Q&A: COVID-19 and the media

Q: When dealing with a public health emergency, which disclosures are permitted to the media and which are not? Does HIPAA allow for any identifiable information to be disclosed to news organizations if the intention is to protect the public at large?

A: Protected health information (PHI) may not be disclosed to the media during a public health emergency without specific authorization from the patient. You may share a list of patients who have tested positive for COVID-19 with public health agencies, but you are not permitted to share the same list with the media. It is permissible to disclose de-identified information about those infected so long as the method of de-identification is consistent with OCR guidance.

Just because a national public health emergency is occurring doesn’t mean requirements regarding disclosure to the media are not applicable during the emergency. OCR has publicly noted that enforcement will be eased when it comes to the use of video conferencing platforms and releases to public health authorities. However, OCR has not announced it is permissible to disclose PHI to the media without patient authorization.

Editor’s note: Chris Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.