New HIPAA Law Guidelines for Contacting Recovered Covid-19 Patients About Blood and Plasma Donations

More than 2.3 million Americans are known to have contracted coronavirus. Despite a massive worldwide response to the pandemic, information on the virus remains limited. Treatment options continue to lag behind demand, as well. 

This lag has been due in part to healthcare providers' concerns about breaking HIPAA laws. As a result, the Office of Civil Rights  (OCR) recently issued clarifications related to HIPAA law and COVID-19. Here's what you need to know.

Why Contact COVID Patients? 

Since the start of the COVID-19 pandemic, demand for the blood of recovered patients has been high. Researchers are strongly interested in studying it. Specifically, they want to investigate the antibodies these patients' blood contains. 

The Human Immune System

When humans contract respiratory illnesses and other viruses, their immune systems fight back. Part of that immune response is the creations of antibodies. Antibodies allow our bodies to recognize and fight off an illness if we encounter it again. 

Antibodies are specific to a single illness. Each time we contract a new illness, our bodies create new antibodies for it. 

Our bodies are not the only thing that can use antibodies to protect us. Researchers can use antibodies from one person to confer protection on others. They can use them to make vaccines and medications.

They can also study them in hopes of developing new treatments. To do this, researchers need convalescent plasma and hyperimmune immunoglobulin from recovered patients. 

This is where HIPAA concerns come in. 

What Is HIPAA Law Around COVID-19?

Healthcare providers want better treatment options for COVID-19. They know blood from recovered patients is key to getting those treatments. 

This gave providers a strong desire to encourage blood and plasma donation. After all:

• Even small encouragements could increase donation rates
• More donations would make more research possible
• More research would result in more effective treatments
• More effective treatments will save hundreds of thousands of lives 

Unfortunately, doctors were hesitant to act on this desire because of HIPAA. HIPAA rules limit when and why doctors may contact patients or share their PHI.

Most doctors believed that blood donation requests were a form "marketing communications." These are expressly forbidden by HIPAA unless patients have authorized them. They are punishable with HIPAA law enforcement consequences.

Given the heavy fines the OCR has been handing down for violations in recent years, this is no small concern.

New Guidance 

OCR issued new guidance in early June of 2020 clarifying that providers may contact recovered coronavirus patients to encourage them to donate blood and plasma. They may do so even if the patient did not previously agree to marketing communications. 

This exception to the rule is justified as follows:

• HIPAA covered entities are legally allowed to contact all patients or share their PHI in the course of "healthcare operations"
• The blood and plasma being requested will play a key role in "population-based health care operations"
• "Population-based health care operations" are considered explicitly covered under the broader scope of "healthcare operations"

As a result, providers are legally permitted to contact recovered patients and ask them to donate blood and plasma. Doing so will not violate the HIPAA law restrictions or open them up to penalties. 

In fact, OCR strongly encourages providers to let their patients know about the value and importance of donating blood and plasma for research. 

Appropriate Procedures

OCR's clarification on this point is not a blanket approval, however. Restrictions apply. Under the official definition of HIPAA and its protections providers cannot make money from patients' blood donations. 

Importantly, this applies to both direct and indirect profits. Healthcare providers and operations cannot fiscally benefit in any way from their patients' decision to donate blood. If they do, then the communication is considered illegal marketing and subject to penalty.

Providers also cannot access or release any more PHI than absolutely necessary in the process. 

This means that they must:

• Restrict access to patient records as much as possible
• Word their requests carefully
• Not promote any donation centers they are linked to or may benefit from in any way

Generally, this means that providers will need to:

• Contact patients themselves rather than engaging a third party to do so
• Carefully control who on staff has access to the patient contact list
• Deliver a standardized message about the value of donating blood after recovering from COVID-19
• Direct patients to where they can find information on donating blood in their community
• Recommend only non-profit blood drives or collection centers if they suggest one by name

This will prevent providers from disclosing patient PHI to third parties in potentially prohibited manners. It will also protect them from violating HIPAA law around marketing messages.

Keeping Your Staff Up-To-Date on HIPAA

As the recent clarifications and changes to HIPAA guidance show, HIPAA law is an ever-evolving thing. Keeping your staff up-to-date is vital. It can also be challenging. 

HIPAA Exams can help. Our course bundles can provide comprehensive training for your staff on everything from OSHA and HIPAA law to age-appropriate care and state-specific healthcare laws. Our one-off courses can fill in training gaps you may find. 

We even offer back-of-house courses for your HR and physical plant employees.

Our courses offer the ultimate in convenience to making managing your operation as easy as possible.

• Courses are available online 24/7
• Each course is compact and concise, making the best use of employee time
• Each course has a comprehension test at the end to measure employee progress
• Printable course completion certificates make it easy to record and prove training progress 
• Pre-bundled courses make getting employees the right courses fast and simple
• Group pricing means you get the most affordable support available 

In addition, we're constantly adding new courses in response to market need. Our COVID-19 compliance course is the perfect example. 

Make HIPAA Compliance Easy

If all of that sounds like exactly what you need, let our team help you make HIPAA law compliance at your facility easy. Check out our complete list of courses today.

Have questions? Contact us! Our responsive customer care team is here to help any time.