Health Information Compliance Alert

Question: We’ve performed an abundance of COVID-19 tests at our practice. Recently, we read that patients who’ve recovered from COVID-19 can now donate blood and plasma due to new technologies. Is it a violation of the HIPAA Privacy Rule to contact these patients and let them know about these opportunities to help others?

Codify Subscriber

Answer: No, you may use protected health information (PHI) to identify and contact patients to let them know about such an opportunity, according to recent guidance from the HHS Office for Civil Rights (OCR).

“We’re making sure misconceptions about HIPAA do not get in the way of a promising COVID-19 response. This guidance explains how healthcare providers can connect COVID-19 survivors with blood and plasma donation opportunities and further public health consistent with patient privacy,” said OCR Director Roger Severino in a release.

“The use of PHI to identify and contact patients who have recovered from COVID-19 for this purpose is permitted as a population-based healthcare operations activity of the covered healthcare provider because facilitating the supply of donated blood and plasma would be expected to improve the provider’s ability to conduct case management for patient populations that have or may become infected with COVID-19,” the OCR guidance says.

Read the full guidance at www.hhs.gov/sites/default/files/guidance-on-hipaa-and-contacting-former-covid-19-patients-about-blood-and-plasma-donation.pdf.