In a recent blog post, colleagues in our Employment, Labor & Workforce Management practice addressed the legal framework pertaining to coronavirus (COVID-19) risks in the workplace.  As the number of cases continues to the climb in the U.S., it is imperative that HIPAA covered entities and their business associates are aware of their privacy and security responsibilities in the midst of this public health emergency.  EBG provides this guidance on how to effectively respond to the coronavirus public health crisis while navigating patient privacy issues.

Last month, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) provided a bulletin to assist entities in determining ways patient information could be permissibly shared in compliance with HIPAA in the event of an outbreak of infectious disease or other emergency situations.  The regulators are onboard with dissemination of protected health information (PHI) to support public health. OCR has outlined several ways by which the HIPAA Privacy Rule permits entities to disclose PHI without a patient’s authorization:

  1. Covered entities may disclose PHI about the patient as necessary to treat the patient or to treat a different patient.
  2. Covered entities may disclose requested PHI to a public health authority, a foreign government agency (at the direction of a public health authority) that is collaborating with the public health authority, and persons at risk of contracting or spreading a disease or condition if authorized by law.
  3. Covered entities may share PHI with a patient’s family, friends, relatives, or other persons identified that were involved in the patient’s care.
  4. Health care providers may share PHI with anyone in order to prevent or lessen a serious and imminent threat to the public health and safety.

Health care providers are required to comply with the “minimum necessary” standard when disclosing PHI of patients with the coronavirus, which means that such providers must make reasonable efforts to disclose only the patient information necessary to achieve the purpose of the disclosure.  In addition, during emergencies, covered entities must implement reasonable safeguards to protect PHI against any “intentional or unintentional uses and disclosures” in violation of HIPAA.

As public health agencies and entities feverishly work together to contain the spread of coronavirus and treat affected individuals in the U.S., it is vital that entities leverage this HIPAA guidance to effectively share patient information while protecting privacy.  Effective response to public health crises will require striking this appropriate balance of interests.

For more information, please contact a member of the Privacy, Cybersecurity and Data Asset Management team at:

Alaap B. Shah

Brian Hedgeman

Back to Health Law Advisor Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.