Skip to Main Content
Services Talent Knowledge
Site Search


Our attorneys stay on top of changes in legislation, agency regulations, case law, and industry trends—then craft timely legal alerts to keep clients up to date on legal developments important to their business.

April 2, 2020

COVID-19: OCR Issues Guidance to Help Ensure First Responders, Others Receive PHI From Individuals Exposed to Virus

On March 24, the Office for Civil Rights at the US Department of Health and Human Services provided guidance on how covered entities may disclose protected health information (PHI) about an individual who has been infected with or exposed to COVID-19 to law enforcement, paramedics, other first responders, and public health authorities in compliance with the Health Insurance Portability and Accountability Act (HIPAA) rules.

The HIPAA rule allows covered entities to disclose, without authorization, the PHI of individuals infected or exposed to COVID-19 in the following circumstances:

  • When the disclosure is needed to provide treatment
  • When the notification is required by law
  • To notify a public health authority to prevent or control the spread of the disease
  • When first responders may be at risk of infection
  • When disclosing PHI to first responders is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public

Unless required by law or for treatment disclosures, covered entities must make reasonable efforts to limit the information used or disclosed under any of the circumstances above to the “minimum necessary” to accomplish the purpose for the disclosure. Multiple provisions can apply simultaneously, and disclosure for each provision should be limited to the minimum necessary. The purpose of the guidance is to ensure that first responders have greater access to real-time infection information to help keep them and the public safe.

HIPAA-covered entities protected by these provisions are not exempt from the law’s privacy rules. Before disclosing information, health care providers should consult local and state statutes and regulations in their jurisdiction, as these laws may place further restrictions on disclosures that are permitted by HIPAA.

New York State also requires that, unless required by law or compliance review, disclosure shall be the “minimum necessary” needed to accomplish the intended purpose of the use, request, or disclosure. 

Barclay Damon attorneys will keep you updated of any further significant developments related to COVID-19 and emergency responders.

If you have any questions regarding the content in this alert, please contact Kadeem Wolliaston, associate, at or another member of the firm’s Health Care & Human Services Practice Area.

We also have a specific team of Barclay Damon attorneys who are actively working on assessing regulatory, legislative, and other governmental updates on non-trademark-related COVID-19 matters and who are prepared to assist clients. You can reach our COVID-19 Response Team at


Click here to sign up for alerts, blog posts, and firm news.

Featured Media


NYS Department of Health Publishes Amended Proposed Cybersecurity Regulations for Hospitals


FTC Noncompete Rule Survives—For Now


New York Trial Court Finds Uber Is Not Vicariously Liable for Driver's Negligence


ERISA Forfeiture Lawsuits: Navigating the Emerging Legal Landscape


EU Leads the Way on Artificial Intelligence Regulation


End of An Era: SCOTUS Overturns Chevron After 40 Years of Deference to Administrative Agencies

This site uses cookies to give you the best experience possible on our site and in some cases direct advertisements to you based upon your use of our site.

By clicking [I agree], you are agreeing to our use of cookies. For information on what cookies we use and how to manage our use of cookies, please visit our Privacy Statement.

I AgreeOpt-Out