Dear COBA Members;

In recent days COBA was notified by some of our members that they were being notified of the results of their COVID-19 testing by the Dept and not by their Healthcare Provider. This obviously raises concerns about HIPAA Regulations and the Right to Privacy of Protected Healthcare Records and Information. As such, we immediately began an investigation along with our Attorneys and County Officials as to whether this practice is a violation of HIPAA Rules.

What we found is that there is an exemption for Healthcare Providers both private and municipal such as the County's setup at NUMC because of the public health crisis, COVID-19 Pandemic.  

As per the United Stated Dept of Health and Human Services, Office of Civil Rights, the HIPAA Privacy Rule permits a covered entity (the Healthcare Provider) to disclose the protected health information (PHI) of an individual who has been infected with, or exposed to COVID-19 with Law Enforcement, Paramedics, other First Responders and Public Health Authorities without the individual's HIPAA authorization in certain circumstances including the following:  

1.) When the disclosure is needed to provide treatment.

2.) When required by law.  

For our purposes, most importantly:  

3.) To notify a Public Health Authority in order to prevent or control spread of the disease. HIPAA permits a covered entity (the healthcare provider) to disclose PHI to a Public Health Authority (in Nassau County this would be the Dept of Health) for the purpose of preventing or controlling the disease, injury, or disability, including for Public Health surveillance, Public Health investigations and Public Health interventions.  

4.) When First Responders may be at risk for infection.

5.) When the disclosure of PHI to First Responders is necessary to prevent a serious and imminent threat to the health and safety of a person or the public.

6.) When responding to a request for PHI by a Correctional Institution or Law Enforcement Official having lawful custody of an inmate or other individual.

Most importantly, a covered entity (the healthcare provider) MUST MAKE REASONABLE EFFORTS to limit the information used or disclosed under any provision listed above to that which is "minimally necessary" to accomplish the purpose of the disclosure.

Long story short. YES your Doctor or any testing facility is legally permitted to disclose the results of your COVID-19 test with the local Health Dept who then notifies the County/Dept of your status.  

This information is limited only to information related to the public health threat that is COVID-19 and no other health related condition.

If you would like to read the entire text of the release related to this issue, please click on the link below which will bring you to the US Dept of Health and Human Services site containing a lot of very useful information on this topic.  

https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf

Always In Unity;

Brian Sullivan, COBA President