On August 24, 2020, amended guidance was provided by the Office for Civil Rights (OCR) of the US Department of Health & Human Services, the agency that has jurisdiction to enforce HIPAA. The new guidance allows covered health care providers (e.g., hospitals, pharmacies, laboratories) and health plans to use without an individual’s authorization, protected health information (PHI) to identify and contact individuals who have recovered from COVID-19 to inform them about how they can donate their plasma containing antibodies (known as "convalescent plasma") to help treat others with COVID-19.
Background – Use Or Disclosure of PHI
The HIPAA Privacy Rule permits HIPAA-covered entities (or their business associates on the covered entities’ behalf) to use or disclose PHI without an individual’s authorization for:
- Payment and,
- Health care operations (e.g. case management and care coordination activities that do not meet the definition of treatment)
When using or disclosing PHI for one of these three purposes, the covered entity (e.g. health plan) must make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose of the use or disclosure.
Under the Department of Health and Human Services (HHS) guidance, health plans may use PHI to identify and contact individuals who have recovered from COVID-19 to inform them about how to donate plasma. This is considered a permitted health care operations activity to the extent that facilitating the supply of donated plasma would be expected to improve the health plan’s ability to conduct case management for patients or beneficiaries that have or may become infected with COVID-19.
Limitations On The Use of PHI Without Authorization
A covered entity may identify and contact individuals, without authorization, to the extent that the activity does not constitute marketing. (Marketing is a communication about a product or service that encourages the recipient of the communication to purchase or use the product or service.) Thus, a health plan could inform or encourage individuals who have recovered from COVID-19 regarding the means and benefits of donating plasma, but cannot encourage such individuals to use any particular blood or plasma donation center(s) if they receive any compensation (direct or indirect) from the donation center.
HIPAA Privacy Rule Reminder
A covered entity generally cannot disclose PHI to a third party, including another HIPAA-covered entity, without the individuals’ authorization. Therefore, a health plan should not disclose PHI about individuals who have recovered from COVID-19 directly to a blood or plasma donation center, for the donation center’s own purposes (unless the participant has authorized this disclosure).
The information contained herein should be understood to be general insurance brokerage information only and does not constitute advice for any particular situation or fact pattern and cannot be relied upon as such. Statements concerning financial, regulatory or legal matters are based on general observations as an insurance broker and may not be relied upon as financial, regulatory or legal advice. This document is owned by Alera Group, Inc., and its contents may not be reproduced, in whole or in part, without the written permission of Alera Group, Inc.
This article was last reviewed and up to date as of 09/03/2020.