On August 24, 2020, the Office for Civil Rights (OCR) issued amended guidance on HIPAA compliance during the COVID-19 pandemic. On June 12, 2020, OCR issued initial guidance on how the HIPAA Privacy Rule permits covered health care providers (e.g., hospitals, pharmacies, laboratories) to contact their patients and beneficiaries who have recovered from COVID-19 to inform them about how they can donate their plasma containing antibodies (convalescent plasma) to help treat others with COVID-19. In the updated guidance, OCR adds health plans and explains how HIPAA permits covered health care providers and health plans to identify and contact patients and beneficiaries who have recovered from COVID-19 for individual and population-based case management or care coordination.

The guidance also reemphasizes that when using or disclosing protected health information (PHI) for health care operations, the provider or health plan must make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose of the use or disclosure. Also, OCR reminds providers and health plans that while they can identify and contact individuals for the care coordination or case management activities described in the guidance without authorization, they can only do so to the extent that it does not constitute marketing, as defined in HIPAA. 

[View source.]