Post by Amanda Abbott and Sammy Chang
COVID-19 has brought up many issues for health care facilities, some touching on fundamentals that are taking on new complexities. For example, the pandemic has caused health care providers to question obligations to notify patients, staff, visitors, vendors, and employees of possible exposures to COVID-19 in contrast to the duty to protect patient privacy.
QUICK REFERENCE: WHAT PROVIDERS CAN DISCLOSE**
Discussion of Legal Authorities and Guidance
When is Disclosure Required?
California regulations/regulatory agencies require:
Every health care provider knowing of or in attendance on a case or suspected case of diseases like COVID-19 report to the local public health office.
General acute care hospitals must report “as soon as reasonably practical” by telephone to CDPH or the local health officer for:
"epidemic outbreak, poisoning, fire, major accident, disaster, other catastrophe or unusual occurrence which threatens the welfare, safety or health of patients, personnel or visitors,” or
all cases of reportable disease (like COVID-19) (i.e. patient positive cases)
CDPH requires that COVID-19 be reported immediately by phone to local health officials and CDPH’s District Offices.
Contact information found here.
California has long vexed hospitals with its ambiguous requirement to report and disclose “unusual occurrences” to public health officials. Current hospital policy should address a definition of unusual occurrences that can be applied or modified to address public health emergencies.
Example: Known or suspected COVID-19 exposure by visitors, vendors, staff, etc., constitutes an unusual occurrence as COVID-19 exposure at the facility may threaten the health of others.
When is Disclosure Permitted?
Federal and California state law allows disclosure of PHI (federal) or medical information (i.e. any individually identifiable information) (California) under the following circumstances without a patient’s consent:
What Can be Disclosed?
Before making a required or permitted disclosure discussed above, verify that your selection of information to disclose is compliant.
Name and identifying information of an infected or exposed individual, if the sharing is for the situations described above or to law enforcement, paramedics, first responders when required by law.
When a health care provider or individual reports a case or suspected case of diseases and conditions like COVID-19 to public health authorities, the provider or individual must include:
name of the disease or condition being reported;
the dates of onset and diagnosis;
the name, address, telephone number, occupation, race/ethnic group, Social Security number, gender, pregnancy status, age, and date of birth for the case or suspected case;
the date of death if death has occurred; and
the name, address and telephone number of the person making the report.
CDPH Guidance issued Fall 2019 recommends that hospitals:
Communicate, verbally and in writing, the increase in infections to affected patients (with the infection or exposed), visitors, and other health care providers within 24 hours of when an outbreak is identified.
When authorized by public health authorities, post visible written communications about the increase in patient infections in common areas of affected wards and units.
Other Limitations of Disclosure
Disclosure should be as narrow as possible.
HIPAA’s catch all “minimum necessary” rule still applies:
Any disclosure must only be made to the extent necessary to accomplish the intended purpose of the use, disclosure, or request or be limited to the relevant requirements of any law authorizing or requiring the disclosure.
This does not apply to disclosure for treatment purposes.
Specific limitations:
The source patient's identity may not be disclosed when informing a person who may be exposed to a patient with a communicable disease, unless otherwise allowed by federal and state law.
Disclosure to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition:
Only if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation.