/>iOn June 12, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) issued timely HIPAA guidance (Guidance) regarding solicitations of blood and plasma donations from recovered COVID-19 patients.
In the Guidance, OCR affirms that health care providers can use patient information to identify patients that have recovered from COVID-19 to provide information about how they may donate plasma or blood with COVID-19 antibodies to support treatment of other patients with COVID-19. OCR explains that this use of protected health information would be permissible as part of a provider’s health care operations to enable case management of COVID-19 patient populations. OCR also reminds providers that because the activity is a health care operation and not for treatment purposes, HIPAA’s minimum necessary standard applies to any use or disclosure of protected health information in connection with the solicitation of blood or plasma donations.
OCR warns that providers may only contact recovered COVID-19 patients for these purposes to the extent the activities do not constitute “marketing” (as defined under HIPAA), and therefore a provider may not receive any direct or indirect remuneration from or on behalf of a third party whose service is described in the communication (e.g., a blood or plasma donation center). OCR also warns that providers cannot disclose protected health information to a third party without individual authorization to allow the third party to make marketing communications to patients (except where the communication is done by a business associate on behalf of a provider). OCR instructs that a hospital therefore would not be permitted to disclose protected health information to a third party blood and plasma donation center to enable that third party center to solicit donations directly from recovered hospital COVID-19 patients.
The Guidance represents the latest in a series of HIPAA guidance communications from OCR to support providers during the COVID-19 public health emergency (see our analyses of previous HIPAA guidance documents here, here, here and here).
