HIPAA Reminders during COVID-19

From our home offices to yours, ComplianceDashboard wishes you safety & sanity during these crazy times! Benefit plan sponsors and managers may be feeling the “overwhelm” of hairpin implementation of plan changes due to COVID-19 Regulations.  No fear! We are here with you, sifting through the legislation, and summarizing essentials applicable to benefit plans. Watch our video for a summary of HIPAA regulatory changes; read below for HIPAA reminders.

HIPAA Privacy & Security Rule Reminders:

HIPAA compliance makes every plan manager’s task list. The Office of Civil Rights (OCR) reminds us HIPAA is still in effect and applicable during the public health emergency, even while working from home

• Privacy& Security Rules are active and in place for Covered Entities (CE).
• PHI created, received, maintained, or transmitted by the health plan is still protected.
• Voluntarily disclosed patient/employee health information is not PHI under HIPAA.
• Review HIPAA regulations regarding permissible disclosure exceptions.
• CEs may disclose PHI about the patient (without a patient authorization) as necessary to treat the patient or a different patient, including coordination or management of healthcare by one or more providers.
• CEs may disclose PHI without individual authorization to a public health authority (e.g., the CDC); at the direction of a public health authority to a foreign government agency; or to persons at risk.
• PHI may be shared with a patient’s family members, relatives, friend or others as identified by the patient, and as necessary to identify, locate, and notify family members. This may include the police, the press, or the public at large.
• PHI may be shared to prevent or lessen a serious and imminent threat to the health and safety of a person or the public.
• Generally, reporting to the media about an identifiable patient or test results of a patient may not be done without a written authorization.
• PHI disclosures must meet “minimum necessary” guidelines to accomplish the intended purpose

The information and content contained in this blog post are for general informational purposes only, and does not, and is not intended to, constitute legal advice. As always, for specific questions concerning your health plan, please consult your ERISA attorney or advisor.