logo
logo
logo
MENU
Categories
Hospitals and Health Systems - Audits and ReimbursementHospitals and Health Systems - Consent and TreatmentHospitals and Health Systems - Corporate and GovernanceHospitals and Health Systems - Corporate ComplianceHospitals and Health Systems - Fraud and AbuseHospitals and Health Systems - Government InvestigationsHospitals and Health Systems - Health RecordsHospitals and Health Systems - HIPAA and HITECHHospitals and Health Systems - Managed CareHospitals and Health Systems - Medical Staff IssuesHospitals and Health Systems - Medical Training ProgramsHospitals and Health Systems - MedicareHospitals and Health Systems - Mergers, Affiliations and Joint VenturesHospitals and Health Systems - Peer ReviewHospitals and Health Systems - Professional Services AgreementsMedical SocietiesPharmaceutical Industry - Agreements with PhysiciansPharmaceutical Industry - Clinical ResearchPharmaceutical Industry - Regulatory CompliancePhysicians and Providers - Audits and ReimbursementPhysicians and Providers - CertificationsPhysicians and Providers - CredentialingPhysicians and Providers - Disciplinary ActionsPhysicians and Providers - Employment AgreementsPhysicians and Providers - Fraud and AbusePhysicians and Providers - Government InvestigationsPhysicians and Providers - HIPAA and PrivacyPhysicians and Providers - ImpairmentPhysicians and Providers - LicensingPhysicians and Providers - LitigationPhysicians and Providers - MedicarePhysicians and Providers - Peer ReviewPhysicians and Providers - Practice AcquisitionsPhysicians and Providers - Practice IssuesPhysicians and Providers - Regulatory CompliancePhysicians and Providers - SupervisionPhysicians and Providers - TrainingUncategorized
F. Peter Lehr
Member
F. Peter Lehr
Visit Profile

COVID-19 Testing and HIPAA Compliance

COVID-19 Testing, Treatment, and Vaccine- HIPAA Compliance

As COVID-19 swab (PCR) and blood (antibody) testing continue to occur in greater numbers and diverse settings, it is important to recognize that the results of such tests are subject to HIPAA privacy and security compliance rules. There is a common public misconception that the declaration of a public health emergency has created a broad exception for covered entities and business associates to use and share COVID-19 testing results. This is not the case.

COVID-19 Compliance for Health Care Providers

First, it is important to recognize that the Department of Health and Human Services (HHS) has created an official website for health care providers which contains HIPAA-related information and guidance pertaining to COVID-19. Among the information available are notices issued by the HHS, such as the notice of enforcement discretion for telehealth services relating to COVID-19, which was analyzed in our previous blog post, “OCR Will Not Seek Enforcement Action for Use of Non-Compliance Telehealth Communications During the Coronavirus (COVID-19) National Public Health Emergency.”

In March, the HHS issued an extremely limited waiver of certain HIPAA requirements, which applied narrowly to hospitals that have instituted a disaster protocol, and then only for up to 72 hours after initiation of the protocol. Reports of this waiver led to a common public misconception that HHS was “relaxing” HIPAA rules. Notices and guidance from the HHS have repeatedly emphasized the need to observe HIPAA rules during the COVID-19 public health emergency.

COVID-19 Testing and HIPAA Compliance

Under HIPAA, a covered entity may disclose COVID-19 test results obviously to the individual patient, and may also use and disclose test results as necessary to treat the patient. There is also an exception that allows disclosure without authorization in cases of a serious and imminent threat to health and safety, to persons in a position to lessen the threat. Disclosure of test results to third parties, such as employers, must be done in compliance with HIPAA privacy rules. As is well known, an individual patient may authorize the release of COVID-19 test results to a third party in a written authorization that meets HIPAA requirements. Covered entities engaged in testing are well-advised to obtain such written authorization from the individual patient as a matter of course if the test results are to be disclosed to an employer. Written authorization is also advisable if the covered entity will use the test results for contact tracing purposes.

The public health activities provision of HIPAA permits covered entities to disclose COVID-19 test results to an employer without the individual’s authorization in very limited circumstances. The covered entity must provide the testing to the individual at the employer’s request, for information concerning a work-related illness or injury or workplace-related medical surveillance, and because such information is needed by the employer to comply with OSHA, the Mine Safety and Health Administration (MHSA), or similar state law requirements. In the context of COVID-19 testing, the public health activities exception may apply when the employer is a licensed health care facility, such as a skilled nursing facility, given that they may have such federal or state-mandated workplace safety reporting requirements. The covered entity must provide the employee with written notice of the disclosure to the employer in all such cases.  It is important to recognize that this exception generally would not apply to fitness-for-duty examinations.

For employers who have implemented COVID-19 testing as part of a pre-placement or fitness-for-duty examination, covered entities may not disclose results to the employer absent written authorization from the individual patient to do so.

f you have any questions or would like any assistance in better understanding HIPAA privacy and security rules, please feel free to contact me at plehr@norris-law.com. For other topics related to COVID-19, visit our Coronavirus Thought Leadership Connection.

The information contained in this post may not reflect the most current developments, as the subject matter is extremely fluid and constantly changing. Please continue to monitor this site for ongoing developments. Readers are also cautioned against taking any action based on information contained herein without first seeking advice from professional legal counsel.

Share
Related Posts
OSHA Issues COVID-19 Safety Rule: Emergency Temporary Standard (ETS)
Impact of the COVID Pandemic on Physician Employment Agreements
Telemedicine and the COVID-19 Vaccination – What’s on the Horizon for 2021?
F. Peter Lehr
Member
F. Peter Lehr
Visit Profile
Related Posts
OSHA Issues COVID-19 Safety Rule: Emergency Temporary Standard (ETS)
Impact of the COVID Pandemic on Physician Employment Agreements
Telemedicine and the COVID-19 Vaccination – What’s on the Horizon for 2021?
Share
Join our growing team
We are looking for quality attorneys to help us do more for our clients. At Norris McLaughlin, each attorney has the same opportunity to succeed whether you’re at the beginning of a career or pinnacle of the profession.
Subscribe to our content
Receive timely legal information
delivered to your inbox
Subscribe to our content
Receive timely legal information
delivered to your inbox
© 2022, Norris McLaughlin, P.A., All Rights Reserved. Attorney Advertising.
Meritas

We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume you consent to our cookie policy. Learn more