Coronavirus Disclosure: Pitfalls to Avoid


COVID-19 is a national emergency. Healthcare providers and public health agencies are working in overdrive to prevent the further spread of the virus. As healthcare professionals are identifying new cases of COVID-19, they are following the required protocols for notifying public health agencies and alerting those that may be at risk of exposure to the virus.

Yesterday, we posted on permissible HIPAA disclosures during a public health emergency. The risk of over-disclosure is prevalent as we work to protect the public by informing those that may have had contact with a COVID-19 infected patient. Care needs to be taken to release only the minimum necessary information to properly inform those at risk for infection. This will become increasingly important as more cases are identified.

Rely on Public Health Agencies

Rely on your public health agencies to make media disclosures and locate potentially exposed persons. If you have a public relations department, work with them to ensure only relevant disclosures are made and that those disclosures do not include any PHI identifiers.

PHI Identifiers include:

  • Name
  • Geographical areas
  • Dates, except of year (unless over the age of 89)
  • Telephone and Fax numbers
  • Social Security numbers
  • Email addresses
  • Medical record numbers
  • Account numbers
  • Health plan beneficiary numbers
  • Certificate/license numbers
  • Vehicle identification and serial numbers, including license plates
  • Web URLs
  • Device identifiers and serial numbers
  • Internet protocol addresses
  • Full face photographs and comparable images
  • Biometric identifiers
  • Any other unique identifying number or code

Relying on your local or state public health agencies to report new cases of COVID-19 protects the healthcare provider from a potential HIPAA breach. This process ensures patient privacy, proper reporting format is followed, and assists in containing public panic.

Consider Local Laws

In addition to HIPAA considerations, healthcare providers and public health agencies need to consider local and state laws when disclosing patient information. This includes awareness of any changes that are implemented during a declared public health emergency. Work with your healthcare attorney to create notifications to patient family members, care givers, and the media. Your attorney will be your best resource to help you ensure your notifications meet your local and state laws as well as ensure HIPAA privacy. If you need a referral to a healthcare attorney, please contact us and we can help put you in touch with a healthcare attorney in your area.

Need More Guidance? Grab Our PHI Decision Tree!

This simple cheat sheet makes it easy to recognize every time you’re interacting with protected health information.

Decision Tree Preview

Contact us for more information about how to stay HIPAA compliant during this pandemic.

Request A HIPAAtrek Demo

HIPAAtrek User
Compliance is complicated. Your compliance software doesn’t have to be. Schedule your demo today!

You Might Also Like

Is the Telehealth you’ve adopted secure?

Many patients and providers who would not have normally considered telehealth as a regular way to access healthcare are now utilizing the services. Many patients are afraid to go the hospital or doctor office in fear of exposing themselves and loved ones to Covid-19. Luckily, doctors can still reach their patients and provide medical care online. After this pandemic is over, many suspect that telehealth will still be sticking around. Now may be a good time to consider how to make your telehealth services more secure.

Read More »