Read More

HHS Clarifies Use of PHI Regarding Plasma Donation

On June 12, 2020, the Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) released guidance instructing health care providers on how to contact recovered COVID-19 patients regarding convalescent plasma donation in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

On August 23, 2020, the Food and Drug Administration (FDA) issued an emergency use authorization for investigational convalescent plasma to aid in the treatment of hospitalized COVID-19 patients. Accordingly, the OCR updated its guidance from June on August 24, 2020 to include health plans alongside health providers with the goal of increasing donation opportunities.

HIPAA and Contacting Former COVID-19 Patients

Under the HIPAA Privacy Rule, HIPAA-covered entities (or business associates on its behalf) are permitted to use or disclose personal health information (PHI) for several purposes such as treatment, payment, and health care operations without an individual’s prior authorization. The OCR clarified that using PHI to contact former COVID-19 patients about donations constitutes “a health care operations activity to the extent that facilitating the supply of donated plasma would be expected to improve the covered health care provider’s or health plan’s ability to conduct case management for patients or beneficiaries that have or may become infected with COVID-19.”

Using PHI to identify and contact individuals in this manner may be conducted without authorization, provided the activity is not considered marketing, in violation of HIPAA, which promotes the purchase or use of a product or service. Accordingly, health care providers or health plans providing donation information for the purposes of their health care operations must not receive any compensation for services they describe. Except for business associates, the OCR cautions that prior authorization is required for a health care provider or health plan to disclose PHI about recovered individuals to a blood or plasma donation center.

Next Steps

If a health care provider or health plan wishes to reach out to recovered COVID-19 patients for this purpose, it is vital they carefully document the reason and whether prior authorization is required.