OCR Updates Guidance for Contacting Recovered COVID-19 Patients About Blood Donations

With a few exceptions, the HIPAA Privacy Rule prohibits the use or disclosure of protected health information (PHI) for marketing purposes.

A version of this article was first published August 25, 2020, by HCPro's Revenue Cycle Advisor, a sibling publication to HealthLeaders.

The Office for Civil Rights (OCR) issued amended guidance on August 24 regarding covered entities (CE) and health plans contacting patients who have recovered from the novel coronavirus (COVID-19) to inform them about donating blood to help other COVID-19 patients.

In the original guidance, which was issued in June, OCR stated that the HIPAA Privacy Rule would permit CEs and business associates (BA) to contact previous COVID-19 patients and provide them with information about donating blood and plasma.

Under the amended guidance, health plans are also permitted to engage in this activity.

CEs and health plans do not need authorization to contact individuals for this purpose, according to OCR, but they cannot engage in any activity that can be considered marketing.

OCR defines marketing as a communication about a product or service that encourages the recipient of the communication to purchase or use the product or service.

With a few exceptions, the HIPAA Privacy Rule prohibits the use or disclosure of protected health information (PHI) for marketing purposes.

Under one exception, the CE or health plan can engage in the communication described above for population-based case management and related healthcare operations activities so long as the CE or health plan is not receiving direct or indirect payment from the third party whose service is being described to the individual, such as the blood and plasma donation center.