OCR Provides Guidance on Providers Contacting Former COVID-19 Patients About Blood and Plasma Donation
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services recently released guidance clarifying that, in certain circumstances, providers may, in a HIPAA-compliant manner without obtaining individual patient HIPAA authorizations, identify patients who have recovered from COVID-19 and provide them with information about how they can donate their blood and plasma to help treat other patients with COVID-19. Specifically, the HIPAA privacy rule permits covered entities (i.e., providers, or their business associates on their behalf) to use or disclose protected health information (PHI) for their own treatment, payment, or health care operations purposes. Included in the definition of “health care operations” purposes are population-based case management activities relating to improving health, and these COVID-19-related activities would fall within that category.
In providing this guidance, OCR reminds providers that although such uses of patient information are permissible, providers must make reasonable efforts to limit the uses of patient information to the minimum necessary to accomplish their intended purpose. Furthermore, health care providers cannot conduct such activities without HIPAA authorizations if such activities would constitute “marketing” activities under HIPAA. Generally, communications for population-based case management or related health care operations functions would not be “marketing” communications if the provider sending such communications does not receive any direct or indirect payment from, or on behalf of, any third party whose service is being described in the communication, such as a blood and plasma donation center. Lastly, even if there is no “marketing” issue under HIPAA, a covered entity, such as a provider, must send the communication to patients and generally may not (without authorization) disclose patient information to a third party to allow the third party to send communications to patients about the third party’s products and services.
Visit our COVID-19 Insight Center for our latest legislative and legal updates, articles, and resources.
The material in this publication was created as of the date set forth above and is based on laws, court decisions, administrative rulings, and congressional materials that existed at that time, and should not be construed as legal advice or legal opinions on specific facts. In some cases, the underlying legal information is changing quickly in light of the COVID-19 pandemic. The information in this publication is not intended to create, and the transmission and receipt of it does not constitute, a lawyer-client relationship. Please contact your legal counsel for advice regarding specific situations.