OCR issues guidance for contacting recovered COVID-19 patients about blood donations

The Office for Civil Rights (OCR) issued guidance June 12 for healthcare providers interested in contacting former novel coronavirus (COVID-19) patients about donating blood and plasma that could help other COVID-19 patients.

Under HIPAA, a covered entity (CE) is permitted to use protected health information (PHI) to identify patients who have recovered from COVID-19 and provide them with information about how they can donate their blood and plasma. As OCR explained, the HIPAA Privacy Rule allows CEs—or business associates acting on the behalf of the CE—to use or disclose PHI for treatment, payment, and healthcare operations, among other purposes, without an individual’s authorization.

According to OCR, population-based activities aimed to improve health, such as the donation of blood and plasma containing antibodies, would fall under the umbrella of healthcare operations.

While it is permissible for a CE to contact former COVID-19 patients and make them aware of the possibility of donating blood, the CE cannot engage in any communication that could be considered marketing. According to OCR, marketing is a communication about a product or service that encourages the recipient of the communication to purchase the product or service. With a few exceptions, the HIPAA Privacy Rule prohibits the use or disclosure of PHI for marketing purposes.

Under one exception, the CE is permitted to engage in such a communication for population-based case management and related healthcare operations activities so long as the CE is not receiving direct or indirect payment from the third party whose service is being described in the communication (such as the blood and plasma donation center).

Likewise, the CE cannot share patient PHI with a third party in order for the third party to make marketing communications regarding its services. Therefore, a hospital cannot disclose PHI to a blood donation center and allow the donation center to contact individuals for its own purposes.