By: Andrew Silverio, Esq.

Recently, the Department of Health and Human Services released updated guidance outlining some permissible uses of Protected Health Information (PHI) under HIPAA in regard to recovered COVID-19 patients (available at www.hhs.gov/sites/default/files/guidance-on-hipaa-and-contacting-former-covid-19-patients-about-plasma-donation.pdf).  This guidance, which applies to health care providers, health plans, and their business associates, is an expansion of previous guidance which applied only to health care providers.

In essence, the guidance provides that these entities can use PHI to identify and contact individuals who have recovered from COVID-19 in order to inform them about how to donate their plasma, which will contain antibodies to SARS-CoV-2 which are useful in potentially treating COVID-19 patients. This activity has been classified as falling within the category of “health care operations,” and thus PHI can be used for this purpose without an individual’s authorization. 

HHS outlines that these activities constitute “health care operations” in that “facilitating the supply of donated plasma would be expected to improve the covered health care provider’s or health plan’s ability to conduct case management for patients or beneficiaries that have or may become infected with COVID-19.”  In regard to a health plan (as opposed to a particular provider who may use collected plasma itself to treat other patients), this justification’s connection to the “health care operations” of the specific covered entity seems tenuous.  It is difficult to see how, for a health plan as opposed to a provider, an interest in increasing the availability of antibody-containing plasma generally actually furthers the “health care operations” goals of the particular plan.  However, the public interest rationale here is crystal clear.

The guidance does come with an important caveat – the use of PHI for this purpose is only permitted to the extent that the outreach does not constitute marketing, which HHS outlines as “a communication about a product or service that encourages the recipient of the communication to purchase or use the product or service.”  This should not be an issue for plans, but providers likely have to walk a fine line when they provide the services in question.