August 8, 2022

Volume XII, Number 220


August 05, 2022

Subscribe to Latest Legal News and Analysis

Public Health vs. Patient Privacy – How Coronavirus Is Putting HIPAA to the Test

In a recent blog post, colleagues in our Employment, Labor & Workforce Management practice addressed the legal framework pertaining to coronavirus (COVID-19) risks in the workplace.  As the number of cases continues to the climb in the U.S., it is imperative that HIPAA covered entities and their business associates are aware of their privacy and security responsibilities in the midst of this public health emergency.  EBG provides this guidance on how to effectively respond to the coronavirus public health crisis while navigating patient privacy issues.

Last month, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) provided a bulletin to assist entities in determining ways patient information could be permissibly shared in compliance with HIPAA in the event of an outbreak of infectious disease or other emergency situations.  The regulators are onboard with dissemination of protected health information (PHI) to support public health. OCR has outlined several ways by which the HIPAA Privacy Rule permits entities to disclose PHI without a patient’s authorization:

  1. Covered entities may disclose PHI about the patient as necessary to treat the patient or to treat a different patient.

  2. Covered entities may disclose requested PHI to a public health authority, a foreign government agency (at the direction of a public health authority) that is collaborating with the public health authority, and persons at risk of contracting or spreading a disease or condition if authorized by law.

  3. Covered entities may share PHI with a patient’s family, friends, relatives, or other persons identified that were involved in the patient’s care.

  4. Health care providers may share PHI with anyone in order to prevent or lessen a serious and imminent threat to the public health and safety.

Health care providers are required to comply with the “minimum necessary” standard when disclosing PHI of patients with the coronavirus, which means that such providers must make reasonable efforts to disclose only the patient information necessary to achieve the purpose of the disclosure.  In addition, during emergencies, covered entities must implement reasonable safeguards to protect PHI against any “intentional or unintentional uses and disclosures” in violation of HIPAA.

As public health agencies and entities feverishly work together to contain the spread of coronavirus and treat affected individuals in the U.S., it is vital that entities leverage this HIPAA guidance to effectively share patient information while protecting privacy.  Effective response to public health crises will require striking this appropriate balance of interests.

©2022 Epstein Becker & Green, P.C. All rights reserved.National Law Review, Volume X, Number 64

About this Author

Alaap Shah Attorney Healthcare Life Sciences

Alaap B. Shah is a Member of the Firm in the Health Care and Life Sciences practice, in the firm's Washington, DC, office.

Mr. Shah:

  • Advises clients on federal and state privacy and data security laws and regulations
  • Advises on cybersecurity and data breach matters
  • Advises clients on health care fraud and abuse matters and government investigations relating to health information technology
  • Counsels clients on digital health and data strategies and related compliance issues

His work focuses on defense and counseling...

Brian Hedgeman, Epstein Becker Law Firm, Washington DC, Health Care Law Attorney
Law Clerk

BRIAN HEDGEMAN is a Law Clerk - Admission Pending - in the Health Care and Life Sciences practice, in the Washington, DC, office of Epstein Becker Green.