HIPAA in the time of COVID-19: What information can be shared to keep the public safe? What remains private?

HIPAA in the time of COVID-19: What information can be shared to keep the public safe? What remains private?
HIPAA Explainer

SOUTHEASTERN NORTH CAROLINA (WECT) - The number of cases of the novel coronavirus in Southeastern North Carolina continues ticking upward, and with every increase come additional questions about those affected.

The WECT newsroom has received countless phone calls, emails and social media messages asking for details on those diagnosed with COVID-19, with many wanting to know who those people are and their movements prior to getting a positive test result.

The Law

The biggest barrier to answering those questions is the Health Insurance Portability and Accountability Act, known colloquially as “HIPAA,” which protects an individual’s private healthcare information.

According to the United States Department of Health and Human Services: “The Privacy Rule protects individually identifiable health information from unauthorized or impermissible uses and disclosures. The Rule is carefully designed to protect the privacy of health information, while allowing important health care communications to occur.”

In general, healthcare providers can only release an individual’s information with written consent, unless that information is critical for the patient’s treatment or the protection of the public at large.

In their releases, local governments have alluded to HIPAA when announcing new cases of COVID-19.

For example, when announcing its second confirmed case of the virus, Pender County officials said the individual’s case was travel-related, but stated: “To protect the individual’s privacy, no further details will be released.”

While the COVID-19 pandemic does not rule HIPAA void, the federal government has provided new guidelines that allow for some information to be shared by hospitals in order to stop the spread of the disease.

HIPAA allows healthcare providers to share protected patient information — without the patient’s written consent — with law enforcement, paramedics, other first responders and public health agencies, as long as the sharing of that information is needed to best treat the patient or control the spread of the disease.

For example, 911 call centers across Southeastern North Carolina have begun screening callers for COVID-19 symptoms, and the new HIPAA guidelines allow dispatchers to maintain a list of positive COVID-19 cases in order to best protect first responders.


Lisa Brown, public health preparedness coordinator for New Hanover County, explained not only does the law limit what information can and should be shared, but she said releasing the names of COVID-19 patients and other identifying information “would ultimately be counterproductive.”

She said the most pressing reason is the patient’s safety.

“There have been instances of individuals being identified in other jurisdictions through the demographic and case information shared, which led them to be identified by the public as being a patient with COVID-19. The results have been unwanted levels of attention and harassment,” Brown said.

Hospitals and doctors are supposed to share testing information for suspected COVID-19 cases, as well as any positive test results, with the county and state so those public health agencies can trace the individual’s contact with others.

Brown said while people may want to figure out on their own if they’ve had contact with an infected person, a practice of publicly identifying cases of the virus could stymie that process.

“The public health contact tracing process is dependent on the person with the communicable disease being open and transparent about who they have had contact with and when. If they fear publically being named, it is likely this will result in the individual not being fully transparent about who they have potentially exposed or where they have been, actually leading to more cases of COVID-19 rather than less,” she said.

Brown said the fear of being named or having enough information released for the public to figure out the identity of a patient could also lead people to avoid medical care for the virus, which would result in a negative outcome for that person.

Ultimately, Brown said because COVID-19 is now considered “widespread” and there has been documented community transmission, identifying information would not help anyway.

“Identifying information in that case could give a false sense of security if certain people or places are avoided, when it is understood that transmission is possible anywhere,” she said.

Copyright 2020 WECT. All rights reserved.