On June 12, 2020, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) issued guidance describing to healthcare providers that are regulated under HIPAA how they may permissibly use protected health information (PHI) to contact patients regarding blood and plasma donation opportunities. The guidance outlines how hospitals and other providers can reach out to patients who have recovered from COVID-19 to connect them with donation opportunities that may benefit others who have the virus.
Outreach to patients who have recovered from COVID-19 is permissible under the HIPAA regulations as a population-based activity that is related to improving health. It also may be permissible for the provider’s case management functions or for care coordination purposes. These exceptions also permit healthcare providers to use patient information to identify patients diagnosed with COVID-19 for the purpose of this outreach. OCR notes, however, that any use or disclosure of protected health information for these purposes must be limited to the minimum necessary to conduct this outreach.
OCR cautions that providers conducting outreach to patients may not receive payment from or on behalf of blood or plasma donation centers in exchange for conducting this patient outreach unless the patients provide written authorization.
Hospitals and other healthcare providers also must be careful if they transfer protected health information to a vendor for this outreach, or if they intend to provide patient information to a blood or plasma center to allow the center to reach out to individuals. Doing so without patient authorization may be a violation of HIPAA, unless the vendor or center is assisting the hospital with otherwise-permissible patient outreach, and unless the parties have a HIPAA business associate agreement in place.