Health Plans May Now Use PHI to Inform Certain Participants about Plasma Donation for Battling COVID-19
Department of Health and Human Services (“HHS”) updated HIPAA guidance to allow health plans—including fully insured and self-funded group health plans—to use Protected Health Information (“PHI”) for the purpose of disclosing information to participants who have recovered from COVID-19 about how the participant can donate plasma to help battle the COVID-19 pandemic.
HIPAA Guidance on Plasma Donation
In June of 2020, the Office of Civil Rights (“OCR”) of the HHS—which is the agency that has jurisdiction to enforce HIPAA—issued guidance allowing health care providers (e.g., hospitals, pharmacies, laboratories, etc.) to use PHI to identify individuals who have recovered from COVID-19. With certain limitations, a health care provider can use an individual’s PHI to provide the individual with information regarding plasma donation for purposes of combating COVID-19. According to the OCR guidance, the use of PHI by a health care provider to provide an individual with information regarding plasma donation is permissible under HIPAA’s permitted disclosure for “health care operations” (specifically, case management and care coordination).
In August of 2020, OCR extended that guidance from health care providers to health plans. (The updated OCR guidance is available here.) The guidance does, however, provide the following warnings:
- The use of PHI for health care operations is subject to HIPAA’s minimum necessary rule. As a result, when using PHI to provide participants with information about plasma donation, a health plan must limit its use and disclosure of a participant’s PHI to the minimum amount necessary to accomplish the purpose of providing the participant with information about plasma donation.
- A health plan should provide a participant with information about how to donate plasma, but not encourage the use of a specific donation center. If a health plan encourages the use of a specific donation center, the health plan should not receive any direct or indirect compensation from the donation center.
- A health plan should disclose information about plasma donation directly to participants. It should not disclose a participant’s PHI to a donation center so that the donation center can contact participants about plasma donation (unless the participant has authorized this disclosure).
If an employer-plan sponsor is interested in providing participants in its group health plan who have recovered from COVID-19 with information about plasma donation, the employer should contact its insurer (if its group health plan is fully insured) or its third-party administrator (if its group health plan is self-funded) to coordinate providing participants with this information.
If you have any questions, please contact the author of this alert or another member of the Employee Benefits Practice Group.