In updated guidance under the HIPAA Privacy Rule, HHS has addressed when health plans and health providers (as HIPAA covered entities (CEs)) may contact individuals who have recovered from COVID-19, the disease that results from SARS-CoV-2, to inform them about how they can donate their plasma containing antibodies to help treat others with COVID-19 (see also HHS's related press release and Article, Group Health Plan Coverage Mandate for SARS-CoV-2, COVID-19, and Serology Testing). First issued in June 2020, the guidance originally applied only to health providers (see Practice Note, COVID-19 Compliance for Health and Welfare Plans: HIPAA Privacy and Related Issues).

Under the Privacy Rule, CEs generally may use or disclose protected health information (PHI) for treatment, payment, and health care operations without first obtaining an individual's authorization (see Practice Note, HIPAA Privacy Rule: Permitted and Prohibited Uses and Disclosures of Health Information). Health care operations include case management and care coordination activities undertaken by a health plan that do not fall under the authorization exception for treatment.

Under HHS's guidance, health plans may use PHI (such as COVID-19 test results) to identify and contact individuals who have recovered from COVID-19 to inform them about how to donate their plasma. (Blood plasma collected from individuals who have recovered from an infection is called convalescent plasma.) These actions are permitted as health care operations activities to the extent that facilitating the supply of donated convalescent plasma is expected to improve a health plan's or provider's ability to conduct case management for individuals who have or may become infected with COVID-19.

The guidance requires CEs that use or disclose PHI for health care operations to limit their uses or disclosures to the minimum necessary for the purpose (see Practice Note, HIPAA Privacy Rule: Minimum Necessary Standard).

Health plans and providers may identify and contact individuals who have recovered from COVID-19 regarding convalescent plasma donations, without authorization, if doing so does not constitute marketing. Citing the Privacy Rule, the guidance defines marketing as a communication about a product or service that encourages the communication's recipient to purchase or use the product or service (see Practice Note, HIPAA Privacy Rule: Marketing, Sales, and Research). Uses or disclosures of PHI for marketing purposes without an individual's authorization are not allowed under the Privacy Rule.

Subject to exceptions, communications that inform or encourage individuals who have recovered from COVID-19 about the means and benefits of donating plasma, and that encourage the individuals to use a particular blood or plasma donation center for those donations, are not allowed. Under one exception to the general prohibition, however, a health plan or provider may make a communication for its case management and related health care operations activities if the CE receives no direct or indirect payment from (or on behalf of) the third party whose service is being described in the communication (for example, a blood or plasma donation center).

CEs generally cannot disclose PHI to a third party (including another CE), without the individuals' authorization, for the third party to make marketing communications about the third party's products or services—unless the third party is making the communication on the CE's behalf (that is, as a business associate) (see Standard Document, HIPAA Business Associate Agreement). For example, a health plan cannot disclose PHI about individuals who have recovered from COVID-19 to a blood or plasma donation center, for the donation center's own purposes. The health plan in this example would need to obtain the individuals' authorization before making the disclosure.

COVID-19 survivors who have undergone serology testing and been contacted by their health plan or provider about donating plasma may have wondered whether those conversations were consistent with HIPAA's privacy safeguards. Although this guidance explains the basis for such conversations from a Privacy Rule perspective, it also includes significant restrictions with which CEs must abide—particularly as to marketing and not promoting a particular blood or plasma donation center. Those lines would be easy to cross, so CEs should become familiar with the guidance's marketing and other limitations before contacting participants and patients.