COVID-19 Testing and HIPAA: July 2020 Legal Commentary

Historical context (July 2020): This archived discussion reproduces F. Peter Lehr’s July 24, 2020 analysis for Norris McLaughlin, published by The National Law Review. Temporary COVID-19 emergency provisions discussed below are no longer current: the federal public health emergency ended May 11, 2023. HIPAA generally regulates disclosures by covered health care entities, not employers’ own employment records. Disclosures to employers, public health authorities, and others depend on the specific HIPAA permission or legal obligation; a blanket authorization rule is inaccurate. See HHS employer-disclosure guidance and HHS public-health guidance. This is historical commentary, not individual legal advice.

As COVID-19 swab (PCR) and blood (antibody) testing continue to occur in greater numbers and diverse settings, it is important to recognize that the results of such tests are subject to HIPAA privacy and security compliance rules. There is a common public misconception that the declaration of a public health emergency has created a broad exception for covered entities and business associates to use and share COVID-19 testing results. This is not the case.

COVID-19 Compliance for Health Care Providers

First, it is important to recognize that the Department of Health and Human Services (HHS) has created an official website for health care providers which contains HIPAA-related information and guidance pertaining to COVID-19. Among the information available are notices issued by the HHS, such as the notice of enforcement discretion for telehealth services relating to COVID-19, which was analyzed in our previous blog post, “OCR Will Not Seek Enforcement Action for Use of Non-Compliance Telehealth Communications During the Coronavirus (COVID-19) National Public Health Emergency.”

In March, the HHS issued an extremely limited waiver of certain HIPAA requirements, which applied narrowly to hospitals that have instituted a disaster protocol, and then only for up to 72 hours after initiation of the protocol. Reports of this waiver led to a common public misconception that HHS was “relaxing” HIPAA rules. Notices and guidance from the HHS have repeatedly emphasized the need to observe HIPAA rules during the COVID-19 public health emergency.

COVID-19 Testing and HIPAA Compliance

Under HIPAA, a covered entity may disclose COVID-19 test results obviously to the individual patient, and may also use and disclose test results as necessary to treat the patient. There is also an exception that allows disclosure without authorization in cases of a serious and imminent threat to health and safety, to persons in a position to lessen the threat. Disclosure of test results to third parties, such as employers, must be done in compliance with HIPAA privacy rules. As is well known, an individual patient may authorize the release of COVID-19 test results to a third party in a written authorization that meets HIPAA requirements. Covered entities engaged in testing are well-advised to obtain such written authorization from the individual patient as a matter of course if the test results are to be disclosed to an employer. Public-health reporting and contact-tracing disclosures may be permitted or required without individual authorization when applicable HIPAA provisions and other laws allow them; each disclosure requires consideration of its purpose and recipient.

The public health activities provision of HIPAA permits covered entities to disclose COVID-19 test results to an employer without the individual’s authorization in very limited circumstances. The covered entity must provide the testing to the individual at the employer’s request, for information concerning a work-related illness or injury or workplace-related medical surveillance, and because such information is needed by the employer to comply with OSHA, the Mine Safety and Health Administration (MSHA), or similar state law requirements. In the context of COVID-19 testing, the public health activities exception may apply when the employer is a licensed health care facility, such as a skilled nursing facility, given that they may have such federal or state-mandated workplace safety reporting requirements. The covered entity must provide the employee with written notice of the disclosure to the employer in all such cases.  It is important to recognize that this exception generally would not apply to fitness-for-duty examinations.

For employers who have implemented COVID-19 testing as part of a pre-placement or fitness-for-duty examination, covered entities ordinarily need a valid individual authorization to disclose results to an employer unless another applicable HIPAA provision or law permits or requires the disclosure.