As the number of confirmed COVID-19 cases rises, first responders now must operate in a world with an additional threat: potentially being exposed to COVID-19. Ensuring that our first responders have as much information as possible is critical in aiding them in protecting not only our communities, but also protecting themselves. However, an individual’s medical status and personally-identifying information are typically protected health information that cannot be disclosed under Health Insurance Portability and Accountability Act (HIPAA). The Department of Health and Human Services’ Office for Civil Rights (OCR) provided a clear reminder to everyone that this tension can be appropriately balanced when it released additional guidance on March 24th, which can be accessed here.
What can be shared with first responders?
Despite the general prohibition that protected health information cannot be disclosed by a covered entity without a patient’s authorization, OCR reiterated the applicability of certain exceptions, including: (i) disclosures to individuals who may be at risk of contracting a communicable disease, and (ii) disclosures to avert serious and imminent harm. In either of these cases, the covered entity must make reasonable efforts to limit the information disclosed to only that which is necessary to accomplish the purpose of the disclosure, and as may be allowed under applicable state law. 45 CFR 164.502(b). In many instances, it is this limitation that creates the most difficulty for covered entities when operationalizing proper disclosures, especially since OCR has traditionally taken a narrow view in the application of these exceptions. To help with this, OCR provided the following examples:
- To inform first responders who could be at risk of infection, 45 CFR 164.512(b)(1)(iv);
- Covered entities, such as local health departments, may disclose protected health information to first responders who may come in contact with an infected COVID-19 individual to prevent or control the spread of the virus.
- To inform first responders to prevent or lessen a serious and imminent threat to the health and safety of the public, 45 CFR 164.512(j)(1).
- When a covered entity believes in good faith that disclosure of the protected health information is necessary to prevent or lessen the threat to the public, it can choose to disclose that information to first responders.
Additionally, OCR provided commentary on more commonly used exceptions, including the following:
- To treat an infected individual, 45 CFR 164.502(a)(1)(ii).
- This would allow a covered entity to provide information to first responders that may be treating or transporting an infected COVID-19 patient.
- To notify a public health authority of an infected individual, 45 CFR 164.512(b)(1)(i).
- A covered entity, such as a hospital, could provide notice to a public health authority (such as the Centers for Disease Control and Prevention or state and local health departments) of an infected COVID-19 individual to prevent or control the spread of the disease or to allow for public health investigations or interventions.
OCR’s newly published guidance contains discussion of each of the foregoing examples which is very helpful in applying these exceptions to our current situation.
State Privacy Laws
In addition to HIPAA, all states have different privacy laws related to protected health information that need to be considered prior to disclosing such information to first responders. All states generally prohibit the release of protected health information or medical information.  Unfortunately, how states address exceptions similar to those described in HIPAA, vary significantly. Because state laws provide greater privacy protection preempt HIPAA, it is important to clearly understand your state’s requirements to develop a disclosure process that protects, not only our first responders, but also our patient’s rights.
If you have any questions regarding whether protected health information can be disclosed to assist first responders, please feel free to contact either Chad Eckhardt, Brodi Conover, or any member of Frost Brown Todd’s Health Care Innovation Industry Team or Government Services Practice Group.