The Health Insurance Portability and Accountability Act of 1996, better known as HIPAA, was enacted in an effort to limit dissemination of personal health information. Additionally, it is widely cited as justification for refusal to disclose specific and general health care information. However, various misconceptions as to what entities HIPAA applies to and what information is covered may create public health issues.
Essentially, HIPAA prevents covered entities from using or disclosing personal health information in any form. Even when privacy rules permit disclosure, such covered entities are obligated to only disclose the minimum necessary information in order to accomplish the purpose behind said disclosure. What many may not realize is that covered entities are also not permitted to share information with patients or their representatives unless the information relates to treatment, payment or health care operations.
Notably, covered entities include health care providers, public health entities, health plans and health care clearinghouses. Institutions including schools, property managers, businesses, etc., are not covered entities with obligations to maintain confidentiality under HIPAA. While other privacy rules may limit disclosure of medical information, entities outside the realm of health care are not bound by the minimum necessary information standard.
In recent media and communications, non-covered entities frequently cite to HIPAA as a reason for their refusal to disseminate more specific information pertaining to the location and recent whereabouts of those who have confirmed cases of COVID-19 or potentially may have been exposed to the disease. While respect of privacy is a valid concern, this approach is short-sighted as it limits the ability of uninfected individuals to safeguard against the spread of the virus.
Limited disclosure of the whereabouts of an infected or exposed individual is vital to contact tracing and spread prevention, and multitudes of institutions are not barred by HIPAA from such disclosure. For example, sharing the building in which an infected person lives may help other residents of a housing complex avoid areas where contact is more likely and practice increased vigilance if avoidance is not possible. Ideally, all individuals would be engaged in perfect social distancing measures by keeping appropriate distance, washing hands as often as recommended and seriously limiting travel. However, recent events have made it clear that such efforts are aspirational and not what is practiced across the board. Knowledge of where positive cases of COVID-19 have been documented gives others more notice as to what areas should be avoided if possible and allows those traveling to a location within proximity of an individual with COVID-19 to take all necessary precautions.
However, such efforts will not be possible so long as schools, property managers, shopping centers, etc., improperly cite HIPAA as a basis for withholding even the most general information. While HIPAA is designed to protect information, it is tailored to health care professionals, suggesting that the intent is not to place a complete barrier to knowledge of present public health concerns.
Notably, institutions should not completely disregard the privacy of individuals with known and potential exposure. However, a great deal of general information concerning the presence and/or whereabouts of the coronavirus can be shared without specifying the affected individual. Doing so would give others the ability to make certain that they take proper precautions, either by avoiding locations where the affected person has been or resides, or by being as careful and vigilant as possible if avoidance is not an option.
HIPAA does not bar any person or entity, apart from covered entities, which include health care providers, public health entities, health plans and health care clearinghouses, from disclosing medical information. Without encouraging others to abandon all sense of privacy, it is worth noting that a greater amount of information can be shared in an effort to slow and halt the spread of coronavirus. An appropriate spread of information will most likely be useful in the practice of social distancing. Therefore, the notion that HIPAA bars non-covered entities from disclosing information in a socially responsible manner presents unnecessary risks and challenges as we continue to press through these uncertain times.
Mallarie Charbonneau is a 2019 graduate of Northeastern University School of Law. Charbonneau has a background in various areas of civil litigation, including products liability, toxic tort and commercial litigation. Her most recent legal experience focused on civil litigation, specifically in the areas of personal injury, construction and premises liability. Prior to attending Northeastern, Charbonneau graduated from Simmons University (formerly Simmons College) summa cum laude as a history and philosophy double major.