OCR Guidance Related to the Disclosure of PHI to Law Enforcement, Paramedics, First Responders and Public Health Authorities

On March 24, 2020, OCR released a set of Frequently Asked Questions to clarify when covered entities are permitted under HIPAA to release patient PHI to law enforcement, paramedics, first responders and public health authorities.  Notably, OCR reiterated that, except where required by law or for treatment purposes, a covered entity must make reasonable effort to limit the disclosure of PHI to the minimum necessary to accomplish the purpose of the disclosure.  The following represents a summary of OCR’s guidance; any specific scenarios should be assessed according to the text of the Privacy Rule.

To start, OCR stated that the Privacy Rule permits, but does not require, a covered entity to disclose the PHI of an individual who has been infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities without the patient’s authorization.  The circumstances under which such disclosures are allowed include:

• Disclosure for treatment purposes. OCR provided the example that the Privacy Rule may permit a skilled nursing facility to disclose PHI about a patient who has COVID-19 to emergency medical transport personnel who will provide treatment while transporting the patent to a hospital.
• Disclosure when notification is required by law. For instance, HIPAA may permit covered entities to disclose PHI about an individual who tests positive for COVID-19 in accordance with state law that requires reporting confirmed or suspected cases of infectious disease to public health officials. 
• Disclosure to notify a public health authority in order to prevent or control the spread of disease. For example, HIPAA may permit covered entities to disclose PHI to a public health authority, such as the CDC or state or local public health department, authorized by law to collect or receive PHI for purposes of preventing or controlling disease.  This further includes authorization to disclose PHI to public health authorities for purposes of public health surveillance, public health investigations, and public health interventions.  
• Disclosure when first responders may be at risk of infection. Covered entities may be permitted to disclose PHI to first responders that may have been exposed to COVID-19, or may otherwise be at risk of contracting or spreading COVID-19, if the covered entity is authorized by law, such as state law, to notify persons where necessary in connection with a public health intervention or investigation.  OCR provided the example that a county health department, consistent with state law, may disclose PHI to a police officer, or other person, who may come into contact with a person who tested positive for COVID-19, in order to prevent or control the spread of COVID-19.
• Disclosure to first responders when necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public. HIPAA may permit a covered entity to disclose PHI to prevent or lessen a serious and imminent threat to a person or the public when the disclosure is made to someone believed to be able to prevent or lessen the threat, including the target of the threat.  The example provided by OCR explains that covered entities may disclose PHI about individuals who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisis services personnel, or others charged with protecting the health or safety of the public, provided the covered entities believe the disclosure is necessary to prevent or minimize any threat of imminent exposure to such personnel in the discharge of their duties.
• Disclosure in response to a request for PHI by a correctional institution or law enforcement official having lawful custody of an inmate or other individual. This permitted disclosure is premised on the condition that the PHI is needed for:
  • Providing health care to the individual;
  • The health and safety of the individual, other inmates, officers, employees and others at the correctional institution, or persons responsible for transporting inmates;
  • Law enforcement on the premises of the correctional institution; or
  • Administration and maintenance of the safety, security, and good order of the correctional institution.

 OCR continued to provide the example that HIPAA allows a covered entity at a prison medical facility to share an inmate’s positive COVID-19 test results with correctional guards at the facility in furtherance of the health and safety of others at the facility.

Separate from the FAQs, OCR included additional examples in their bulletin to describe the disclosures that may be made in circumstances specifically applicable to first responders, including examples specific to the disclosure of PHI by a covered entity to EMS dispatch and the disclosure of PHI by a covered entity 911 call center to policer officers responding to a call.

If you have additional questions or need further assistance, please feel free to reach out to Alessandra Swanson or your Winston relationship attorney.

View all of our COVID-19 perspectives here. Contact a member of our COVID-19 Legal Task Force here.