Release of Health Department COVID-19 Case Information to News Media
March 18, 2020
Overview
Can a HIPAA covered health department release COVID-19 county level case information (number of COVID-19 cases by county) to the press to avert a serious threat to public health or safety?
Considerations:
HIPAA permits HIPAA covered entities to disclose protected health information (PHI) where the covered entity has a good faith belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Disclosure of a COVID-19 case at the county level is protected PHI. Disclosures to avert a serious threat to health must be consistent with all applicable law, such as state law, and conform to ethical standards. The disclosure must also occur to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. 45 CFR § 164.512(j).
The preamble to the original HIPAA Privacy Rule reflects the Office of Civil Rights’ (OCR) intent that the Rule be consistent with Tarasoff v. Regents of the University of California (17 Cal. 3d 425 (1976)) where the court held that:
when a therapist’s patient had made credible threats against the physical safety of a specific person, the therapist had an obligation to use reasonable care to protect the intended victim of his patient against danger, including warning the victim of the danger. Many states have adopted, through either statutory or case law, versions of the Tarasoff duty to warn. The rule is not intended to create a duty to warn or disclose. Rather, it permits disclosure to avert a serious and imminent threat to health or safety consistent with other applicable legal or ethical standards. If disclosure in these circumstances is prohibited by state law, this rule would not allow the disclosure. 65 FR 82461, 82538 (December 29, 2000).
Since the rule was finalized, OCR has issued guidance interpreting its scope. OCR states that this exception applies to a covered entity’s disclosure of PHI to public officials who are reasonably able to prevent or lessen a serious and imminent threat to public health or safety. OCR indicates that disclosure of a patient’s decision to stop taking medication to a family member is appropriate where the patient poses a serious and imminent threat to the health or safety of the patient or others and the family member is reasonably able to prevent or lessen the threat. OCR reiterates that this exception is derived from court decisions like Tarasoff v. Regents of the University of California. In a 2013 letter to health care providers, OCR states that HIPAA does not prevent their disclosure of necessary patient information to law enforcement, family members of the patient, or others, when the health care provider believes that the patient presents a serious danger to himself or others, per 45 CFR § 164.512(j). OCR states that it will not second guess a health professional’s good faith belief that disclosure to anyone who is in a position to prevent or lessen the threatened harm is appropriate. Anyone could include family, friends, caregivers and law enforcement. Anyone might also include the target of the threat or others who the covered entity has a good faith belief can mitigate the threat.
On its enforcement page, OCR provides information about a case where a hospital shared information about an unusual sporting accident with the local media, without patient authorization. The hospital shared copies of the patient’s skull x-ray as well as a description of the complainant’s medical condition. The paper reported the individual’s x-ray, date and location of the accident, patient’s gender and a description of the patient’s medical condition. The hospital asserted that the disclosures were made to avert a serious threat to health or safety under 45 CFR § 164.512(j). OCR investigated this case and concluded that the disclosure did not meet the Privacy Rule’s requirements.
A health department might consider the following questions as it evaluates whether its proposed disclosure to the media complies with 45 CFR § 164.512(j):
- Has the health department documented the factual analysis and thinking that lead it to the decision to disclose or not?
- Who at the health department formed the good faith belief? Is it the product of professional judgment based on professional services? What are the individual’s credentials?
- What is the context for the belief? Is it based upon the statement or action of a particular patient?
- Does state law provide a more stringent standard?
- Do other federal laws apply, such as 42 CFR Part 2 which regulates substance use disorder records?
In the context of disclosure of COVID-19 county case information, health departments will need to determine whether the press release is intended to avert a serious threat to health. Does the health department need the public to respond differently to the COVID-19 threat once a particular county is identified as having an active case? Health departments must establish a nexus between the information disclosed and the intended action by recipients of the information that will prevent or lessen the threat of COVID-19 spread.
HIPAA covered health departments might also evaluate whether disclosure of county level COVID-19 case information meets HIPAA’s expert method de-identification standard. The Network for Public Health Law’s quick reference explains this method.
The Network for Public Health Law provides information and education about laws related to the public’s health. We do not provide legal representation or provide advice on a particular course of action.