Breaking Compliance News Blog

HIPAA & COVID-19: Disclosing to public health and the authorities

Posted by Margaret Scavotto, JD, CHC on 3/24/20 9:00 AM

Find me on:

Blog Series: Staying HIPAA Compliant During COVID-19

Sarah Badahman, CHPSE, Founder/CEO, HIPAAtrek, St. Louis 

Bethany Baty, Digital Marketing Director, HIPAAtrek, St. Louis

Margaret Scavotto, JD, CHC, President, MPA, St. Louis 


Today is day two of a five day blog series on HIPAA issues that are relevant during COVID-19. Our goal is to help you remain compliant during these challenging times. ~ MPA and HIPPAtrek.

Disclosures to Public Health and the Authorities


COVID-19 is a national emergency. While healthcare facilities are preparing for the coronavirus pandemic, hospitals are facing increased workloads. Healthcare providers and public health agencies are working in overdrive to prevent the further spread of the virus. Healthcare providers are required to report cases of COVID-19 to public health agencies as a part of the response effort. As healthcare professionals identify new cases of COVID-19, they must follow required protocols for notifying public health agencies and alerting those that may be at risk of exposure to the virus.  

The risk of over-disclosure is prevalent as we work to protect the public by informing those that may have had contact with a COVID-19 infected patient. Care needs to be taken to release only the minimum necessary information to properly inform those at risk for infection. This will become increasingly important as more cases are identified.

Rely on Public Health Agencies

During an infectious disease outbreak – such as COVID-19 - protection under the Privacy Rule is not waived. Providers are permitted, and required, to disclose patient information for public health activities. Public health agencies include the CDC and state or local public health departments that are authorized by law to receive patient information. Public health agency disclosures may include:

  • referrals for testing of suspected cases of COVID-19
  • confirmed cases of COVID-19
  • deaths due to COVID-19 infections

Rely on your public health agencies to make media disclosures and locate potentially exposed persons. If you have a public relations department, work with them to ensure only relevant disclosures are made and that those disclosures do not include any PHI identifiers.

PHI Identifiers:

  • Name
  • Geographical areas
  • Dates, except of year (unless over the age of 89)
  • Telephone and Fax numbers
  • Social Security numbers
  • Email addresses
  • Medical record numbers
  • Account numbers
  • Health plan beneficiary numbers
  • Certificate/license numbers
  • Vehicle identification and serial numbers, including license plates
  • Web URLs
  • Device identifiers and serial numbers
  • Internet protocol addresses
  • Full face photographs and comparable images
  • Biometric identifiers
  • Any other unique identifying number or code

Healthcare providers and public health agencies also have a responsibility to protect the public against COVID-19. Protection will include informing persons that have had contact with a COVID-19 infected patient. These communications should include instructions to adhere to recommendations of healthcare providers and/or government agencies to avoid a serious or imminent threat to public health.

Additionally, these disclosures are more sensitive and require authorization, in some instances. Steps must be taken to not disclose information that could identify the patient. When unsure if the disclosure requires an authorization, healthcare providers should either contact a healthcare attorney or use caution and obtain patient consent. In February, the Office for Civil Rights (OCR)  released a bulletin to help healthcare providers navigate the COVID-19 pandemic and HIPAA.

Relying on your local or state public health agencies to report new cases of COVID-19 protects the healthcare provider from a potential HIPAA breach. This process ensures patient privacy and proper reporting format, and assists in containing public panic.

Consider Local Laws

In addition to HIPAA considerations, healthcare providers and public health agencies need to consider local and state laws when disclosing patient information. This includes awareness of any changes that are implemented during a declared public health emergency. Work with your healthcare attorney to create notifications to patient family members, care givers, and the media. Your attorney will be your best resource to help you ensure your notifications meet your local and state laws as well as ensure HIPAA privacy. If you need a referral to a healthcare attorney, please contact us and we can help put you in touch with a healthcare attorney in your area.

The coronavirus is not a case of public health versus patient privacy. As public health agencies and healthcare providers must work together to identify, treat, contain and prevent the further spread of COVID-19, they must also remember to work together to protect patient privacy.

HIPAAtrek and MPA can help make HIPAA compliance easier with policy downloads, training, and HIPAA software. Let us know if we can help. 

SIGN UP for MPA and HIPAAtrek's webinar:

Surviving HIPAA During COVID-19

March 25, 1:00 p.m. CST


MCS Signature November 2018

missing hipaa policies snip


Topics: HIPAA, security, COVID-19, privacy

    Privacy Policy           Terms of Use