News

Fall River
image description

Obligations of County to Release Personal Health Information re COVID-19

  • By: P.J. Van Ert

Question:  What information or obligation is the County under to release that person’s personal health information (PHI)? 

Response:   All of the “old” rules for disclosures, the laws and regulations governing public health, still apply.  In all scenarios, Counties must ONLY release the minimum necessary information for the disclosure. Also, an individual may provide authorization to disclose PHI. In that situation, Counties still must make reasonable efforts to limit the information disclosed to that which is the minimum necessary.  The HIPAA Privacy Rule still applies in a global pandemic, but must be balanced for appropriate uses to treat patients, protect the nation’s public health and other critical purposes. In other scenarios, Public Health may disclose PHI, including a positive Covid-19 result, in the following scenarios:

  • HIPAA allows disclosure without prior authorization for purposes of treatment. Such treatment includes of the patient and as necessary to treat a different patient. 45 CFR sections 164.502(a)(1)(ii), 164.506(c).  
  • HIPAA allows disclosure to public health authorities or the state health department without individual authorization. 45 CFR sections 164.501, 164.512(b)(1)(i). 
  • HIPAA allows disclosure to persons at risk of contracting or spreading the disease in order to prevent or control the spread. This would include person who were in contact with the Covid-19 positive patient. 45 CFR 164.512(b)(1)(iv).
  • A covered entity (local county government/health department) is permitted to share PHI with the family, friends and others involved in the care of a patient. This information about a patient may also be shared to identify or locate family or others responsible for the care of the patient.  45 CFR 164.510(b). 
  • Providers may disclose PHI to anyone in a position to prevent or lessen the serious and imminent threat, including family, friends, caregivers and law enforcement without a patient’s permission. The professional judgment of health professionals always controls what is the nature and severity of the threat to health and safety. 45 CFR 164.512(j). A global pandemic clearly qualifies.

Disclosures to the media or others not involved in the care of the patient or otherwise entitled to notification is limited to situations where the patient provides written authorization. The previous options above are the only instances where disclosures can be made without prior authorization of the patient. 

For most disclosures, a covered entity must make reasonable efforts to limit the information disclosed to that which is the “minimum necessary” to accomplish the purpose. (Minimum necessary requirements do not apply to disclosures for treatment purposes.) Covered entities may rely on representations from a public health authority or other public official that the requested information is the minimum necessary for the purpose, when that reliance is reasonable under the circumstances. For example, a covered entity may rely on representations from the CDC that the protected health information requested by the CDC about all patients exposed to or suspected or confirmed to have Novel Coronavirus (2019-nCoV) is the minimum necessary for the public health purpose. In addition, internally, covered entities should continue to apply their role-based access policies to limit access to protected health information to only those workforce members who need it to carry out their duties. See 45 CFR §§ 164.502(b), 164.514(d).

Recommendation:   It is recommended that each request for information about County Covid-19 positive results be reviewed very carefully and by counsel.  We need to identify who is making the request or what agency is asking for the information and determine the purpose of the request and whether it fits into a disclosure without the need for prior written authorization. If a disclosure of PHI will be made, always share the minimum necessary information to accomplish the stated purpose.