OCR: CEs May Offer COVID-19 Patient 'List' to First Responders

In new guidance, the HHS Office for Civil Rights (OCR) has authorized hospitals and other covered entities (CEs) that may be faced with demands from first responders and law enforcement to provide a list of patients who have tested positive for COVID-19.[1]

But whether the strategies offered—including to limit the disclosure to dispatchers only—are workable remain to be seen, particularly given how fraught the relationship between the police and caregivers can be. It was just three years ago that dramatic body camera video showed the handcuffing of a Utah nurse who refused to allow a police official to take blood from a patient with serious burns who later died.[2] (The nurse received a $500,000 settlement from the Salt Lake City police department and the University of Utah, which owns the hospital, and the officer was fired.)

In addition, Jeff Drummond, an attorney with decades of experience in HIPAA matters, tells RPP that the use a patient list, particularly when shared with law enforcement or firefighters, might be problematic and advises giving the guidance thoughtful consideration before implementation.

Titled “COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities,” the guidance, issued March 24, differs little from how disclosures to these groups have historically been interpreted by OCR.[3] Generally speaking, no patient authorization is required for sharing of protected health information (PHI) with public health entities and to protect against imminent danger, for example.

Where the guidance may break new ground—reflecting what one OCR official called “creative thinking” and “further steps” on the agency’s part—is in its recommendations about the use of lists of patients affected by COVID-19.

Speaking March 30 at the virtual Compliance Institute sponsored by RPP publisher the Health Care Compliance Association, Timothy Noonan, OCR deputy director for health information privacy, discussed the guidance and fleshed out some of the examples the agency offered.

This document is only available to subscribers. Please log in or purchase access.
 


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field