In this unprecedented time with worldwide infection of COVID-19, there are provisions within the HIPAA Privacy Rule to address use and disclosure of patient information in a public health emergency to aid in prevention and control of the spread of disease. While this provision addresses use and disclosure to authorized public health authorities, Covered Entities and Business Associates must continue to safeguard patient information from impermissible uses and disclosures.
Refer to the bulletin released by the Office of Civil Rights (OCR) in February 2020 at this link OCR HIPAA Privacy and COVID-19 for more information regarding HIPAA Privacy Rule relating to infectious disease control.