H1N1 and Health Information Privacy

The potential for a swine flu or H1N1 pandemic raises questions about the ability of healthcare providers and sponsors of health plans to use and disclose health information.  It is important to understand that the HIPAA privacy rule is not suspended during a pandemic.  However, healthcare providers and plan sponsors that are covered entities under HIPAA can share health information in the following ways:

• Treatment – healthcare providers can share patient information as necessary to provide treatment.
• Notification – healthcare providers can share patient information as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for an individual’s care of the individual’s location, general condition or death.
• Imminent Danger – providers can share patient information with anyone as necessary to prevent or lessen a serious threat to the health and safety of a person or the public.
• Facility Directory – healthcare facilities maintaining a directory of patients can tell people who call or ask about individuals whether the individual is at the facility, their location in the facility, and general condition.
• Reporting Disease – health information can be reported to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease.
• National or Public Health Emergency – if the President of the United States declares an emergency or disaster and the Secretary of Health and Human Services declares a public health emergency, the Secretary may waive sanctions and penalties for non-compliance with certain provisions of the HIPAA Privacy Rule.

For more information contact: