Question

The Health Insurance Portability and Accountability Act (HIPPA) outlines rules and regulations related to protecting confidential health information. Using cited sources, discuss what, if any, nurses may release confidential health information, specifically COVID-19 test results and what steps must be taken by the nurse when releasing this information.

Answer 1

Yes, the HIPAA Privacy Rule permits a covered entity to disclose the protected health information (PHI) of an individual who has been infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities without the individual’s HIPAA authorization, in certain circumstances, including the following:

When the disclosure is needed to provide treatment: HIPAA permits a covered skilled nursing facility to disclose PHI about an individual who has COVID-19 to emergency medical transport personnel who will provide treatment while transporting the individual to a hospital’s emergency department.

When such notification isrequired by law: HIPAA permits a covered entity,such as a hospital, to disclose PHI about an individual who tests positive for COVID-19 in accordance with a state law requiring the reporting of confirmed or suspected cases of infectious disease to public health officials.

To notify a public health authority in order to prevent or control spread of disease: HIPAA permits a covered entity to disclose PHI to a public health authority that is authorized by law to collect or receive PHI for the purpose of preventing or controlling disease, injury, or disability, including for public health surveillance, public health investigations, and public health interventions.

HIPAA permits a covered county health department, in accordance with a state law, to disclose PHI to a police officer or other person who may come into contact with a person who tested positive for COVID-19, for purposes of preventing or controlling the spread of COVID-19.

When the disclosure of PHI to first respondersis necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public: HIPAA permits a covered entity, consistent with applicable law and standards of ethical conduct, to disclose PHI about individuals who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisisservices personnel, or others charged with protecting the health orsafety of the public ifthe covered entity believes in good faith that the disclosure of the information is necessary to prevent or minimize the threat of imminent exposure to such personnel in the discharge of their duties.

When responding to a request for PHI by a correctional institution or law enforcement official having lawful custody of an inmate or other individual: HIPAA permits a covered entity,such as a physician, located at a prison medical facility to share an inmate’s positive COVID-19 test results with correctional officers at the facility for the health and safety of all people at the facility.

HIPAA covered health departments must make reasonable efforts to only disclose the minimum necessary PHI to accomplish the purpose of the disclosure. Consequently, the following common COVID-19 disclosures all require a minimum necessary analysis:

• To persons at risk of infection, such as first responders
• To prevent or lessen a serious and imminent threat to the health and safety of a person or the public, such as to child welfare workers, mental health crisis services personnel, fire department personnel or others charged with protecting the health or safety of the public.To close contacts, such as a spouse, family members, friends, or other persons identified by a patient.

HIPAA covered hospital might determine that a list of names and addresses of all individuals known to have tested positive or received treatment for COVID-19 is the minimum necessary PHI to share with an EMS dispatch. The hospital’s decision to share this PHI to persons at risk of infection meets HIPAA’s reasonableness standard.

Information that is protected: All medical records and other individually identifiable health information used or disclosed by a covered entity in any form, whether electronically, on paper, or orally, are covered by the final rule.

The Privacy Rule states that:

In general, “a covered health care provider [with a direct treatment relationship] must obtain the individual’s consent,…prior to using or disclosing protected health information to carry out treatment, payment, or health care operations.

What about sharing protected health information (PHI) with public health authorities?: “The final rule continues to permit covered entities to disclose protected health information without individual authorization directly to public health authorities, such as the Food and Drug Administration, the Occupational Safety and Health Administration, the Centers for Disease Control and Prevention as well as state and local public health departments, for public health purposes as specified in the NPRM [Notice of Proposed Rulemaking for the Privacy Rule].”

The Privacy Rule generally requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for PHI to the minimum necessary to accomplish the intended purpose.

As required by the HIPAA law itself, state laws that provide greater privacy protection (which may be those covering mental health, HIV infection, and AIDS information) continue to apply. These confidentiality protections are cumulative; the final rule will set a national “floor” of privacy standards that protect all Americans, but in some states individuals enjoy additional protection. In circumstances where states have decided through law to require certain disclosures of health information, the final rule does not preempt these mandates.

steps taken by the nurse should be:

The nurse must remember that information must only be used for the purpose for which it was obtained and impose limits on how information may be shared but there are exceptions.

The nurse must also keep in mind that there is a delicate balance between being informative and over-communicating. "Crisis communication is incredibly important now."

Set up hotlines and videos for the public, relaying that patients should call them if they think they have the virus so they can meet them outside.

While some hospital nurses are actively communicating and being transparent, others are declining to publicly disclose if one of their patients has COVID-19 to minimize liability.

As long as hospitals are releasing de-identified patient data, they should be compliant with the Health Insurance Portability and Accountability Act. If the hospital receives an inquiry from the press who relays a specific name, that is where hospitals have to be more careful.

The nurse who is responding to inquiries is appropriately trained on what they can or cannot say, especially when it comes to social media. As it  can do a lot of reputational harm if they improperly reveal the identity of a patient who has the virus.