We are in a time where everything is changing and changing quickly. If you would have told me a week ago that my children would be off school indefinitely, my husband and I would be working remotely and all our restaurants and bars would be closed to dining, I would have said you were crazy. Yet that is the situation that we are waking up to today. As a result of the current Coronavirus environment, we will see guidance being issued to address various laws and we will keep you up-to-date on this guidance as it comes out. Yesterday, as a result of the Secretary of HHS issuing a public health emergency, HHS issued several bulletins on HIPAA. We have received calls from many clients regarding when and how they may be able to disclose information they hold regarding individuals who may have the Coronavirus.
The first piece of guidance, titled Waiver or Modification of Requirements under Section 1135 of the Social Security Act as the Result of the Consequences of the 2019 Novel Coronavirus (COVID-19), provides limited relief in complying with some provisions of HIPAA. However, this relief applies only to hospitals. It does not provide any waiver of the HIPAA rules for group health plans, health care clearinghouses or other group health care providers. The following is an excerpt from the guidance:
Pursuant to Section 1135(b)(7) of the Act, I hereby waive sanctions and penalties arising from noncompliance with the following provisions of the HIPAA privacy regulations: (a) the requirements to obtain a patient’s agreement to speak with family members or friends or to honor a patient’s request to opt out of the facility directory (as set forth in 45 C.F.R. § 164.510); (b) the requirement to distribute a notice of privacy practices (as set forth in 45 C.F.R. § 164.520); and (c) the patient’s right to request privacy restrictions or confidential communications (as set forth in 45 C.F.R. § 164.522); but in each case, only with respect to hospitals in the designated geographic area that have hospital disaster protocols in operation during the time the waiver is in effect.
In reaction to yesterday’s announcement, HHS also issued a COVID-19 and HIPAA Bulletin (updating what they issued in February to reflect the limited relief for hospitals detailed above). It reiterates the HIPAA privacy rules and shares the limited circumstances that information surrounding sharing protected health information (PHI) about an individual who is diagnosed with COVID-19 can be shared without authorization. Without an authorization, HIPAA primarily only permits sharing of PHI with a public health organization (such as the CDC). A copy of that announcement can be found here.
One important point that I want to remind our readers of is that employers are not subject to HIPAA in their capacity as an employer. To be subject to HIPAA, you must be either a covered entity (defined as a group health plan, healthcare clearinghouse or health care provider that transmits certain information electronically) or a business associate (a service provider to a covered entity that either creates, receives, transmits or maintains PHI on behalf of the covered entity). Therefore, an employer’s health plan is subject to HIPAA, but information that you may receive from your employees directly (i.e., not from your health plan records) is not protected by HIPAA. Before sharing this information openly as an employer though, there are other state and federal laws that could limit the sharing depending on how and why you received the information.
Additionally, HHS issued a HIPAA emergency disclosure decision tool. It allows organizations to determine when and with who they can share PHI even in light of this state of emergency. If you are wondering whether you are able to use or disclose information in this time of great change, you can find the decision tool here.
Graydon has formed a Coronavirus Task Force to make sure that we have a team of attorneys to provide you with the most up-to-date information in an environment that is changing faster than virtually anything we have seen before. We know this is impacting your business and we are here to help guide you through the legal hurdles you will face in the coming weeks. If you have questions, please reach out to any Graydon attorney and we can put you in touch with the right person at the firm (virtually of course as we are all working remotely).
