on the coronavirus and its ramifications for employers impacted by the outbreak. As this is still an active outbreak with cases increasing within the United States, it's a good time to review how HIPAA applies in a public health emergency, including its restrictions and flexibility in these types of situations. Accordingly, last week, the Office for Civil Rights (OCR) released a helpful bulletin on how the HIPAA Privacy Rule comes into play with the coronavirus outbreak and other public health emergencies.

The most important thing to remember is that the basic requirements of HIPAA still apply even in a public health emergency. For instance, health care providers must still uphold the “minimum necessary” standard when treating patients with the coronavirus. A covered entity must make a reasonable effort to disclose only the “minimum necessary” protected health information (PHI) to accomplish the purpose. When a public health authority asks a covered entity to disclose information to it for infectious disease reporting, a covered entity can rely that the request meets the “minimum necessary” standard to meet the authority’s public health purpose. Additionally, just because a public health emergency exists does not mean that covered entities can freely disclose patient information. The HIPAA Privacy Rule permits covered entities to disclose PHI without a patient’s authorization for the purpose of treating the patient.  

However, disclosure of PHI to the media or others not involved in the patient’s care is generally not permissible except under certain circumstances. Notwithstanding the above, special rules are activated during a public health emergency. Under certain conditions, which are further detailed in OCR’s recent bulletin, it is permissible to disclose PHI to the following categories of individuals and entities:

  • Public health authorities;

  • Foreign government authorities (at the direction of public health authorities);

  • Persons at risk;

  • Family, friends, police, disaster relief organizations, etc. who are involved in the patient’s care; and

  • Anyone, if it would lessen or prevent a serious and imminent threat to the health and safety of the public at large or an individual person.

As public health agencies are still trying to contain the coronavirus in the U.S. and elsewhere, it is imperative for covered entities and business associates alike to comply with HIPAA while simultaneously balancing a public health emergency. Although HIPAA has taken account for these types of situations, the HIPAA rulebook cannot be set aside and disregarded during this time.

©1994-2020 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.National Law Review, Volume X, Number 43


About this Author

Kristen A. Marotta Associate  Hospitals & Health Systems Physician Organizations

Kristen focuses her practice on health care transactions, regulatory matters, and general contracting. Her experience includes counseling clients on both investing in and exiting from the health care space, drafting compliance plans and policies, facilitating deals and conducting due diligence to assess risk, addressing employment issues for health care entities, and assisting companies with formation and reorganization.

Prior to joining Mintz, Kristen was an associate...