When patients suffer from an infectious respiratory disease like COVID-19, the immune system creates antibodies that put in place protection if the pathogen is another time. These antibodies, in the blood of patients who recover from such an illness, are invaluable as they have the ability to provide protection for the patient and also for other patients who they are transferred to.
Thanks to the donation of blood and plasma two preparations can be made: Convalescent plasma and hyperimmune immunoglobulin. Convalescent plasma and hyperimmune immunoglobulin have both been used to tackle the contraction of other viral respiratory diseases. Given the extent of COVID-19 and the high mortality rate, these treatments could be crucial for patients who are have difficulty fighting the infection. Research studies are now being conducted to test whether antibody treatments are effective in dealing with COVID-19.
To be included in these programs, patients who have previously been diagnosed with COVID-19 will need to be approached and asked if they are willing to donate blood and plasma, but is this contact allowable under the HIPAA Privacy Rule?
On June 12, 2020, the Department of Health and Human Services’ Office for Civil Rights shared guidance to healthcare groups on the HIPAA Privacy Rule and contacting COVID-19 patients to seek blood and plasma donations.
OCR said that the HIPAA Privacy Rule does not prohibit healthcare providers from approaching COVID-19 patients to request blood and plasma donations and prior permission from the patient is not obligatory.
Healthcare providers can approach patients to advise them about the possibility of donating blood and plasma to assist the response to COVID-19 to improve other patents’ chances of defeating the disease.
HIPAA covered groups and business associates acting on their behalf can use or share PHI for the purpose of treatment, payment, and healthcare operations, without first receiving authorization to complete these tasks from a patient. Asking for a donation of blood or plasma does not fall into the category of treatment, as the blood/plasma will not be used to treat the patient, instead it is being used for population-based health care operations to enhance healthcare, case management, and care-coordination, which are taken into account in the definition of healthcare operations.
There is some lack of clarity in relation to whether contacting patients to solicit blood donations would be thought of as marketing communications, which are generally not allowed by the HIPAA Privacy Rule without prior permission being granted by a patient.
In relation to this, an exception to the Privacy Rule’s Marketing provision is allowed which the OCR explained by stating:“A covered health care provider is permitted to make such communication for the covered entity’s population-based case management and related health care operations activities, provided that the covered entity receives no direct or indirect payment from, or on behalf of, the third party whose service is being described in the communication (e.g., a blood and plasma donation center)”.