In an effort to streamline the provision of COVID-19 patients’ Protected Health Information (PHI) to public health authorities, the United States Department of Health and Human Services Office for Civil Rights (OCR) recently published practical guidance explaining the methods by which Health Insurance Portability and Accountability Act (HIPAA) Covered Entities may disclose COVID-19 patient PHI to law enforcement, first responders, and public health authorities. 

In addition to clarifying regulatory principles governing the disclosure of patients’ PHI, the guidance also provides practical examples of the circumstances under which a Covered Entity may disclose COVID-19 patients’ PHI to law enforcement, first responders, and public health authorities. Specifically, the guidance demonstrates how Covered Entities may disclose COVID-19 patients’ PHI in the following instances:

1. When the disclosure is needed to provide treatment;
2. When the reporting of testing results is required by law;
3. When the reporting of testing results is needed to prevent or control the spread of disease;
4. When first responders may be at risk of infection;
5. When disclosure to first responders is necessary to prevent or lessen a serious imminent threat to the health and safety of a person or the public; or
6. When responding to a request for PHI by a correctional institution or law enforcement official having lawful custody of an inmate or individual. 

While the OCR guidance will assist HIPAA Covered Entities in responding to requests for information by public health authorities, we remind Covered Entities of the importance to consult state and local laws prior to making any disclosures of PHI.  Further, except when required by law, or for treatment disclosures, Covered Entities must make a reasonable effort to limit the information used or disclosed to the “minimum necessary” to accomplish the purpose for the disclosure.

If you have any questions concerning the appropriateness of making disclosures of patient information to public authorities or wish to learn more about OCR’s new guidance, please contact your Dinsmore attorney.