Situation Report | January 11, 2021
Last December, the U.S. Department of Health and Human Services Office for Civil Rights issued guidance addressing how the Health Insurance Portability and Accountability Act (HIPAA) permits covered entities and their business associates to use health information exchanges (HIEs) to disclose protected health information (PHI) for the public health activities of a public health authority (PHA).
The guidance provides examples relevant to the COVID-19 public health emergency on how HIPAA permits covered entities and their business associates to disclose PHI to an HIE for reporting to a PHA that is engaged in public health activities.
It addresses circumstances when the HIPAA Privacy Rule permits such PHI disclosures without an individual’s authorization, along with various other notice or disclosure requirements applicable to an HIE, covered entities, and business associates in such circumstances.