Practice Management Alert

Reader Questions:

Contacting Some Prior COVID-19 Patients May Not Violate HIPAA

Question: My practice has tested a lot of patients for SARS-CoV-2, the virus that causes COVID-19. Now that there’s technology available for people who have recovered from COVID-19 to donate blood and plasma, is it a violation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to contact these patients and let them know about these opportunities to help others?

New York Subscriber

Answer: No, you may use protected health information (PHI) to identify and contact patients to let them know about such an opportunity, according to recent guidance from the Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

“We’re making sure misconceptions about HIPAA do not get in the way of a promising COVID-19 response. This guidance explains how health care providers can connect COVID-19 survivors with blood and plasma donation opportunities and further public health consistent with patient privacy,” said Roger Severino, director of OCR, in a June 12 HHS press release.

“The use of PHI to identify and contact patients who have recovered from COVID-19 for this purpose is permitted as a population-based health care operations activity of the covered health care provider because facilitating the supply of donated blood and plasma would be expected to improve the provider’s ability to conduct case management for patient populations that have or may become infected with COVID-19,” the OCR guidance says.

Read the full guidance here: www.hhs.gov/sites/default/files/guidance-on-hipaa-and-contacting-former-covid-19-patients-about-blood-and-plasma-donation.pdf.