Today, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) issued guidance to help the public understand when the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule applies to disclosures and requests for information about whether a person has received a COVID-19 vaccine.
In the guidance, OCR reminds the public that the HIPAA Privacy Rule does not apply to employers or employment records. The HIPAA Privacy Rule only applies to HIPAA covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions), and, in some cases, to their business associates. The HIPAA Privacy Rule applies to most EMS providers but only as it relates to it’s patient’s Protect Health Information (PHI).
Today’s guidance addresses common workplace scenarios and answers questions about whether and how the HIPAA Privacy Rule applies. The Privacy Rule does not apply when an individual:
Generally, the Privacy Rule does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce
The Privacy Rule does not prohibit a covered entity or business associate from requiring or requesting each workforce member to:
OCR stated that they are issuing this guidance to help consumers, businesses, and health care entities understand when HIPAA applies to disclosures about COVID-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from COVID-19.
More details about the latest guidance on HIPAA, COVID-19 Vaccinations, and the Workplace may be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-covid-19-vaccination-workplace/index.html. If you have questions regarding what information you may or may not share relative to COVID-19 vaccinations, please contact the AAA for assistance.
News Release from the U.S. Department of Health and Human Services | Monday, July 20, 2020
Yesterday, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) is issuing guidance to ensure that recipients of federal financial assistance understand that they must comply with applicable federal civil rights laws and regulations that prohibit discrimination on the basis of race, color, and national origin in HHS-funded programs during COVID-19. This Bulletin focuses on recipients’ compliance with Title VI of the Civil Rights Act of 1964 (Title VI).
To help ensure Title VI compliance during the COVID-19 public health emergency, recipients of federal financial assistance, including state and local agencies, hospitals, and other health care providers, should:
OCR is responsible for enforcing Title VI’s prohibitions against race, color, and national origin discrimination. As part of the federal response to this public health emergency, OCR will continue to work in close coordination with our HHS partners and recipients to remove discriminatory barriers which impede equal access to quality health care, recognizing the high priority of COVID-19 testing and treatment.
Roger Severino, OCR Director, stated, “HHS is committed to helping populations hardest hit by COVID-19, including African-American, Native American, and Hispanic communities.” Severino concluded, “This guidance reminds providers that unlawful racial discrimination in healthcare will not be tolerated, especially during a pandemic.
“Minorities have long experienced disparities related to the medical and social determinants of health – all of the things that contribute to your health and wellbeing. The COVID-19 pandemic has magnified those disparities, but it has also given us the opportunity to acknowledge their existence and impact, and deepen our resolve to address them,” said Vice Admiral Jerome M. Adams, Surgeon General, MD, MPH. “This timely guidance reinforces that goal and I look forward to working across HHS and with our states and communities to ensure it is implemented.”
To read the new OCR Bulletin, please visit: Title VI Bulletin – PDF
To learn more about non-discrimination on the basis of race, color, national origin, sex, age, and disability; conscience and religious freedom; and health information privacy laws, and to file a complaint with OCR, please visit: www.hhs.gov/ocr.
For more OCR announcements related to civil rights and COVID-19, please visit: https://www.hhs.gov/civil-
Office for Civil Rights Guidance on COVID-19 and HIPAA disclosures to law enforcement, paramedics, other first responders, and public health authorities
by Kathy Lester, J.D., M.P.H.
On March 24, the Office for Civil Rights (OCR) released guidance clarifying that any covered entity may share the name or other identifying information of an individual who has been infected with, or exposed to, COVID-19 with law enforcement, paramedics, other first responders, and public health authorities without an individual’s authorization. This clarification allows ground ambulance entities and their personnel to share the information consistent with the guidance. It also allows other covered entities such as hospitals, physicians to share the information with ground ambulance entities and their personnel. Finally, there are no HIPAA restrictions on non-covered entities, such as law enforcement, families, public health departments, and 911 call centers (not otherwise covered entities), from sharing the information. There may be State confidentiality laws that apply as well, and the AAA encourages ground ambulance entities to review the laws in the States in which they operate.
The authority to share this information is in the existing HIPAA regulation – this is not a waiver or a change in the current law. OCR highlights the current authority in the guidance.
The guidance provides the example of a physician at a medical facility sharing an inmate’s positive COVID-19 status with correctional guards.
For all of these disclosures, with the exception of those that are required by law or for the purpose of treatment, the covered entity must provide the minimum amount of information necessary to accomplish the purpose. For example, the guidance states that a hospital should not distribute a list of individuals who are COVID-19 positive or suspected to have the virus to EMS personnel, but rather disclose the information on a case-by-case basis about the specific patient being treated. Similarly, a 911 call center that is a covered entity may provide such information to a police office or similar personnel being dispatched to the scene to allow the responder to take the necessary precautions.
The guidance also provides additional examples that reference specific types of covered entities, but these are just examples. The laws apply to all covered entities and not just those highlighted in the examples.
The DHS Office of Civil Rights has released guidance for mobile healthcare providers serving in the COVID-19 pandemic.
Download the PDF Guidance►