Printer Friendly, PDF & Email

OCR: Yes, You Can (Contact COVID-19 'Survivors' About Blood Donations)

Many a HIPAA covered entity (CE) pulls back from sharing information, even when permitted to do so, because of fear of enforcement action by the HHS Office for Civil Rights (OCR); many a family member is told “HIPAA won’t let me,” when asking for information they are allowed to have.

To be sure, OCR has undertaken dozens of actions against errant CEs (and occasionally a business associate) for a variety of infractions, ranging from recent cases of not sharing patient records in a timely manner to failing to perform a required security risk analysis, leading to a large data breach. But agency officials have always tried to stress that they’ve never pursued a doctor, hospital or other entity for releasing information that, based on professional judgment, was deemed to be for the benefit of a patient.

In fact, in recent guidance, OCR has sought to expand upon the permissive nature of HIPAA (i.e, you can share unless the action is expressly disallowed). This was seen in response to the opioid crisis and now relates to the COVID-19 pandemic, telehealth, sharing information with first responders, certain waivers for enforcement related to hospitalizations and testing sites—to name a few.

This document is only available to subscribers. Please log in or purchase access.