◆ As the new coronavirus, COVID-19, spreads across the United States, the HHS Office for Civil Rights (OCR) is reminding HIPAA covered entities and business associates that the protections in the HIPAA privacy rule “are not set aside during an emergency,” even though HIPAA allows disclosures of protected health information (PHI) that’s necessary for public health officials to carry out their public health mission.^[1] Covered entities can disclose PHI to the Centers for Disease Control and Prevention or to a state or local health department, and also can disclose PHI “as necessary to prevent or control the spread of the disease or otherwise to carry out public health interventions or investigations,” OCR said. In addition, “health care providers may share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public,” consistent with applicable laws and the provider’s standards of ethical conduct, OCR said. For most disclosures, a covered entity must make reasonable efforts to limit the information disclosed to the “minimum necessary” standard, the agency said.

◆ In the event of a coronavirus emergency, all employers, including those considered covered entities under HIPAA, will have freedom to share employee information as necessary “to prevent or lessen a serious and imminent threat to the health and safety of a person or the public—consistent with applicable law,” wrote attorney Tiffany Downs, a partner at FordHarrison.^[2] This means an employer may disclose an employee’s health information to anyone in a position to prevent or lessen the serious and imminent threat, including family, friends, co-workers, caregivers and law enforcement, without an employee’s permission, Downs said. Most employers are not covered entities and therefore not subject to HIPAA’s privacy rule, Downs said, but she noted that an employer may fall under HIPAA if it sponsors a group health plan from which it receives PHI. Still, an outbreak of an infectious disease such as the coronavirus means that HIPAA-covered employers will have the same freedom as HIPAA-excluded employers to share information in order to reduce the threat, Downs said.