Support Centre

USA: OCR issues guidance on disclosure of PHI about individuals exposed to Coronavirus

The U.S. Department of Health & Human Services' Office for Civil Rights ('OCR') issued, on 24 March 2020, guidance on how covered entities under the Health Insurance Portability and Accountability Act of 1996 ('HIPAA') may disclose protected health information ('PHI') about individuals who have been infected with or exposed to COVID-19 ('Coronavirus') to law enforcement, paramedics, other first responders, and public health authorities in compliance with HIPPA ('the Guidance'). In particular, the Guidance outlines the circumstances where covered entities may disclose PHI, including when needed for the provision of treatment, required by law, and when first responders may be at risk of infection.

In addition, the Guidance notes that covered entities must take reasonable steps to limit such disclosure or use of PHI to that which is the minimum necessary to accomplish the purpose for the disclosure.

You can read the press release here and the Guidance here.