In light of the recent Novel Coronavirus outbreak, the U.S. Department of Health and Human Services (HHS) has issued a reminder for HIPAA adherence pertaining to the ways that patient information can be shared during outbreaks of infectious disease and other emergency situations such as this one.
According to the Office for Civil Rights, HIPAA covered entities may disclose, without patient authorization, protected health information (PHI) about the patient as necessary to perform treatment. How far does this leeway extend and how will privacy be protected during outbreaks? Let’s take a closer look.
HIPAA applies only to covered entities and business associates
According to HHS, by law the HIPAA Privacy Rule applies only to covered entities – “health plans, health care clearinghouses, and certain health care providers.” At least this much has not changed. Normally, individuals, organizations and agencies that meet the definition of a covered entity under HIPAA would have to comply with the requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information.
However, “treatment” in these cases can include the coordination or management of healthcare and related services by one or more providers, which could also include consultations between providers as well as the referral of patients.
Employees may not access or disclose patient records for an unauthorized purpose
This much has not changed either. Under HIPAA, employees may only access or disclose patient records when specifically authorized to do so as part of their job, or when required to do so under law. Employees are not allowed to look up a patient’s medical record to see if it mentions anything about coronavirus, no matter how strong that temptation may be.
Information CAN be shared with friends and family of the coronavirus patient
Family members, friends, and any individual involved in the care of the patient can be notified about the patient’s condition so long as verbal permission has been obtained, or that it can be reasonably inferred that the patient does not object. If a patient is incapacitated, then professional judgement should be used as to whether the sharing of information is in the patient’s best interest.
Patient data may be shared to protect public health
Providing specific information about an identifiable patient to the media or public at large is not permitted. However, if there is serious or imminent threat to the health and safety of another person or to the public, necessary information may be shared in order to protect those who would be affected. It should be noted that even this must be restricted. In general, the information that’s shared should be as minimal as possible.
When outbreaks like these occur, it’s easy for the public to begin to panic. From there it’s a slippery slope, as rules and regulations can become blurred amidst the chaos. That’s why when incidents like these do happen, it’s more important than ever to have a clear set of guidelines to follow. And it’s even more important to make sure you’re following them correctly. Do not allow public panic to sway you from civic responsibility and the law.
Take Action Now
For more information on determining when and how information should be disclosed in the event of an emergency such as coronavirus and other similar outbreaks, HHS has published an Emergency Preparedness Decision Tool which can be found here.
At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your organization.