OCR Issues Guidance on Permissible Sharing of PHI to First Responders During the COVID-19 Pandemic

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has released additional guidance on HIPAA and COVID-19, the disease caused by the 2019 Novel Coronavirus, SARS-CoV-2. The new guidance document provides examples of allowable disclosures of protected health information (PHI) by covered groups under the HIPAA Privacy Rule to help make sure first responders and others receive PHI about people exposed to SARS-CoV-2 or showing symptoms of COVID-19.The new guidance document is in Q&A form and outlines when covered entities are permitted to share PHI such as names and other identifying information to first responders, law enforcement officials, paramedics, and public health authorities without first receiving a HIPAA authorization.

The document states that under the HIPAA Privacy Rule, disclosures of PHI are allowed when the information is required to supply treatment, when a disclosure is required by legislation, when first responders such as paramedics are at risk of contracting COVID-19 and need data to stop infection, and when a disclosure could stop or lessen a serious and imminent danger.

OCR also confirms that sharing PHI is permitted when responding to a request for PHI from a correctional institution or law enforcement official in lawful custody of an inmate or other person, and PHI is required in order to provide healthcare services to the person, to ensure the health and safety of the individual or others in the institution, those required to transport the person, and when PHI is required to control safety, security, and good order in a correctional institution.

OCR outlines that a hospital is allowed to provide a list of names and addresses of all individuals known to have tested positive for COVID-19 to an EMS dispatch for use on a per-call basis. That data can then be used to ensure that any personnel responding to an emergency at the patient’s location knows they must take additional precautions to ensure their own safety is maintained, such as donning personal protective equipment (PPE).

911 call center staff may ask for details about a patient’s symptoms in order to determine whether there is a risk they have been infected with SARS-CoV-2. Information may then be handed over to law enforcement officers and others responding to an incident at the person’s location to ensure they take steps to safeguard themselves.

In all instances, a covered entity must make reasonable efforts to restrict the disclosed information to the minimum amount necessary to achieve the purpose for the disclosure.

“Our nation needs our first responders like never before and we must do all we can to assure their safety while they assure the safety of others,” stated Roger Severino, OCR Director. “This guidance helps ensure first responders will have greater access to real time infection information to help keep them and the public safe.”

The guidance document – COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities – can be located here on this link (PDF).