HIPAA Guidance Amended During COVID 19 Pandemic

September 11, 2020

On August 24, 2020, amended guidance was provided by the Office for Civil Rights (OCR) of the US Department of Health & Human Services, the agency that has jurisdiction to enforce HIPAA. The new guidance allows covered health care providers (e.g., hospitals, pharmacies, laboratories) and health plans to use without an individual’s authorization, protected health information (PHI) to identify and contact individuals who have recovered from COVID-19 to inform them about how they can donate their plasma containing antibodies (known as "convalescent plasma") to help treat others with COVID-19.



Download this article.



Background – Use Or Disclosure of PHI



The HIPAA Privacy Rule permits HIPAA-covered entities (or their business associates on the covered entities’ behalf) to use or disclose PHI without an individual’s authorization for:



  • Treatment,

  • Payment and,

  • Health care operations (e.g. case management and care coordination activities that do not meet the definition of treatment)

When using or disclosing PHI for one of these three purposes, the covered entity (e.g. health plan) must make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose of the use or disclosure.



Amended Guidance



Under the Department of Health and Human Services (HHS) guidance, health plans may use PHI to identify and contact individuals who have recovered from COVID-19 to inform them about how to donate plasma. This is considered a permitted health care operations activity to the extent that facilitating the supply of donated plasma would be expected to improve the health plan’s ability to conduct case management for patients or beneficiaries that have or may become infected with COVID-19.



Limitations On The Use of PHI Without Authorization



A covered entity may identify and contact individuals, without authorization, to the extent that the activity does not constitute marketing. (Marketing is a communication about a product or service that encourages the recipient of the communication to purchase or use the product or service.) Thus, a health plan could inform or encourage individuals who have recovered from COVID-19 regarding the means and benefits of donating plasma, but cannot encourage such individuals to use any particular blood or plasma donation center(s) if they receive any compensation (direct or indirect) from the donation center.



HIPAA Privacy Rule Reminder



A covered entity generally cannot disclose PHI to a third party, including another HIPAA-covered entity, without the individuals’ authorization. Therefore, a health plan should not disclose PHI about individuals who have recovered from COVID-19 directly to a blood or plasma donation center, for the donation center’s own purposes (unless the participant has authorized this disclosure).



Download this article.



The information contained herein should be understood to be general insurance brokerage information only and does not constitute advice for any particular situation or fact pattern and cannot be relied upon as such. Statements concerning financial, regulatory or legal matters are based on general observations as an insurance broker and may not be relied upon as financial, regulatory or legal advice. This document is owned by Alera Group, Inc., and its contents may not be reproduced, in whole or in part, without the written permission of Alera Group, Inc.



This article was last reviewed and up to date as of 09/03/2020.

The information provided in this alert is not, is not intended to be, and shall not be construed to be, either the provision of legal advice or an offer to provide legal services, nor does it necessarily reflect the opinions of the firm, our lawyers or our clients. This is not legal advice. No client-lawyer relationship between you and our lawyers is or may be created by your use of this information. Rather, the content is intended as a general overview of the subject matter covered. Barrow Weatherhead Lent LLP is not obligated to provide updates on the information presented herein. Those reading this alert are encouraged to seek direct counsel on legal questions. © 2023 Barrow Weatherhead Lent LLP. All Rights Reserved.

About Alera Group 

Alera Group is an independent, national insurance and wealth services firm with more than $1.1 billion in annual revenue, offering comprehensive employee benefits, property and casualty insurance, retirement plan services and wealth services solutions to clients nationwide. By working collaboratively across specialties and geographies, Alera Group’s team of more than 4,000 professionals in more than 180 locations provides creative, competitive services that help ensure a client’s business and personal success. For more information, visit https://aleragroup.com/ or follow us on LinkedIn.