Q&A: Disclosing COVID-19 test results in sports leagues
Q: As sports leagues attempt to make their return, many are going to be using daily COVID-19 testing as part of their protocol. Obviously, the leagues need to quarantine any individual who tests positive for the virus. But why is the covered entity that is performing the testing allowed to disclose a patient’s test results to the leagues?
A: It all depends on who is conducting the testing and who the testing is being done for. If the leagues are paying healthcare professionals to conduct the test, the healthcare professional would not be acting as a covered entity. As an example, Alluvium, a Salem, Oregon–based nonprofit group of volunteer healthcare professionals, is conducting employment site testing, and the employers are paying for the tests (as opposed to an insurance company paying for the tests). Alluvium is not a covered entity healthcare provider because Alluvium does not bill any health plan. It does not send and receive HIPAA-covered transactions.
If the tests are paid for using health insurance, the covered entity is limited on what it can share with, in this case, the leagues. HIPAA does permit the limited sharing of PHI with employers pursuant to 45 CFR § 164.512(b)(1)(v). Covered entities can disclose PHI to an employer about a workforce member if the covered entity provides healthcare to that member at the employer’s request to conduct an evaluation relating to medical surveillance of the workplace, or to evaluate whether the member has a work-related illness or injury. The disclosure of PHI needs to consist of findings concerning a work-related illness or injury or workplace-related medical surveillance.
Outside of these limited exceptions, covered entities would need a signed authorization from the person being tested if the tests are paid for by a health plan on behalf of the individual. If the covered entity is conducting workplace-related medical surveillance, the covered entity is required to provide written notice to the individual that PHI relating to the medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer. This notice is given at the time the healthcare is provided. If the healthcare is provided on the employer’s work site, notification would be provided by posting the notice in a prominent place at the location where the healthcare is provided.
Editor’s note: Chris Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.